AI · 06
Deploying an AI assistant: a CISO guide
What to check before you switch on an AI assistant (a chat panel, a "sparkle" button) over business data — for teams in the EU, Germany, the US and Canada.
Last reviewed 13 October 2026. Orientation, not legal advice — laws and vendor terms change; confirm with your counsel and the vendor's current documents.
The one idea
An AI assistant is a new data flow, not just a new feature. Every question sends text — and often the data on screen — to a model that runs somewhere. Secure it the way you would any processor of your data: know what leaves, where it goes, who can use it, and what is kept.
Answer those four and most of the regulation falls into place.
The four questions
What leaves
The prompt, chat history, and any data the tool adds behind the scenes — page context, query results, customer names. Ask for the exact payload, not a summary.
Where it goes
Which model provider, which country, which sub-processors. A model endpoint is a sub-processor like any other.
Who can use it
SSO, roles, and a central off switch — per tenant or per role, not just a user preference.
What is kept
Prompt and answer retention at the vendor and the model provider; whether data is used for training; whether use is logged for audit.
Controls to ask for
- Data minimisation — send only what the question needs; mask or drop personal data (names, IDs) before it reaches the model.
- Choice of endpoint and region — an OpenAI-compatible or private endpoint you control, in a region you approve.
- No training on your data, in writing, from the vendor and the model provider.
- Admin kill switch and role-based access — off by default for users who don't need it.
- Audit trail — who asked what, when, which data was used; with a defined retention period.
- Human in the loop — answers are drafts; nothing is filed, posted or decided automatically.
- Red flags — "it's just a chat", no sub-processor list, no region answer, on-by-default with no admin control.
Security threats to plan for
Privacy is half the job. An assistant also opens new ways in.
- Prompt injection — text hidden in a document, email or data record can give the model instructions. Treat anything the assistant reads as untrusted input.
- Data leaking out — an injected instruction can make the answer carry data away, for example in a link or image address. Block or check outgoing links and images in answers.
- Seeing too much — the assistant must only see what the asking user is allowed to see, using that user's own permissions in the source system, not a powerful service account.
- Acting too much — if it can call tools or change data, limit what it may do and require a person to confirm.
The common reference is the OWASP Top 10 for LLM Applications (link below).
By region
Status as of October 2026. Laws here are moving — confirm with your counsel; this is orientation, not legal advice.
European Union
GDPR applies to any personal data in prompts: a processing agreement with the vendor (Art. 28), a DPIA where risk is high (Art. 35), a lawful basis for the processing (Art. 6), and — if data leaves the EEA — a transfer mechanism such as an adequacy decision or Standard Contractual Clauses (Chapter V). EU AI Act: the AI-literacy duty (Art. 4) applies since February 2025 — since July 2026 (Regulation 2026/1744) it means taking measures that build staff literacy, not guaranteeing a set level, and national authorities can enforce it since August 2026; transparency duties (people must know they're dealing with AI) since August 2026. The high-risk rules were postponed to December 2027 — an assistant for tax analysis is typically not high-risk, but check your use.
Germany
Everything in the EU row, plus: works council co-determination — a tool that can monitor employee behaviour or performance needs agreement first (§87(1) no. 6 BetrVG); usage logs count. Cloud vendors are commonly asked for a BSI C5 attestation. The data protection authorities' joint AI guidance (DSK, May 2024) is a useful checklist. Professional secrecy: tax advisers and other secrecy-bound professions need more than a DPA — §203 StGB and, for tax advisers, §62a StBerG require the provider to be bound to confidentiality in text form (see the BStBK's AI FAQ, February 2026).
United States
No single federal AI law. Expect a patchwork: state laws (Texas since January 2026; Colorado's replacement act from January 2027), state privacy laws such as California's rules on automated decision-making, and sector rules. Federal policy is pushing to pre-empt state AI laws but has not done so. NIST AI RMF is the common reference for a risk programme; SOC 2 for the vendor.
Canada
No federal AI act — the proposed AIDA lapsed in January 2025. PIPEDA governs personal data in prompts, including cross-border transfers. In Quebec, Law 25 requires telling people when a decision about them is made solely by automated processing — keep a human deciding.
An EU region is not the same as EU control. A provider with a US parent can be subject to US law (such as the CLOUD Act) wherever the data sits. If that matters to you, ask about EU-operated clouds or self-hosting an open-weight model — and apply the same four questions to them.
Use case 1 — Anthropic (Claude): API, Team or Enterprise
The four questions answered for one provider, from Anthropic's published terms as checked in October 2026. Confirm against the current versions before you sign.
Two ways in: Claude Team / Enterprise — the ready-made Claude app for your staff; or the Claude API — the model behind an assistant built into your own software. Both are "commercial" products, so the same core terms apply.
What leaves
Whatever your users type or upload (Team/Enterprise), or whatever your application puts in the request (API). With the API, you decide the payload — that's where data minimisation happens.
Where it goes
Anthropic's direct API offers inference in "us" or "global" only, and stores data in the US; there is no EU-only option yet. For EU processing, Claude is also offered through Amazon Bedrock and Google Cloud Vertex AI in EU regions — then that cloud provider's terms and region apply. Claude is also in Microsoft Foundry, but as of October 2026 only as Global or US Data Zone, with Anthropic as the processor — no EU option yet.
Who can use it
Team includes SSO. Enterprise adds SCIM provisioning, role-based access, domain capture, audit logs and a Compliance API. For the API, access is through keys and workspaces you control.
What is kept
By default, commercial inputs and outputs are not used for training. API inputs and outputs are deleted within 30 days; zero data retention is available by agreement. Team/Enterprise chats are kept in the product so users can return to them; a deleted chat is removed from back-end storage within 30 days, and Enterprise admins can set custom retention. Ask which features a zero-retention agreement covers. Exceptions: feedback users submit (thumbs up/down) is kept up to 5 years and may be used for training — admins can turn it off — and content flagged for policy violations is kept longer.
- Contract: the Data Processing Addendum, with EU Standard Contractual Clauses, is part of Anthropic's Commercial Terms — accepting them accepts the DPA. Via Bedrock or Vertex, the cloud provider's terms govern instead.
- Assurance: Anthropic lists ISO 27001:2022, ISO/IEC 42001:2023 (AI management) and SOC 2 Type I & II for its commercial products; reports via its Trust Portal.
- Check for Germany/EU: if prompts may contain personal data and must stay in the EU, use an EU cloud region route — the direct API won't meet that today.
- Turn off feedback submission if staff might rate chats containing sensitive data.
Anthropic's own pages
Use case 2 — Azure OpenAI (Microsoft Foundry)
The same four questions for OpenAI models run by Microsoft in Azure, from Microsoft's published documentation as checked in October 2026. Confirm against the current versions before you sign.
Azure OpenAI runs OpenAI's models inside Microsoft's Azure, in your own Azure subscription. It does not call OpenAI's own services (ChatGPT, the OpenAI API) — your contract and data protection terms are with Microsoft.
What leaves
Whatever your application puts in the request — prompt, history, retrieved data. As with any API, you decide the payload.
Where it goes
You pick the region and a deployment type: Standard (regional) processes within the resource's geography; Data Zone EU processes within Microsoft's EU Data Boundary — which can include EFTA countries such as Norway and Switzerland, and Microsoft can add regions without notice; Global may process in any geography. Data at rest stays in your chosen geography in every case. Batch jobs come as Global Batch or Data Zone Batch — pick the Data Zone one for EU work.
Who can use it
Standard Azure controls: Microsoft Entra ID sign-in, Azure role-based access, network isolation (private endpoints), and Azure's logging and monitoring.
What is kept
Prompts and outputs are not used to train models and are not available to OpenAI. The models are stateless; only optional features (Responses/Assistants history, stored completions, uploaded files) store data — in your resource, encrypted, deletable by you, customer-managed keys optional.
- Contract: the Microsoft Products and Services Data Protection Addendum (DPA) governs processing.
- Assurance: Microsoft reports ISO/IEC 42001 (AI management) certification for Foundry Models including Azure OpenAI; Azure holds a combined BSI C5 / SOC 2 Type 2 report — confirm Azure OpenAI is in its scope via the Service Trust Portal.
- Abuse monitoring: by default, flagged prompts and outputs may be stored and reviewed — by automated means, and by authorised Microsoft staff when needed (EEA-based staff for EEA deployments). Customers meeting Limited Access criteria can apply to turn off storage and human review — worth doing for confidential data.
- Check for Germany/EU: choose an EU region with a Standard or Data Zone EU deployment — Global can process outside the EU, and Data Zone EU may include Norway or Switzerland.
Microsoft's own pages
Use case 3 — Amazon Bedrock (AWS)
The same four questions for models run through AWS, from AWS's published documentation as checked in October 2026. Confirm against the current versions before you sign.
Bedrock offers models from several providers — Anthropic, OpenAI, Meta, Mistral, Amazon and others — through one AWS service, in your own AWS account. Your contract and data protection terms are with AWS, not the model provider.
What leaves
Whatever your application puts in the request. As with any API, you decide the payload.
Where it goes
Call a model in one region, or use an inference profile: geographic (e.g. EU — routed only between regions in that geography) or global (any AWS commercial region). Traffic stays on the AWS network; CloudTrail records which region processed each request.
Who can use it
Standard AWS controls: IAM and IAM Identity Center, organisation policies (SCPs) to restrict models and regions, private connectivity (PrivateLink), KMS encryption, and CloudTrail for API activity.
What is kept
By default Bedrock does not store prompts or outputs, and its operators can't access them. Models run in AWS-owned accounts that model providers cannot access. Full prompt/output logging exists but is off by default — when you turn it on, it goes to your own S3 or CloudWatch.
- Contract: AWS's GDPR Data Processing Addendum is part of the AWS Service Terms. Fine-tuning uses a private copy of the model; that data isn't shared with model providers or used to improve base models.
- Assurance: AWS lists Bedrock in scope for BSI C5 and SOC 1/2/3, and certified under ISO/IEC 42001 (AI management); reports via AWS Artifact.
- Check the exact model: for some newer models AWS stores traffic for up to 30 days for automated abuse detection — for certain frontier models all traffic, with possible human review of flagged items. Read the abuse-detection page for the model you pick.
- Check for Germany/EU: use an EU region or an EU geographic inference profile — a global profile can process outside the EU.
AWS's own pages
Use case 4 — Google Cloud Vertex AI (now Gemini Enterprise Agent Platform)
The same four questions for models run through Google Cloud, from Google's published documentation as checked in October 2026. Confirm against the current versions before you sign.
Google has renamed Vertex AI the Gemini Enterprise Agent Platform; contracts and older documents may still use the old name. It offers Google's Gemini models and partner models (such as Anthropic's Claude) in your own Google Cloud project. Your contract and data protection terms are with Google Cloud.
What leaves
Whatever your application puts in the request. As with any API, you decide the payload.
Where it goes
Pick the endpoint: regional (e.g. Frankfurt, europe-west3) keeps processing within that jurisdiction — for some models in-country; the EU multi-region keeps it within EU member states (not the UK or Switzerland); the global endpoint can process anywhere and gives no residency guarantee. Data at rest stays in the location you chose.
Who can use it
Standard Google Cloud controls: IAM, organisation policies (including blocking the global endpoint), VPC Service Controls, customer-managed encryption keys, and Cloud Audit Logs.
What is kept
Google won't train or fine-tune on your data without permission. Gemini caches requests in memory for up to 24 hours by default (an admin can switch this off); request/response logging is off by default.
- Contract: the Google Cloud Data Processing Addendum governs processing.
- Assurance: Google Cloud holds a BSI C5 attestation and reports ISO/IEC 42001 certification for Google Cloud Platform — confirm Vertex AI is in each scope via its compliance pages.
- Zero retention takes work: Google may log prompts for abuse monitoring unless you get an exception; Grounding with Google Search keeps logs for up to 3 days and can't be switched off; some features (Interactions API, Sandbox) store data unless configured not to.
- Check for Germany/EU: use a European regional endpoint or the EU multi-region — and block the global endpoint by organisation policy.
Google's own pages
A sensible rollout
Map the data flow→Contract & DPIA→Pilot, small group→Review logs→Widen access
- Start with a pilot group and non-personal questions; widen once the logs show what people actually send.
- Write a one-page use policy — what may be asked, what must never be pasted, and that answers get checked.
- Train users on what the assistant can and can't do (see Understanding AI) — and keep a record: that documents the measures the EU AI-literacy duty asks for.
- Re-check yearly — and whenever the vendor changes its model or provider.
Go deeper (free, vendor-neutral)