Legal
Responsible AI and data protection
A short, honest summary of how AskEU handles AI risk and personal data. It is our own assessment, not a legal opinion or a certification.
What AskEU is and is not
AskEU is an information service about healthcare rights. It does not diagnose, recommend treatment, handle medical records or make decisions about anyone. Using it needs no account, and it never asks for health data.
EU AI Act: our assessment
- Transparency (Art. 50): people are told they are talking to an AI, and every AI-written answer is labelled as AI-generated.
- Risk class: we assess AskEU as a limited-risk system. It is not used to decide access to benefits or services and does not triage emergencies, so it does not fall under the high-risk uses in Annex III.
- Our role: we deploy a third-party general-purpose AI model. The rule library, the instructions and the checks are ours.
- We will reassess if the scope changes, for example if a public body wants to use AskEU to decide eligibility.
GDPR: our assessment
- Data we process: for early access an email, country, status category, language and optionally an organisation and a question. Conversation logs are pseudonymised and kept for 90 days.
- Legal basis: consent, contract and legitimate interest (Art. 6(1)(a), (b), (f)). Data is hosted in the EU. People can ask for access, correction or deletion at privacy@ask.eu.com.
- Sensitive data: we never ask for it, but people may type it into a free-text question. We warn against it, keep logs short and delete on request.
- DPIA: we assess that a full data protection impact assessment (Art. 35) is not required at this stage, because there is no systematic monitoring and no large-scale processing of health data. This summary is our lighter version. We will do a full DPIA before scaling or adding accounts or health-related features.
Main risks and what we do about them
| Risk | What we do |
|---|---|
| Wrong or outdated answer | Answers may only use a closed library of checked rules. Every point links to a rule and its official source, and unverified points are removed. Rules that are changing carry a warning. If no rule applies, the AI says so. |
| Medical emergency | A 112 notice is on every page, and the AI is instructed to put calling 112 first when an emergency is mentioned. AskEU states clearly that it is not an emergency service. |
| Sensitive data typed in | Neither the forms nor the AI ask for them, a notice says not to share them, logs are pseudonymised and deleted after 90 days, and people can ask for deletion any time. |
| Vulnerable users and misunderstanding | Newcomers and refugees may misread an answer or rely on it too much. We use plain wording in four languages, keep official terms in brackets so they match forms, always name who to ask, and repeat the disclaimer where answers appear. |
| Dependence on one AI provider | The rule library and the checks belong to AskEU and are separate from the model, so the model can be replaced. Only the question text is sent to the model, not early access data. |
| Security incident | No accounts and minimal data. Strict security headers and a content security policy, EU hosting and rate limits on the AI service. If personal data is affected, we report to the authority within 72 hours as the GDPR requires. |
Next steps
- Independent legal review of this assessment before public launch.
- Accuracy testing against published targets before launch.
- A full DPIA before scaling or adding accounts.
- Questions: privacy@ask.eu.com