Disclos / AI Transparency / DPA AI Addendum
DPA AI Addendum
Effective date2026-05-31
PartiesDisclos Research Practice ("Provider") and [Client legal entity] ("Customer" or "Controller")
StatusAddendum to the executed Data Processing Agreement dated [date of underlying DPA]
This Addendum supplements the existing Data Processing Agreement between the Parties with specific terms governing the use of artificial intelligence in the Provider's services under Regulation (EU) 2024/1689 (the EU AI Act) and Regulation (EU) 2016/679 (the GDPR). Where this Addendum conflicts with the underlying DPA, this Addendum prevails for AI-related processing.
This is the standard AI Addendum Disclos Research Practice attaches to client engagements. Client-specific fields appear in square brackets and are completed per engagement.
1. Definitions
The following definitions apply in addition to those of the underlying DPA:
- AI system has the meaning given in Article 3(1) of Regulation (EU) 2024/1689.
- Deployer has the meaning given in Article 3(4) of Regulation (EU) 2024/1689.
- GPAI model has the meaning given in Article 3(63) of Regulation (EU) 2024/1689.
- High-risk AI system means an AI system classified as high-risk under Article 6 of Regulation (EU) 2024/1689.
2. AI features in scope
The Provider's services incorporate the following AI feature, described in the corresponding model card:
| Feature | Surface | Model | Role |
|---|---|---|---|
| Disclos Audit Engine | Internal back-office. Not user-facing. | Anthropic Claude (Sonnet 4.6, Opus 4.7) | Downstream GPAI use; output human-reviewed |
3. Provider and Deployer roles
| Feature | Provider role under the AI Act | Customer role under the AI Act |
|---|---|---|
| Disclos Audit Engine | Downstream deployer of a GPAI model. Not a GPAI provider. Not a high-risk system. | None for this feature. The Customer receives a human-reviewed deliverable and does not operate the engine. |
4. Transparency (Art. 50)
The audit engine does not interact with the Customer's data subjects, so no end-user Article 50 disclosure is triggered by this feature. The Provider's wider Article 50 position is recorded in the AI Transparency Notice at https://www.disclos.eu/ai-transparency.
5. High-risk obligations
No AI feature in scope is high-risk under Annex III or Article 6. The high-risk conformity track (Articles 9 to 15, 49) is not engaged. If the Provider later introduces a high-risk feature, this section is updated and the full track applies before deployment.
6. Customer (Deployer) obligations
The Customer does not act as a deployer of any high-risk feature under this engagement. Should the Customer deploy any high-risk AI of its own, Article 26 obligations apply to the Customer independently of this Addendum.
7. GPAI suppliers
The Provider uses a third-party GPAI model supplied by Anthropic, PBC (Claude). The upstream supplier's Article 53 documentation is incorporated by reference and made available to the Customer on request. The Provider does not use the model to train on Customer data, and the supplier's default is not to train on API inputs.
8. Sub-processors
AI processing by sub-processors is permitted only after notice and Customer non-objection per the underlying DPA. The current sub-processor providing AI-related processing is Anthropic, PBC (Claude API).
9. Audit rights
The Customer may, no more than once per twelve months and on thirty days' written notice, audit the Provider's compliance with this Addendum, including review of the model card, the Article 12 logs (anonymised where data subjects are involved), and the risk management documentation.
10. Term and termination
This Addendum is co-terminous with the underlying DPA. On termination, the Provider shall return or delete AI-feature-related Customer Personal Data per the underlying DPA, including any embeddings or derived representations.
Disclos is not a law firm. Researched compliance reference. Not legal advice.