This is a draft. Each section offers an example: replace every [field] with what is true for you and delete the rest. Publishing it does not mean your use of AI complies with the AI Act, and Squaretrust does not check that it does.
AI tools and what they are used for
What the customer checks: which AI tools take part in the work you do for them, and what for.
Example to adaptWe use [tool] to [draft documents] and [tool] for [coding assistance]. No other AI tool is allowed without the approval of [role]. This list is reviewed every [quarter].
To attach: the list of tools (public).
Data sent to the tools
What the customer checks: that their data does not go into a tool unchecked.
Example to adaptOur customers’ data is only entered into [approved tools], and never [sensitive personal data, passwords, a customer’s code]. Into [tool], we only send [anonymised text].
To attach: the internal rules on AI use (on request).
Model training and retention
What the customer checks: that their data is not used to train a third party’s model.
Example to adaptFor [tool], training on our data is turned off [by contract / in the enterprise plan settings]. The provider keeps prompts for [30 days], then deletes them.
To attach: the relevant part of the provider’s contract or terms (on request).
Processing region
What the customer checks: where their data is processed, and whether it leaves the EU.
Example to adapt[Tool] processes data in [the European Union / the United States]. For processing outside the EU, the transfer relies on [standard contractual clauses / an adequacy decision].
To attach: nothing more: the subprocessor list gives the region.
AI providers and subprocessors
What the customer checks: that your AI providers are treated like your other subprocessors.
Example to adaptAI providers that process personal data are on our subprocessor list, with their purpose and region, and are bound by a data processing agreement. We tell our customers [x days] before adding one.
To attach: the subprocessor list (public).
Human review
What the customer checks: that a person stays responsible for what goes out.
Example to adaptAny content produced with the help of AI is reviewed by [a qualified person] before it is sent to a customer. No decision about a customer or a person is taken by AI alone.
Training and AI literacy
What the customer checks: that your staff know how to use AI and know its limits (Article 4 of the AI Act).
Example to adaptEvery employee who uses an AI tool has received [x hours of training / an internal guide] on allowed uses, the tools’ limits and the data not to enter. This material is updated every [year].
To attach: the internal guide or training programme (on request).
Transparency towards users
What the customer checks: that people know when they are dealing with AI (Article 50 of the AI Act).
Example to adapt[Our support assistant says it is an AI from its first message.] [We do not expose any automated assistant to our customers.] Generated content we publish is labelled as such [where relevant].