Trust, privacy, and compliance

Configuring for GDPR, DORA, the EU AI Act, and sector rules

In brief: Unless supports GDPR and DORA configuration, EU AI Act transparency and oversight, and sector-specific guardrails.

Compliance configuration starts with the use case and the rules that apply to it. Unless provides technical controls and workspace settings to support those obligations, while the customer remains responsible for its role under the relevant rules.

Configure for the rules that apply

The requirements depend on how the Customer Agent is used. GDPR governs personal data, the EU AI Act governs the AI system, and DORA adds obligations for financial entities. Unless can also be configured for GDPR, DORA, and ISO 42001.

For GDPR, the customer is the controller and Unless is the processor. Personal data is screened for personally identifiable information (PII) when it enters the platform, and sensitive identifiers are tokenized before a model call. End users exercise access, rectification, and erasure rights through the customer’s dashboard, with a human confirming each request before changes are made.

For DORA, Unless is built to support the obligations of financial entities. Its ICT risk management aligns with ISO 27001 and ENISA guidance; incidents are disclosed under committed timelines, and subcontractors are disclosed with audit and termination rights retained by the customer.

Apply EU AI Act controls

The EU AI Act approach includes risk classification, transparency, audit, and human oversight. Most agentic deployments, including the Customer Agent, are described as limited-risk: the platform provides AI disclosure, a per-decision audit trail, and human review or override. If a specific use case qualifies as high-risk, Unless works with the customer in advance on the additional measures that apply.

Set sector-specific guardrails

Sector controls can be configured for entities supervised by BaFin and AFM. Guardrails for finance, HR, payroll, and healthcare are configured for those sectors rather than custom-built for each customer. Independent content silos also keep one customer’s data from training another customer’s agent.

Manage controls in the Compliance tab

The Compliance tab brings key controls into the workspace for legal, DPO, and security teams. It includes editable and exportable audit logs, risk classifications, retention rules, sub-processor inventory, and transparency reports. Its Privacy area provides settings to obfuscate PII during inference, remove it from user input, or filter it from training data by default.

Configuration brings the relevant controls together, but the right setup depends on the rules and use case involved. Use the Compliance tab to review and manage those controls in the workspace.