For customers
Disclosing AI: what belongs on your website.
If you use an Invariance system with AI, you remain responsible for the data. Part of the notices therefore has to come from you: to your customers, patients or clients and to your staff. This page shows which notices these are and gives you texts you can adopt.
Last updated: 5 November 2026
At a glance
| Who | What | Legal basis |
|---|---|---|
| All customers | a paragraph on AI in your privacy policy | GDPR Art. 13 |
| Clinics and practices in Italy | inform patients about the use of AI | Law no. 132/2025, Art. 7(3) |
| Professionals in Italy, such as tax advisers and lawyers | inform clients about the AI systems used | Law no. 132/2025, Art. 13(2) |
| Anyone who lets people communicate directly with an AI | make it recognisable that it is an AI | AI Act (Regulation (EU) 2024/1689), Art. 50, since 2 August 2026 |
| All customers | promote the AI literacy of your staff | AI Act, Art. 4 |
All customers
- What
- a paragraph on AI in your privacy policy
- Legal basis
- GDPR Art. 13
Clinics and practices in Italy
- What
- inform patients about the use of AI
- Legal basis
- Law no. 132/2025, Art. 7(3)
Professionals in Italy, such as tax advisers and lawyers
- What
- inform clients about the AI systems used
- Legal basis
- Law no. 132/2025, Art. 13(2)
Anyone who lets people communicate directly with an AI
- What
- make it recognisable that it is an AI
- Legal basis
- AI Act (Regulation (EU) 2024/1689), Art. 50, since 2 August 2026
All customers
- What
- promote the AI literacy of your staff
- Legal basis
- AI Act, Art. 4
1. Your privacy policy
GDPR Art. 13 requires you to inform the data subjects about purposes, recipients and transfers to third countries. Invariance and the AI providers are recipients; it is enough to name them as a category. Put your purpose in the brackets. The exact place of processing is stated in the data sheet for your product.
Use of artificial intelligence. For [purpose, for example searching our documents] we use software that processes text with AI language models. The software is operated by Invariance (Philipp Gurndin, Bolzano, Italy) on our behalf under Art. 28 GDPR. The language models run at providers with whom Invariance has concluded data processing agreements, in data centres in Europe. These providers do not store the content and do not use it to train AI models. No transfer to third countries without an adequacy decision of the EU Commission takes place. On request we will tell you which providers are used.
If a provider in your product does store something after all, for example Microsoft for dictation, up to 30 days in the EU for abuse monitoring, we add to the paragraph in your data sheet.
2. Clinics and practices
In Italy, patients have a right to be informed about the use of AI (Law no. 132/2025, Art. 7(3)). The decision remains with the doctor (para. 5), and the systems must be reliable and regularly checked (para. 6). The sentence belongs in the patient information, for example in the clinic's privacy notice.
For [coding diagnoses] we use an AI-assisted tool. A doctor reviews every result; the decision remains with the doctor. The data is processed in Europe, not stored by the AI provider and not used to train AI models.
These include training for staff, medical approval before routine use and a data protection impact assessment. We supply the templates and the technical part of the impact assessment.
3. Tax advisers, lawyers and other professionals
Anyone in Italy who provides an intellectual professional service uses AI only as support (Law no. 132/2025, Art. 13(1)) and informs clients about the AI systems used, clearly, simply and completely (para. 2). Completely means: name the systems. The sentence fits in the engagement letter and on your website.
For [research and organising documents] we use AI systems as tools: [Invariance software with language models, for example via Cortecs or Mistral]. The professional work and every decision remain with us. Your data is processed in Europe, not stored by the AI provider and not used to train AI models.
4. When people talk directly to AI
Since 2 August 2026, AI systems with which people communicate directly, such as a chat on your website, must make this recognisable, at the latest at the first contact (AI Act, Art. 50(1) and (5)). We build this notice into the software as the provider; leave it visible. If you publish text generated with AI to inform the public on matters of public interest, label it, unless a human has reviewed it and bears editorial responsibility (Art. 50(4)).
You are chatting with an AI assistant. Answers may contain errors; only information from our staff is binding.
5. Your staff
Anyone who uses AI systems takes measures to promote the AI literacy of the people who work with them (AI Act, Art. 4, as worded by Regulation (EU) 2026/1744). No particular level is prescribed; short training with proof is a common way, and we supply the template for it. In Italy, employers must also inform their employees about the use of AI, in the cases and in the manner of Art. 1-bis of Legislative Decree 152/1997 (Law no. 132/2025, Art. 11(2)).
6. What you get from us
- The data processing agreement with the list of sub-processors
- The technical and organisational measures
- The data sheet for your product, with location and storage
- The zero data retention overview of our AI providers
- Templates for notice, instruction, training and approval
- The technical part of the data protection impact assessment, where one is needed
What we do for our own role is on the compliance page.
Note
Not legal advice. The texts are suggestions for the typical case in Italy. As the controller under the GDPR, you decide how to inform; for special cases, ask your data protection officer. In Germany and Austria some rules differ, for example § 203 of the German Criminal Code (StGB); talk to us.
Philipp Gurndin gurndin@invariance.co +39 350 0404 001 PEC gurndin@pec.it