Transparency and Compliance Statement for Artificial Intelligence Systems
NordOvest IT attaches primary importance to the ethical, safe, and human-centric development and use of emerging technologies. This document, which integrates and completes our Privacy Policy, aims to provide full algorithmic transparency to users of this website and our business partners regarding the use of automated systems, in strict and proactive compliance with Regulation (EU) 2024/1689 of the European Parliament and of the Council (so-called AI Act) and subsequent regulatory implementations.
Regulatory framework and risk-based approach. Under the risk-based approach (Risk-Based Approach) introduced by Regulation (EU) 2024/1689, NordOvest IT operates, within its public web ecosystem, as a Deployer (user) of minimal-risk or limited-risk Artificial Intelligence systems. The adopted systems do not fall into the high-risk categories of Annex III nor into the prohibited practices of Article 5, being solely subject to the specific transparency obligations set out in Article 50 of the Regulation, in order to ensure that natural persons are always fully aware of interacting with a machine.
Areas of application of language models. Our technological infrastructure uses models based on Large Language Models (LLM) and Natural Language Processing exclusively for defined technical and operational purposes. Regarding the website's virtual assistant (NovBot Chatbot), in full compliance with transparency obligations under Art. 50 par. 1 of the AI Act, the system is unequivocally identified as an artificial assistant and the user interface explicitly displays the objective wording Chat with AI, excluding any deceptive intent and making clear the absence of a human operator in the first-level interaction phase. Regarding the automation of internal back-office workflows, Artificial Intelligence is implemented solely as an auxiliary tool for parsing and routing incoming emails, syntactic review, and multilingual translation, without ever making automated decisions that produce legal effects or significantly affect the data subject under Article 22 of the GDPR.
Safeguard measures, Zero-Training policy, and data segregation. As a Managed Security Service Provider (MSSP), NordOvest IT applies the highest standards of information segregation to its algorithmic workflows. A strict Zero-Training Policy is enforced: it is strictly forbidden to use data entered by users (such as chatbot queries or request texts) for training, fine-tuning, or optimizing the foundation models of technology providers, a constraint formalised through Enterprise / Opt-Out contractual agreements across our APIs. Textual interactions with the virtual assistant reside temporarily in the browser's volatile memory (sessionStorage) for the duration of the active session, and are kept for a maximum of 60 days on secure servers exclusively for security, audit, and abuse prevention purposes. Furthermore, any complex processing delivered in support of clients is governed by the principle of human oversight (Human-in-the-Loop - HITL), with prior validation by qualified technical personnel.
Limitations of use and probabilistic nature of outputs. Although the adopted AI systems are equipped with safety filters and guardrails to mitigate hallucinations or inconsistent outputs, the probabilistic nature of generative technologies cannot guarantee the constant logical infallibility of every output. The information provided by the virtual assistant is therefore of a purely indicative and informational nature; for any binding technical requests, contractual proposals, or commercial determinations, the only authoritative source is direct contact with our human team via the website form or formal company channels.
Algorithmic governance, technical documentation, and auditability. In compliance with the joint principle of Accountability under both the GDPR and the AI Act, NordOvest IT maintains a constantly updated internal AI Governance registry. This technical documentation, including model mapping, provider reliability metrics, and applicable impact assessments, constitutes proprietary business assets under Art. 32 of the GDPR and is securely maintained to be promptly disclosed upon formal request by Competent Supervisory Authorities, such as the National Cybersecurity Agency (ACN) and the Data Protection Authority.
Last updated: September 2026