Trust and compliance

    European AI: GDPR and the EU AI Act

    Last updated: March 2026

    LastBot ONE is built for European operators. The platform runs on European infrastructure, is designed around GDPR controller and processor roles, and is structured to meet the obligations the EU AI Act places on providers and deployers of AI systems used in customer service. This page summarizes the posture; the Master Services Agreement and DPA contain the binding detail.[2]

    What the EU AI Act means for AI customer service

    The EU AI Act (Regulation (EU) 2024/1689)[3] classifies AI systems by risk. Most customer service AI agents fall outside the high-risk categories listed in Annex III, but they still trigger transparency, human-oversight, and risk-management duties. Operators must inform customers they are interacting with an AI, keep humans in the loop for material decisions, and document the system's intended purpose and limits.

    LastBot ONE supports these duties out of the box: every channel includes an AI disclosure, the management portal exposes live oversight controls, and the agent specification doubles as the deployer's documentation of intended purpose.

    GDPR posture[4]

    Roles
    Your business is the controller. LastBot Europe Oy is the processor under Article 28 and signs a DPA.
    Data residency
    Conversation data and knowledge content are processed on European infrastructure.
    Sub-processors
    Authorized sub-processors are listed in the MSA. Changes are notified in advance with an objection window.
    Transfers
    Where any transfer outside the EEA is required for a specific feature, it is governed by Standard Contractual Clauses and a transfer impact assessment.
    Data subject rights
    The platform supports access, rectification, deletion, and export requests through the management portal.
    Security
    Encryption in transit and at rest, role-based access control, audit logs, and regular penetration testing.

    Sovereign architecture

    LastBot ONE is designed for digital sovereignty: European hosting, European-headquartered operator, and a model layer that can run on European-controlled compute. This matters when your customers, your regulators, or your procurement office require that personal data stays inside European jurisdiction end-to-end.

    Sovereignty does not stop at hosting. The closed-loop AI coach learns from your tenant's data inside your tenant boundary; conversation content is not pooled across customers and is not used to train external foundation models.

    Frequently asked questions

    Need a compliance walkthrough?

    We can walk your DPO or procurement team through the architecture, sub-processor list, and DPA in a single session.

    Book a compliance walkthrough