Formalize AI Capabilities - Terms and Conditions

These AI Services Terms and Conditions (the ‘’AI terms’’) are incorporated into, and form part of, the Agreement. They apply only where the applicable Quote expressly includes, or the Customer has validly enabled an AI Capability, where available. Capitalised terms not defined in these AI Terms have the meaning given in the Terms and Conditions. 

1. Order of precedence and Scope

1.1 Order of Precedence

These AI terms supplement the Terms and Conditions, the applicable Quote, the Data Processing Agreement, the Service Level Agreement and where applicable, the DORA Addendum. Except as expressly modified by these AI terms, all provisions of the Agreement remain in full force and effect, including provisions concerning invoicing, payments, taxes, terms, termination, confidentiality, intellectual property, governing law and dispute resolution. 

If an AI Capability is disabled, suspended or deprecated, the remaining Services and the remainder of the Agreement continue unaffected unless the parties agree otherwise in writing.

1.2 Conflict resolution

In the event of a conflict, the following order of precedence applies, but only to the extent of that conflict:

  1. The applicable Quote, solely as to the AI Capabilities purchased or enabled, pricing, allowances and other commercial terms expressly stated in that Quote;

  2. These AI terms, solely as to the use, operation and provision of AI Capabilities and other AI-specific matters;

  3. The DPA, solely as to the processing of Personal Data;

  4. The SLA, solely as to service levels, support communications, availability and service credits;

  5. The Terms and Conditions, as to all other matters;

2. Purpose

The purpose of these AI Terms is to establish the legal and security framework under which Formalize provides built-in artificial intelligence capabilities to assist the Customer in their compliance work in Formalize. These AI capabilities run on the same infrastructure and follow the same security principles as the rest of the Platform.

Under this framework, the Customer may access specific AI Capabilities as described in the applicable Quote.

The use of AI is entirely the Customer’s choice, and the Platform remains fully usable without these optional additions.

3. Definitions

‘‘AI Capability’’ means any artificial intelligence functionality expressly made available by Formalize under the applicable Quote or enabled by the Customer within the Platform.

‘‘AI Change’’ means a material change to an AI Capability that is reasonably likely to materially reduce the agreed security safeguards, human-oversight controls, processing-location commitments under the DPA, or material functionality of that AI Capability. A routine update, replacement or change to Model, model version, hosting provider or other technical component is not, by itself, an AI Change. AI Changes are communicated in accordance with the Terms and Conditions.

‘‘AI Output’’ means a proposed or executed Resolution, and any other output, recommendation, classification, extraction, summary or content generated by an AI Capability

‘‘Customer Data’’ means all data, content, documents, information, prompts, inputs and materials submitted to, stored in, transmitted through or otherwise made available by or on behalf of the Customer through the Services, including Personal Data. 

“Feedback” means voluntary comments, corrections, ratings or suggestions about an AI Capability or AI Output, provided by the Customer or its Users through the Platform or another communication channel.

“Model” means a pre-trained artificial intelligence model used by Formalize to provide an AI Capability, as further described in the applicable technical documentation.

“Prompt” means an input sent to a Model in connection with an AI Capability, whether submitted directly by a user or generated automatically by the Platform in order to provide the AI Capability, including selected documents, form-field definitions, instructions and relevant Customer Data.

“Resolution” is a completed unit of AI functionality, as identified in the applicable Quote or product documentation, and may include an approved action or another completed customer-facing outcome.

4. Roles under the AI Act

Formalize’s and the Customer’s respective roles under the Regulation (EU) 2024/1689, as amended from time to time (the ‘’AI Act’’), are allocated for the AI Capabilities as currently made available as follows:

  1. Formalize acts as Provider, within the meaning of Article 3(3) of Regulation (EU) 2024/1689 (the “AI Act”): Formalize integrates these AI capabilities into the Platform and places them on the market under its own name.

  2. The Customer acts as Deployer, within the meaning of Article 3(4) of the AI Act, when it puts an AI Capability into operation within its own organisation.

  3. Third-party providers involved in the provision of AI Capabilities retain the obligations applicable to them under the AI Act and other applicable law. Information concerning Formalize’s AI technical architecture and relevant third-party providers is made available in Formalize’s trust center and, where Personal Data is processed, the DPA’s sub-processor documentation. Formalize’s obligations under these AI Terms remain unaffected.

This allocation reflects the AI Capabilities’ current scope and intended purpose. It does not constitute a warranty that a particular Customer use case is non-high-risk or otherwise outside the scope of the AI Act. The Customer remains responsible for assessing its intended use and deployment context, including whether its use is subject to requirements applicable to deployers or under other applicable law.

5. Intended Use

AI Capabilities are intended to support governance, risk and compliance activities, document review, information retrieval, document automation and related internal business workflows, among others. They are not designed or marketed for making decisions that produce legal effects or similarly significantly affect natural persons, or for use cases that Formalize has identified as requiring a fundamental-rights impact assessment under Article 27 of the AI Act.

The Customer shall notify Formalize before using an AI Capability in a materially different or regulated context, including where the Customer reasonably believes that its intended use may classify the AI Capability as high-risk or otherwise trigger requirements under the AI Act.

6. Service Operations and Controls

6.1 Human-in-the-Loop Requirement

To ensure accuracy and compliance, Formalize implements strict human oversight protocols:

  1. Formalize makes available human-oversight, review and approval controls appropriate to the intended purpose and associated risk of each AI Capability. 

  2. AI-generated suggestions are clearly marked as such in the user interface until human review is complete.

  3. Where an AI Capability is configured to perform an action affecting Customer Data, Formalize shall make available controls enabling the Customer to determine the applicable approval, permission and oversight settings.

6.2 AI Literacy and Customer Deployment Controls

  1. Formalize shall make available product documentation and reasonable information describing the intended use, known limitations, human-oversight features and safe operation of each AI Capability.

  2. The Customer shall ensure that its personnel and other persons using AI Capabilities on its behalf have an appropriate level of AI literacy, authority and training, taking account of their technical knowledge, experience, education, training and the context in which the AI Capabilities are used.

  3. The Customer shall take account of the information, limitations and controls made available by Formalize when configuring and using AI Capabilities. The Customer remains responsible for assessing whether its intended use, including any action taken in reliance on AI Output, complies with applicable law and its own legal, regulatory and contractual obligations.

6.3 Auditability, Permissions and Operational Safeguards

  1. Formalize shall maintain reasonable technical and organisational measures designed to enable AI Capabilities to operate within the relevant Customer organisation and in accordance with the permissions, approval settings and other controls configured by the Customer of made available by Formalize. Formalize shall maintain logs appropriate  to the relevant AI Capability and its configured controls, which may include,  the relevant user of configured permission set, AI Capability, time of request, AI Output, proposed or completed action, and applicable approval, rejection or execution event. Such logs shall be handled in accordance with the DPA to the extent they contain Personal Data and otherwise in accordance with the Agreement.

  2. Formalize may suspend, limit, disable or roll back an AI Capability where reasonably necessary to address a security vulnerability, material malfunction, suspected misuse, legal or regulatory requirement, or material risk of harm. Formalize shall provide notice without undue delay where practicable and shall use reasonable efforts to restore the affected AI Capability when the relevant issue has been resolved.

6.4 Disabling AI Capabilities

Customers may maintain full control over AI Capabilities through: (i) Organisation settings, including the organisation-wide AI disablement at any time; (ii) user-level access and permission settings made available within the Platform (iii) removal of an AI Capability upon request to Formalize support.

7. Privacy, Security and Customer Data

The processing of Personal Data through an AI Capability is governed exclusively by the DPA. Formalize shall process Personal Data only as necessary to provide the AI Capability in accordance with the DPA and the Customer’s documented instructions.

7.1 No Training on Customer Data

Formalize represents and warrants the following regarding Customer Data:

  1. Customer Data is never used to build data sets with the purpose of training or fine-tuning any general-purpose, shared, or third-party AI models; nevertheless Feedback voluntarily provided by the Customer or its Users may be used for the purpose of fine-tuning the Model. For clarity, this restriction does not prevent Formalize from processing Customer Data  as necessary to provide, secure, support, monitor, prevent abuse of, or invoice for the AI Capabilities, provided that any processing of Personal Data is performed in accordance with the DPA.

  2. All AI processing is scoped to a single organisation and bound by the permissions of the requesting user.

  3. Models do not retain Customer Data as persistent state between requests. Customer Data is not stored or logged by the Model service, except for any encrypted, temporary performance cache described in Formalize’s technical documentation.

7.2 Infrastructure, Sub-processors and Processing Locations

Formalize shall provide the AI Capabilities using the sub-processors and processing locations identified in the DPA’s then-current sub-processor list. Formalize shall not make a material change to an AI-related sub-processor or processing location except in accordance with the DPA. Any statements in these AI Terms concerning AI infrastructure, Model providers, data location, retention or access are subject to, and shall be interpreted consistently with, the DPA.

8. Financial Terms

The applicable Quote sets out the fees, including Resolution allowance, and any other reasonable technical usage limits, including limits on documents, form fields, tokens, web searches, agent steps and file-processing capacity.

9. Compliance and Liability

9.1 AI Act Classification and Transparency

Formalize has assessed its current AI Capabilities, as currently scoped and made generally available, and does not intend to provide them as high-risk AI systems. This assessment is limited to the AI Capabilities’ intended purpose and current functionality. Formalize may update this assessment where required by an AI Change, applicable law, regulatory guidance or a material change to the AI Capabilities.

Nothing in this section prevents the Customer from carrying out its own assessment of the lawfulness, suitability and regulatory classification of its particular use of the AI Capabilities.

9.2 Acceptable Use

The Customer shall not use, and shall not permit any user to use, the AI capabilities to:

  1. engage in, or configure the AI capabilities to facilitate, any practice prohibited under Article 5 of the AI Act;

  2. process Personal Data, including special categories of Personal Data or personal data relating to criminal convictions and offences, other than in accordance with the DPA, the Customer’s documented instructions and applicable law;

  3. attempt to disable, circumvent, or misrepresent the human-review or approval mechanisms.

  4. use an AI Capability for a purpose outside its intended purpose or in a manner that conflicts with the documentation, user permissions or human-oversight controls made available by Formalize;

  5. enter security credentials, access tokens, encryption keys or similar authentication information into an AI Capability; or

  6. represent AI Output as independently verified, professionally reviewed or legally binding where it has not been so verified or reviewed.

9.3 Liability for AI Capabilities

Formalize shall not be liable for inaccuracies, errors or omissions in AI Output, provided that Formalize has implemented the human-review and approval mechanisms described in clause 3.1. The Customer acknowledges that AI Output may be inaccurate, incomplete, non-unique or unsuitable for a particular purpose; that output quality may be affected by low-quality documents, ambiguous terminology or incomplete data; and that the Customer remains responsible for reviewing AI Output before relying on or acting upon it.

Subject to the preceding paragraph, each party’s liability arising out of or in connection with AI Capabilities is subject to the exclusions, limitations, claim-notification period and liability cap set out in clause 14 of the Terms and Conditions. The parties confirm that fees for AI Capabilities form part of the subscription fees for the purpose of calculating the cap in clause 14.2 of the Terms and Conditions, unless the applicable Quote expressly provides otherwise.

10. Intellectual Property

As between Formalize and the Customer, the Customer owns all right, title, and interest in and to the AI-generated outputs produced from the Customer's own data, subject to the exception below.

Where an output contains, reproduces, or is derived from content licensed to Formalize by a third-party rights holder (for example, standards content licensed from ISO), ownership of that underlying licensed content remains with the original rights holder, and the Customer's rights in the output are limited to the licence terms under which Formalize itself holds that content. Formalize will implement reasonable measures to visually distinguish such third-party licensed content from Customer-derived, AI-generated output in the product interface.

Nothing in this Section grants the Customer any right in the Model itself, in Formalize's underlying software, or in any aggregated or de-identified data that does not identify the Customer or any individual.

11. AI Service Continuity and Third-Party Dependency

The SLA governs availability, support commitments and service credits for AI Capabilities to the extent that AI Capabilities are included within the Services covered by the SLA. Formalize’s use of a Model, hosting provider or other subcontractor does not by itself relieve Formalize of the SLA commitments, except to the extent expressly stated in the SLA.

Where a material third-party dependency is unavailable, degraded, withdrawn, no longer meets the industry standards due to the rapid AI development or is materially modified, Formalize may suspend the affected AI Capability or substitute a functionally equivalent service, provided that Formalize uses reasonable efforts to minimise disruption and gives notice without undue delay. A failure or delay caused by circumstances beyond Formalize’s reasonable control does not displace any DPA obligation or SLA remedy except to the extent expressly stated in those documents.

Boek een demo