Compliance & assurance for AI knowledge platforms

Deploying an AI knowledge platform is a compliance event, not a software purchase. It creates a new processing activity over documents you already hold, with a new set of people able to reach content they previously could not, and a new derived copy of your estate that your retention schedule says nothing about.

Most vendor conversations about compliance are about the vendor's certificates. That is one input, and a small one. This guide is about the obligations the deployment creates for you, in the order they tend to bite.

01The obligations deploying this creates for you

Regulations govern the organisation processing the data, not the tool. Before an AI platform indexes anything, three things need to exist on your side.

A lawful basis, for a processing activity you have probably not described before. Indexing a document estate for AI retrieval is not the same processing activity as storing those documents, and in most organisations the existing record of processing does not cover it. Personal data in HR files, contracts, incident reports and email-derived content is in scope whether or not anyone intended it to be.

An assessment proportionate to the risk. The ICO's guidance sets out when a data protection impact assessment is required. Large-scale processing of personal data using new technology will often meet the threshold, and "our vendor is certified" is not an answer to it.

A subprocessor position you can defend. An AI platform typically involves at least a hosting provider and a model provider, sometimes several. Each is a subprocessor. You need them named, located, and covered contractually, and you need to know what happens when the vendor changes one.

None of this is exotic. It is the ordinary work of taking on a processor, and it is routinely skipped for AI tools because they arrive looking like productivity software rather than infrastructure.

02Permissions: the control that fails first

This is the failure that causes real damage, and it is specific to the category.

A platform that indexes your document estate can, by construction, read everything it has been pointed at. That is how it answers. The compliance question is what happens at answer time: does it check, for this person asking this question, which of the retrieved passages they are entitled to see?

Where that check is weak, the failure is subtle. Nobody gets handed a restricted file. Instead the system composes a fluent answer that draws on a document the asker could never have opened, and presents it without attribution or with attribution they cannot follow. The information has leaked; the access log shows nothing unusual.

Three questions settle it:

• Are source permissions enforced at query time, or only at indexing time? Index-time filtering goes stale the moment permissions change.
• What happens when permissions change after indexing? Ask for the propagation delay in minutes or hours, not in principle.
• Can an answer be composed from a passage the asker cannot open? The answer should be an unambiguous no.

Related, and the reason curation matters here: restricting what the system may answer from is a stronger control than filtering what it returns. Our guide to curated knowledge covers that distinction.

03Retention, deletion and the copies you forgot about

Indexing does not point at your documents. It extracts their text, splits it, and generates vector embeddings, which are numerical representations that encode the content closely enough to reconstruct meaning from it. Those artefacts are a derived copy of your material, and they live wherever the index lives.

This collides with three routine obligations.

Retention schedules. Your schedule governs the document. It almost certainly says nothing about a derived index, which means content you have formally retired can remain answerable.

The right to erasure. When a data subject asks for their personal data to be deleted, deleting the source document is not sufficient if the index retains a representation of it. Ask specifically whether deletion propagates to extracted text and embeddings, and how long that takes.

Legal hold and disclosure. If material is under hold, an index derived from it is arguably in scope too. Conversely, an index is a searchable artefact that may itself be disclosable. Neither point is settled, which is a reason to know where the copies are rather than a reason to ignore them.

The practical test: ask the vendor to describe, end to end, what happens when you delete one document. If the answer stops at the source system, the derived copies are yours to worry about.

04The evidence you will actually be asked for

Auditors and regulators rarely ask whether a system is secure. They ask you to reconstruct a specific event. For an AI knowledge platform the question takes a predictable shape: somebody acted on an answer this system gave them. Show me what it was based on, and show me that it was the current approved version at the time.

Answering that requires four things, and a platform either records them or it does not:

1. Which documents the answer drew on, at a granularity fine enough to check. A citation to a 200-page policy is not evidence.
2. Who approved those documents as answerable, by name, and when.
3. Who asked what, and when, retained for as long as your evidential requirement runs.
4. What the document said at that time, which matters because policies are revised and the answer was given against a version.

This is the single most useful thing to test in a trial. Ask a question, then try to reconstruct the answer a month later using only what the platform recorded.

05Sector regimes, and the six questions

The same platform carries very different obligations depending on who is deploying it. For a marketing team it is a productivity tool. For a bank it is likely a third-party arrangement supporting an important function, with a register entry, exit plan and audit rights attached.

Financial services. DORA Article 28 requires a register of information on ICT third-party arrangements, including where data is stored and processed. FCA and PRA outsourcing expectations apply on top.

Essential and important services in the EU. NIS2 extends security obligations into the supply chain, and a tool reading your operational documentation sits inside it.

Health, pharma and public sector. Sector frameworks add their own evidence requirements over the top of data protection, and validation expectations in regulated manufacturing are stricter than anything in this guide.

Anyone deploying AI in the EU. The EU AI Act assigns obligations by risk classification and by whether you are provider or deployer. Internal knowledge search is usually not high-risk, but the classification is yours to make and document. Treat any vendor claiming their product is "AI Act compliant" with suspicion, because the obligations follow the use, not the tool.

Whatever the regime, six questions produce the evidence:

1. Are source permissions enforced at query time, and what is the propagation delay?
2. When we delete a document, what happens to the extracted text and the embeddings?
3. Can you reconstruct, a year from now, what a given answer was based on?
4. Who are your subprocessors, where are they, and how are we told when they change?
5. Is our data used to train models, by you or anyone in your chain, and is that contractual?
6. What are we entitled to audit, and on what notice?

Certificates are worth asking for alongside these. Ask for the document rather than the badge, check the scope statement covers the service you are buying, and check it names the entity that will contract with you.

06Where AnswerVault stands

Answering our own six questions.

Permissions are inherited from the source system and enforced at query time, and answers are additionally confined to document sets a named subject-matter expert has approved. Citations resolve to the sentence rather than the file, and every query and response is recorded, which is what section 04 asks for. Customer data is never used to train models, by us or by our providers.

Subprocessors, retention, the inference path and audit rights are documented on the security page rather than released only under NDA, so an assessment can start before a sales call.

On certification: Catapult CX Ltd, AnswerVault's operating entity, is certified to ISO/IEC 27001:2022 (BSI, certificate IS 699849, valid to March 2028), covering the consultancy and software engineering services under which AnswerVault is built and run. It also holds ISO 9001 and ISO/IEC 20000-1. ISO/IEC 42001 is not certified; certification is underway. AnswerVault is listed on G-Cloud.

What a platform contributes to your compliance position is evidence, not absolution. The obligations in section 01 remain yours.

Next

If jurisdiction shapes your shortlist, read the sovereignty guide. For what governed answers require in practice, read curated knowledge. For what any of it costs, see cost and comparisons.

AnswerVault's Starter tier is free. Connect a document source and see how governed knowledge search works.