AI notice — transparency on the Security Portal’s assistant

1. You are interacting with an artificial intelligence system

The Security Portal’s assistant is a generative AI system: its answers are produced automatically by a language model, with no real-time human intervention. This page explains how it works, what its limits are and what responsibilities remain with those who use it. A short transparency note is always visible below the conversation window.

Legal reference: transparency obligations under Article 50 of Regulation (EU) 2024/1689 (the “AI Act”). The assistant is developed and operated by Unleaf, which uses a language model from a third-party provider (OpenAI). It is not designed to take decisions that have legal or similarly significant effects on people.

2. How it works (in short)

1. Your question is converted into a numerical representation (embedding) and used to search for the most relevant passages solely within the Portal’s knowledge base (Unleaf editorial content and extracts from selected public sources — see the “Sources & method” page).
2. The passages found are passed as context to an OpenAI language model (currently gpt-4o-mini), with instructions requiring it to answer only on the basis of that context and to cite the sources used in the [Source N] format.
3. If the Portal does not contain relevant information, the assistant is instructed to say so explicitly (“I don’t have enough information in the portal to answer”) instead of improvising.
4. The cited sources are shown below the answer and are clickable: they lead to the content page on the Portal or to the original external source, with the attributions required by the respective licences.
5. When the interface is in Italian, a “Prossimi passi” (Next steps) button may appear below some answers, with a paid Unleaf course, consultancy service or both, on the topic of the cited editorial sources. It is not chosen by the model: a fixed table decides it on the basis of the topics of that content, and the model sees neither the services nor their texts.

The system adapts the selection of sources to your account’s role (e.g. more technical answers for CISOs and professionals, more accessible ones for non-specialist staff) and to the interface language. This is a ranking preference, not a filter: it does not exclude content or produce decisions about you.

3. Limits you need to know

• Answers may contain errors. Even when grounded in sources, a generative model can misunderstand, oversimplify, combine passages incorrectly or translate imprecisely. Always check the cited sources before relying on an answer.
• The assistant only knows the Portal’s corpus. It does not browse the web in real time and does not cover anything that has not been indexed: the absence of a piece of information from the Portal does not mean that it does not exist. The knowledge base is updated periodically by the editorial team and by an automated nightly collection from the selected sources listed in “Sources & method”.
• No real-time human review. Answers are not reviewed by a person before they are shown to you. Quality is checked on samples and after the fact: periodically, an OpenAI model pre-assesses a sample of recorded questions and answers, without your email or your identifier, and a member of Unleaf’s staff makes the final assessment.
• Answers are not professional advice. They are general information and do not replace tailored assessments by qualified professionals (see the Terms of use, Article 7). In particular, do not base security, legal or organisational decisions with significant consequences solely on an answer from the assistant.
• Sources may be in another language. The assistant may draw on sources in Italian or English and translate them into the interface language: the translation is automatic and may introduce terminological inaccuracies.

4. Your responsibilities

• Verify the information against the cited sources before using it.
• Do not enter into the conversation unnecessary personal data of third parties, classified or confidential information that you have no right to dispose of, or unlawful content.
• Use the answers within the limits set by the Terms of use (internal professional use, no public redistribution, no training of other AI systems).

5. What happens to your data when you use the assistant

• The text of your question is sent to OpenAI to generate the embedding; to generate the answer, the passages retrieved from the corpus and the previous messages in the same conversation (your questions and the assistant’s answers) are also sent. For API customers such as Unleaf, OpenAI states that data are not used to train its models and are normally retained for no more than 30 days to provide the service and detect abuse, subject to legal obligations and to the exceptions for specific endpoints documented by OpenAI. The transfer to the United States takes place on the basis of the Data Processing Addendum with OpenAI Ireland Ltd and the standard contractual clauses referred to in it (see the privacy notice, section 8).
• The question, the generated answer, the cited sources, the role, the model used, your user identifier and email, and the date and time are recorded in an audit log that you can consult from your dashboard. It is used for traceability, security, enforcement of the monthly usage limit (60 queries per month) and review of answer quality. The full text of questions and answers is anonymised after 90 days (and remains viewable in the dashboard until then); the remaining pseudonymised metadata (sources, role, time, outcome) are deleted after 12 months. For quality review, a member of Unleaf’s staff may read samples of the questions and answers still held in the log.
• Full details, legal bases and your rights are set out in the Portal’s privacy notice.