GDPR does not have a certification a vendor can complete
As with HIPAA, it is worth stating plainly: there is no formal, universal "GDPR certified" badge a software vendor can earn and display, comparable to a SOC 2 or ISO 27001 audit. GDPR compliance is an organizational and legal obligation for the entity processing personal data (the controller) and its processors, governed by data processing agreements, lawful-basis analysis, and the specific technical and organizational measures in place — not a certificate a platform vendor holds on a customer’s behalf.
Where does customer data go when an AI feature processes it?
The first question a GDPR-relevant analysis needs to answer for any AI feature is where the underlying data physically travels and is processed — is it processed entirely within infrastructure the customer organization controls, or does it leave that boundary to reach a third-party model provider or a shared multi-tenant processing environment? This question applies distinctly to each AI capability in a platform: a rule-based decision-tree bot processes data very differently than a system that calls out to an external model provider.
Does a knowledge-retrieval or bot system create a new cross-border transfer question?
If an AI capability retrieves from or is powered by infrastructure located outside the customer’s jurisdiction — including a cloud-hosted model provider — that can constitute an international data transfer under GDPR, triggering its own legal basis and safeguard requirements (such as Standard Contractual Clauses), independent of whatever transfer mechanism already governs the platform’s core data storage. This is easy to overlook because AI features are often added to an existing platform without re-running the transfer analysis that applied to the original architecture.
What does erasure mean once embeddings exist?
GDPR’s right to erasure requires that personal data be deletable on request. This becomes technically nuanced once a knowledge-retrieval system has generated vector embeddings from source content containing personal data: deleting the original source document does not automatically guarantee the embedding derived from it is also deleted, or that the underlying personal data cannot be partially reconstructed from the embedding in some system designs. A team evaluating or building an AI-assisted retrieval feature needs to understand specifically whether an erasure request propagates to the embedding index, not just the source record.
How deployment model changes the residency conversation, and what it does not change
A private-cloud deployment keeps data processing inside infrastructure the customer organization directly controls, which is directly relevant to answering "where does the data go" and to controlling cross-border transfer more directly than a cloud-only SaaS deployment can. It does not, by itself, satisfy every GDPR obligation — lawful basis, data subject rights handling, processor agreements, and erasure mechanics still require an organizational compliance program regardless of deployment model. Voz360’s AI capabilities shipped today (Answer Engine, rule-based; Context Retrieval, embeddings-based knowledge search) run within the deployment model chosen — managed SaaS or private cloud — giving an organization direct control over that residency question when private cloud is selected.
Can the vendor tell you — in one sentence — which of their AI capabilities are rule-based, which are generative, and which are still roadmap?