Annex K – AI Usage, Content and Reporting Procedures

1. Purpose and Roles

1.1 The standard functions serve to support the processing of approved information, answer general knowledge and service questions, create content requiring editorial review and prepare permissible business processes. The platform's standard offering is not intended to take over safety-critical decisions or independently provide advice requiring authorisation.

1.2 Roles under the AI Act, data protection law and contract law must be determined separately. Brixovo remains responsible for its own statutory provider obligations. The Tenant bears the obligations arising from its actual use, its own provision and its modifications. A contractual designation does not replace this assessment.

1.3 White-label provision may establish the Tenant's own role as a provider; however, it does not automatically make every chatbot a high-risk system. Changes of purpose, substantial modifications and use in regulated decision-making contexts require a renewed assessment of roles and risks. Brixovo's statutory obligations cannot be shifted to the Tenant by a general declaration.

2. Permitted Standard Scope and Separate Approvals

2.1 Only lawful applications within the booked scope and the documented intended purpose are permitted. Examples include FAQ assistants, general product information, internal knowledge search, editorial drafts and general appointment or contact information without substantively significant automated decision-making.

2.2 [D-01] The standard offering does not include high-risk applications under the AI Act or applications for the material assessment of natural persons in employment, education, credit or insurance decisions, essential public services, law enforcement, migration, administration of justice or safety-critical infrastructure. Even an output described as merely advisory may have significant influence in such contexts. Human final confirmation alone does not remove a high-risk classification.

2.3 Use for an excluded purpose requires a new, expressly reviewed offering with the necessary provisions on conformity, operations, liability and insurance. The Tenant must not approve such use solely through its own declaration, a DPIA or activation in the administration area. Practices prohibited by law cannot be approved at all.

2.4 The input of health data, other special categories of data, data on criminal convictions, secrets protected by professional rules or comparably sensitive content is not envisaged under the standard offering. A lawful special case requires a prior express agreement on purpose, types of data, legal bases, safeguards, recipients and necessary confidentiality obligations. General details of a medical practice, such as opening hours, are not health data solely because of the industry.

2.5 Services specifically directed at minors require a separate review of information, data protection, contract formation and safeguards. The standard version is not evidence of approval for such offerings.

3. Prohibited Uses

3.1 All AI practices prohibited by law are prohibited, in particular harmful manipulative or deceptive applications, harmful exploitation of vulnerabilities, unlawful social scoring, unlawful biometric categorisation and identification, unlawful emotion recognition in the workplace or in educational institutions, untargeted scraping to build facial recognition databases, and unlawful predictions concerning individuals' commission of criminal offences.

3.2 Irrespective of statutory transitional periods, creating or disseminating sexualised depictions without the required consent, abusive sexualised depictions of minors and other unlawful content is prohibited. This also applies to attempts to circumvent safety mechanisms for such purposes.

3.3 The following, in particular, are also prohibited:

• unlawful discrimination, impersonation, fraud, phishing and unlawful advertising solicitation;
• unlawful publication of personal data, secrets or protected content;
• unauthorised access to other Tenants, third-party accounts, infrastructure or keys;
• malware, deliberate operational disruption, abusive load and circumvention of agreed technical limits;
• removal or concealment of mandatory AI, provider or security notices;
• use of fabricated references, reviews, certification marks or evidence of conformity;
• claiming that an AI result is a verified human expert decision when this is not the case.

3.4 Permissible security reports and coordinated tests do not constitute abuse. Tests that may affect availability, data or other Tenants must be coordinated with Brixovo in advance. Legally permitted acts are not excluded across the board.

4. Transparency and Content Review

4.1 When interacting directly with AI, Users must be informed of its AI nature clearly, distinctly and accessibly no later than at the start of the interaction. Branding, embedding and custom texts must not remove or render invisible the required notice. Brixovo provides the technical precautions required within its own area of responsibility; the Tenant checks the specific implementation on its interfaces.

4.2 Required machine-readable markings and provenance information for generated content must not be removed or falsified. Brixovo must assess and fulfil the technical marking obligations applicable to its own system. A visible “AI” notice is not automatically evidence of fulfilment of machine-readable marking obligations.

4.3 The Tenant assesses further disclosure obligations, in particular for artificially generated realistic image, audio or video content and for certain texts published to inform the public. A merely formal approval must not be presented as expert or editorial oversight.

4.4 Before publication, facts, product characteristics, prices, third-party rights and legally significant statements, in particular, must be checked. Source references provided by the system may also be incorrect. Brixovo owes the agreed system function, not unreviewed expert approval of Tenant content.

4.5 The Tenant uses sufficiently trained persons for setup, supervision and approvals. It equips them with knowledge of capabilities, limits, potential errors, data protection and reporting channels appropriate to their area of use. Brixovo provides the agreed system information and fulfils its own applicable obligations.

5. Limits on the Use of AI Outputs

5.1 Standard rule of the draft: Refunds, contractual changes, legally binding declarations, decisions with significant effects on natural persons, releases of sensitive data and comparable actions must not be executed solely on the basis of an AI output. Specific confirmation by an authorised person is required before execution. Automated processing within an ordinary Stripe subscription already lawfully established must be distinguished from this as deterministic performance of a contract.

6. Data Protection, Sources and Detection Limits

6.1 The Tenant limits inputs to permissible and necessary content. Document and PII checks are only supplementary technical aids. They do not guarantee complete anonymisation and replace neither content review nor a legal basis. In particular, it must not be assumed that all names, addresses, dates of birth or free-form chat inputs are automatically detected and removed.

6.2 Connected websites, shops and ticket systems must be lawfully integrated. Rights, authentication and, where applicable, restricted data releases must be taken into account. Synchronisation must not transfer confidential order, customer or support data into publicly accessible knowledge repositories without review.

6.3 Deleting the original source does not necessarily delete all copies, search representations, chat histories or externally transmitted content. The deletion steps required in each case are governed by the DPA and deletion concept. Brixovo must not confirm comprehensive deletion until dependent storage systems have been checked.

7. Reporting Unlawful Content and Security Incidents

7.1 Reports may be submitted via [APPROVAL: publicly accessible reporting channel and monitored email address]. This contact is accessible without a customer account and is also identified as a channel for security reports. A report should contain:

• the precise location, preferably the full URL or a unique object identifier;
• a comprehensible explanation of the content or risk being reported;
• a name and email address for queries, to the extent that collecting them is permissible and necessary in the individual case;
• a statement that the information is accurate and complete to the best of the reporting person's knowledge.

7.2 For reports concerning certain sexual offences against children, identity details not required by law must not be a prerequisite. Sensitive evidence must be submitted only through a suitable secure transmission channel; it should not be duplicated unnecessarily.

7.3 Where contact is possible, Brixovo acknowledges receipt without undue delay, promptly examines sufficiently specific reports and provides information on the decision and available remedies to the extent required by law. Court and administrative orders are handled in accordance with statutory requirements.

8. Review, Measures and Complaints

8.1 Proposed operating model D-08: Content-related moderation decisions are taken by a responsible person. Automated systems may supply security, format, quota and abuse signals or temporarily block dangerous transactions. Before approval, the procedures actually used must be disclosed; additional AI-based content moderation must not tacitly be described as an existing process.

8.2 Brixovo considers severity, recurrence, apparent intent, consequences, the possibility of remedy and the interests of those involved. Measures range from notices and requests for correction, through blocking individual content or functions, to proportionate account suspension or termination in accordance with the law. Blanket deletion based on mere unverified suspicion is not agreed.

8.3 To the extent required by law, those affected receive specific reasons stating the underlying facts, contractual or statutory basis, use of automated means, scope of the measure and possible remedies. Mandatory exceptions to protect investigations, persons or security remain unaffected.

8.4 A free human review of a measure may be requested through the designated contact. The review must not be exclusively automated. Where more extensive statutory complaint rights apply, these are provided without restriction. Access to judicial remedies and competent authorities remains available independently of an internal complaint.

8.5 Documentation compliant with data protection requirements serves traceability, not unlimited storage of all content. Review and retention periods must be determined according to the circumstances and legal basis. There is no general commitment to comprehensive advance screening of all Tenant content.