AI, automation & responsibility

01

Current state

No generative AI in the public journey

The current MyProID version does not require a generative model to display profiles, create vCards or local QR codes, process public forms or increment aggregate metrics.

Rules, forms and deterministic automation are described as such rather than marketed as AI.

Before activation, a feature must document what it does, why it is useful and which risks or limits it introduces.

• Purpose and user benefit.
• Model or service type and provider where relevant.
• Data sent, retained and potentially reused for training.
• Processing location and relevant transfers where known.
• Known limitations such as errors, hallucinations and bias.
• An option not to use the feature when it is not essential.
• Human review or correction where impact is significant.

Profile, account and form data should not be sent to an AI model merely because a feature could use it. Data minimisation and purpose limitation apply.

Claims such as “no training” or “zero retention” should only be made when contractually and technically verifiable for the relevant provider and service.

04

Interaction

Tell people when they interact with AI

The EU AI Act includes transparency obligations for certain AI interactions and certain synthetic or manipulated content.

If MyProID introduces an assistant, generator or other relevant feature, the interface should identify the nature of the tool when required or useful.

Model output should remain a suggestion when user validation is required. Results must not be turned into facts, reliability scores or decisions without a verifiable method.

For uses affecting people, reputation, access or professional decisions, human review and correction should remain available.

Generated content must not be presented as a real testimonial, certification or proof when it is synthetic. Users remain responsible for what they publish.

Where law or context requires it, generated or manipulated content should be identifiable and appropriately marked.

07

Quality

Errors, bias and performance limits

Models can produce plausible but false outputs, miss context, amplify bias or vary between runs. Responsible UI should not hide those limitations behind unverified scores.

Any published accuracy or test result must come from an actual documented measurement.

Any model input remains untrusted input. Future integrations should limit prompt injection, context exfiltration, excessive tool use and unauthorized data propagation.

Secrets, passwords, API keys and private information from other users must never be inserted into prompts by default.

No third-party AI provider is required for the current public operation of MyProID. If that changes, the provider and data flows must be added to privacy and technical documentation.

An external function will not be described as local, independent, sovereign or zero-retention unless the real architecture proves it.

10

Governance

Review, withdrawal and change

An AI feature should be removable if benefits no longer justify risks, provider terms change or results become unreliable.

Material changes to provider, model, data or purpose should trigger a new risk review and updated user information.