I have received the Data Processing Agreement amendment, but I don’t want to sign it / my company does not comply. Can I still use the Matrix42 Intelligence cloud-based capabilities?

In this case, you will not be able to use the Matrix42 cloud-based AI capabilities as those require further data processing using cloud services. Matrix42 needs to comply with the conditions mandated by the service offering party.

I have already signed a Data Processing Agreement with Matrix42. Was there any change?

The amendment to the existing Data Processing Agreement adds an additional subprocessor, including their conditions.

What are the specifics on ‘Microsoft Abuse Monitoring’? 

Matrix42 Intelligence uses Abuse Monitoring from Microsoft with the standard content filters. Matrix42 aims to provide ethically correct use of AI, and will therefore use this functionality.

Which data sources are currently used?

At the moment, capabilities provided via Matrix42 Intelligence are relying on data provided in our Matrix42 Enterprise Service Management solution. 

Will the uploaded data of customers be mixed?

The underlying cloud platform M42Next is implemented with multi-tenant capabilities.
At the moment, no cross-client data is used to train AI models.

Where can I obtain information on data processing/GDPR/information security?

Matrix42 Intelligence uses data which was previously uploaded (ingested) from the Matrix42 Enterprise solution. Details can be found in dedicated help areas:

• Ingested Objects
• AI Assist in Service Desk – Processed Data

Topics related to GDPR and overall data processing can be found in our Data Processing Agreements or any amendments.

I am concerned about our data being used for model training; how do you address data handling?

As the European Choice in Service Management, we place the highest value on data protection, data security, and transparency. Our contractual terms (including the DPA) allow data to be used solely for improving and further developing our services, but always in strict compliance with the GDPR and the principles of privacy by design and data minimization.

Specifically, this means:

1. Anonymization / Data minimization
   Before data is used for internal development or training purposes, it is anonymized or pseudonymized so that we cannot draw any conclusions about identifiable individuals or customer-specific content. Upon request, we can explicitly document this in the contract.
2. Training of models only with anonymized data
   We use only anonymized data to train general models. Model improvements are made exclusively on the basis of previously anonymized or aggregated information.
   Therefore, there is no mixing between tenants and no unwanted flow of knowledge into models that are available to other customers.
   All development also takes place exclusively within our own isolated environment.
3. No disclosure to third parties
   There is no disclosure of data to third parties or any other external parties for training or other purposes. Any “commercial use” or other transfer is explicitly excluded.
4. Why is storage for training purposes still mentioned?
   The reference in the documents does not mean that we use raw data or personal content for model training. It simply means that, as is common in the industry, we may use certain anonymized telemetry data, usage metrics, or aggregated information to improve features, detect errors, or optimize models within the platform.
   Even anonymization itself is considered a form of processing under the GDPR. Therefore, we require a clear contractual basis for this or the corresponding wording in the DPA or its addendum.

What is the classification of Matrix42 regarding the EU AI Act?

Matrix42 is a provider of AI systems, but not foundation (GPAI) models. This means that:

• Matrix42 develops AI-powered products and systems (e.g. AI Knowledge, AI Actions, AI Workflow, AI Assist) using existing foundation or open-source models such as Mistral, Phi-4, Azure OpenAI, or Llama 3. 
• Matrix42 does not publish or distribute those base models as standalone products.

It is to mention that the documentation obligations concerning model training (datasets, weights, methodology) rest with the original model provider (e.g., Microsoft, Meta, Mistral). The responsibility of Matrix42 is to ensure compliance, transparency, and safe integration when using these models inside Matrix42 solutions.

Have the solution and its capabilities been assessed from a risk perspective in accordance with the EU AI Act?

Matrix42 has performed a risk classification of provided capabilities, aligned with the EU AI Act.