Skip to main content

Compliance and legal FAQ

This reference answers common compliance, data-protection, and legal questions about DIAL for administrators and governance owners evaluating or operating a deployment. It describes the platform's capabilities and the boundaries of its responsibility; it is not legal advice.

Note

This document applies to self-hosted enterprise editions of DIAL.

Data usage and processing​

How is data transmitted to DIAL used? Is it incorporated into model training datasets?​

DIAL retains conversational data and prompts in system logs exclusively for governance and compliance purposes. When interfacing with third-party cloud-based large language models (including Azure OpenAI, Google Vertex, and AWS Bedrock), the platform uses your organization's designated cloud AI subscriptions. The processing, retention, and use of that data by those third-party providers is governed by the service agreements between your organization and the respective cloud service provider.

Where are conversation logs maintained, and what security protocols are implemented?​

DIAL stores all log data in object storage (Azure Blob Storage, Google Cloud Storage, or Amazon S3) provisioned within your organization's cloud infrastructure. Access controls and security configurations for that storage remain under the exclusive administration of your organization's IT department.

Technical limitations and safety​

What are the known technical limitations, such as the potential for hallucinations?​

DIAL functions solely as an orchestration layer for large language models and does not incorporate generative AI logic internally. Limitations such as hallucinations or factual inaccuracies are inherent to the specific models or applications being orchestrated, not to the platform itself.

What safety testing protocols are implemented for potentially harmful or malicious queries?​

As an orchestration layer, DIAL does not independently evaluate content or implement content-based restrictions. Responsible AI metrics, content filtering, and safety measures are functions of the specific models or applications being orchestrated, not of the platform itself.

Regulatory compliance​

How does DIAL support compliance with data privacy regulations such as GDPR?​

While specific compliance implementation remains the responsibility of the deploying organization, DIAL provides several compliance-oriented features:

  1. A configurable option to disable collection of conversation logs.
  2. Configurable data retention policies at the cloud storage level that can automatically purge conversation logs and sensitive files after a defined interval (for example, 30 days).
  3. An interceptor framework that examines communications bidirectionally — both user prompts and model responses.
  4. The ability to implement custom validation logic for detecting and handling sensitive information or personally identifiable information (PII).
  5. Options to modify or block requests containing prohibited content.

These capabilities help minimize and control the lifetime of PII within DIAL, supporting integration into an ecosystem that is compliant with data privacy regulations.

How does DIAL support compliance with the EU AI Act for general-purpose AI systems?​

While specific compliance implementation remains the responsibility of the deploying organization, DIAL provides technical capabilities that facilitate compliance with the EU AI Act, including:

  1. Comprehensive conversation logging for audit and investigative purposes.
  2. Transparent AI-generated content labeling mechanisms.
  3. User feedback collection for quality assessment and improvement.

Collected conversations and feedback help the deploying organization analyze how DIAL is used, make corrections, and add the guardrails needed to ensure compliance.

Security and data protection​

What security measures protect sensitive information processed through DIAL?​

DIAL incorporates a multi-layered security architecture, including:

  1. In-transit and at-rest protection of sensitive information, using the TLS protocol for all exposed connections and the built-in encryption of cloud storage services.
  2. Attack-surface minimization through reverse proxy implementation and API management.
  3. Network isolation of cloud resources via firewalls and private connectivity.
  4. Mandatory token-based authentication using JWT standards.
  5. Integration with OpenID Connect-compliant identity providers.
  6. Centralized role-based access control with granular permission management.
  7. Group-based access controls for precise resource authorization.

Intellectual property and liability​

Who retains intellectual property rights to content generated via DIAL?​

DIAL functions exclusively as an intermediary orchestration layer and does not independently generate or modify AI content. Intellectual property rights and copyright ownership for generated content are governed by the terms established in the service agreements between your organization and the respective model provider (Azure OpenAI, Google Vertex, AWS Bedrock, and others).

Who bears liability for inaccurate or inappropriate AI-generated content, and how is bias addressed?​

DIAL operates solely as an orchestration layer for third-party models and does not independently generate content. Liability considerations regarding content accuracy, appropriateness, and potential bias are determined by the contractual arrangements between your organization and the respective model service provider, as specified in the applicable service agreements.

What degree of human oversight is required for AI-generated content?​

The required level of human oversight depends on the criticality, sensitivity, and regulatory context of the content being generated. Policies governing content review, approval workflows, and override mechanisms are typically established by the implementing organization. Organizations are advised to develop comprehensive governance frameworks aligned with their operational requirements, risk tolerance, and applicable regulatory obligations.

Further reading​