AI transparency
AI use that is transparent, controlled and accountable.
Where AI tools support XpertDPO work, the important questions are purpose, human review, data handling, professional judgement and accountability.
AI supports controlled work. It does not replace senior judgement, legal review or accountable decision-making.
Purpose, controls, human review and accountable decisions.
Policy
AI Usage Transparency Policy
Policy owner: XpertDPO
Last reviewed: 6 August 2026
1. Purpose
XpertDPO uses artificial intelligence (AI) to support aspects of its research, analysis, drafting, learning content and operational work. This policy explains where AI may be used, the controls we apply, how we describe AI-assisted work and where final responsibility sits.
AI supports our work. It does not replace senior professional judgement, legal analysis, independent DPO advice or accountable decision-making.
This policy covers AI tools used by XpertDPO employees, contractors and approved delivery partners. It concerns XpertDPO’s own use of AI; it is not advice about whether another organisation’s AI use is lawful or appropriate.
2. How We Use AI
Depending on the task and the information involved, AI may support:
- research, horizon scanning and the organisation of source material;
- analysis, comparison and identification of questions or possible omissions;
- drafting, editing and restructuring written material;
- preparation of learning materials, examples and summaries;
- coding, testing and technical documentation;
- document review and information discovery within an approved workflow; and
- the creation of clearly disclosed synthetic or avatar-led learning media.
AI output is treated as working material, not as verified fact, legal authority or a final professional conclusion. Relevant output is checked against source material, evidence and applicable law before it is relied upon or published.
3. Our Human-AI Working Model
Some XpertDPO articles identify Philipa Jane Farley and Eliot Vale as a human-AI pair. In that work:
- Philipa Jane Farley provides professional judgement, direction, context and final editorial approval;
- Eliot Vale, powered by OpenAI Codex, works alongside Philipa across research, analysis, drafting and editorial challenge; and
- Anthropic’s Claude may be used as an additional cross-check for source consistency, clarity and possible omissions.
We use a shared byline only where that description reflects the work actually performed. We identify a Claude cross-check only where it genuinely took place.
The byline describes the working process. It does not transfer legal, professional or publication responsibility to an AI system. Final approval and accountability remain with Philipa Jane Farley and XpertDPO.
4. Human Oversight and Professional Judgement
AI does not independently:
- provide final legal advice;
- determine an organisation’s compliance position;
- approve a DPIA, risk assessment or regulatory response;
- make decisions on behalf of a client or data subject; or
- replace the independence, escalation duties or judgement expected of a DPO.
The level of human review is proportionate to the purpose, sensitivity and possible impact of the work. Material intended for publication, client reliance or regulatory use receives appropriate human review before release.
5. Personal, Confidential and Client Information
We apply data protection principles to any use of AI involving personal data, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.
Before personal, confidential or client information is used in an AI-assisted workflow, we consider whether the use is necessary and appropriate. Depending on the circumstances, this includes the tool and account type, contractual protections, access controls, retention, international transfers, security, lawful basis, transparency requirements and whether a DPIA or other assessment is required.
We do not intentionally use client information or personal data to train general-purpose AI models. Sensitive information is not placed into public or unapproved AI tools. Where an approved AI service is used, we limit information to what is reasonably necessary for the task and apply the available organisational and technical controls.
6. Decisions, Profiling and Higher-Risk Uses
XpertDPO does not use AI to make solely automated decisions about individuals that produce legal or similarly significant effects.
At the date of this policy, XpertDPO does not knowingly deploy an AI system classified as high-risk under the EU AI Act. Classification depends on the intended purpose, context and XpertDPO’s role in the relevant use; it is not determined solely by a product label. A materially different or higher-risk use would require a specific assessment and appropriate controls before deployment.
XpertDPO does not use AI for emotion recognition or biometric categorisation of clients, website visitors, learners or staff.
7. Transparency in Public Content and Interactions
Our public articles are subject to human review and editorial control, and XpertDPO holds responsibility for publication. Where AI has made a material contribution, we may provide a byline, author note, review note, label or other explanation even where a particular form of disclosure is not legally required.
Where people interact directly with an AI system, or encounter AI-generated or manipulated audio, image or video that could reasonably be mistaken for authentic content, we provide an appropriate disclosure where required and, where useful, as a matter of good practice.
Synthetic or avatar-led learning media is identified in a way appropriate to its format and context.
8. Quality, Fairness and Security
AI systems can produce errors, omit relevant context, reproduce bias or present uncertain material confidently. We address those risks through proportionate measures such as:
- checking important statements against authoritative sources;
- separating source material from inference and draft analysis;
- using human challenge and review;
- limiting data and access;
- applying security and supplier controls appropriate to the use; and
- escalating material uncertainty rather than presenting it as fact.
We do not claim that AI output is neutral or correct merely because it was generated by a particular system.
9. Governance and Review
We keep proportionate records of approved or material AI use cases and the assessments required for them. The level of documentation depends on the nature of the system, the information involved and the effect the use may have on people, clients or regulated work.
We review AI uses when the purpose, tool, information, supplier terms, risk profile or applicable law materially changes. Team members using AI are expected to follow XpertDPO’s approved working practices and to raise concerns or uncertainty.
This policy will be reviewed when there is a material change in our AI use or in the legal and regulatory framework.
10. Questions, Concerns and Individual Rights
You may ask us:
- whether AI materially contributed to content or a service you received;
- for an explanation of how human review and accountability were applied;
- to correct inaccurate personal data or raise a concern about our processing; or
- to exercise any applicable data protection right.
Email: dpo@xpertdpo.com
Phone: +353 1 678 8997
Post: 20 Harcourt Street, Dublin 2, Ireland
Further information about our handling of personal data is available in our Privacy Notice.
Relevant Framework
Next step
Need to examine an AI use in context?
Tell us what the system does, what information it uses and where the output matters. We will help frame the privacy, governance and DPIA questions.