Services
AI Use Privacy Review
We review how your business uses AI, in one project: which tools your staff and your product use, what personal data goes into them, and whether that use is lawful. At the end you receive an opinion signed by a lawyer and a list of what to fix, so you can keep using the tools without exposing customer data. Every opinion and every document goes out only after one of our lawyers has checked it.
What gets examined
The review examines six areas, each against Israeli law, and against EU law where it applies to you.
The tools in use
Which AI tools your staff and systems use, and what personal data goes into them.The basis for using the data
Whether each tool may use the data, given what people were told when it was collected, and when consent is needed — including for training a model and for data collected from the internet.Supplier terms
Where the supplier processes the data, whether it trains its models on it, how long it keeps it, and whether the data leaves Israel.AI in your product
What users are told, whether the system makes decisions about people, and what happens when its output is wrong.Agents and permissions
What an AI agent connected to your systems can see, what it may do, and where a person approves before it acts.Customers in Europe
If your product is used in the EU: the EU AI Act’s transparency duties — telling users they are dealing with an AI system, and marking content it generates.
Deliverables
At the end you receive a written legal answer, and the order in which to close the gaps.
| Deliverable | What it contains |
|---|---|
| AI use map | The tools and features in use, what data goes into each, and who in your organisation owns it. |
| Legal opinion | An answer signed by a lawyer: which uses are lawful, which need changes, and on what conditions you can continue. |
| Privacy impact assessment (DPIA) | For a use that creates a high risk for the people the data concerns: the risks, and the measures that reduce them. |
| Supplier terms | What to require of your AI suppliers, or which clauses to add to your agreement with them. |
| Agent permission rules | Access on a need-to-know basis, view-only by default, and a person’s approval before action. |
| Order of treatment | A handover session on the gaps and the order to address them, and a management briefing: what is allowed, what was decided and who owns it. |
How it runs
The work runs in five steps, and the scope is set in writing before it starts.
- Initial fit call
- A first discussion of the need, scope and priorities.
- Scope letter
- Deliverables, timetable and terms of engagement, in writing, before work starts.
- Collection
- The list of tools, supplier terms and documents, then conversations with the relevant people on your side.
- Delivery
- The deliverables, then a handover session on the gaps and the order to address them.
- Continuation, if you want it
- Ongoing support, or the Fractional Chief AI Officer role.
- 1. Fit call
- 2. Scope letter
- 3. Collection
- 4. Delivery
- 5. Continuation
Questions people ask
How is this different from a Fractional Chief AI Officer?
The review is one project, and it ends in an opinion and an order of treatment. The Chief AI Officer is a standing role: approving new tools, training staff and reporting to management. You can start with the review and continue to the role, and the documents written in the review carry over to it.
Do we need consent to train an AI model on our customers’ data?
As a rule, yes. In its draft guidance on AI, the Privacy Protection Authority holds that privacy law applies to training too, and that the usual basis is informed consent — separate and explicit where the purpose is complex. Under the draft, using personal data collected from the internet without consent is usually a prohibited invasion of privacy. The guidance is still a draft, but it states the Privacy Protection Authority’s position, and the review checks each use against it.