Purpose:

This Bizagi AI Acceptable Use Policy for Clients establishes universal guidelines for the safe, ethical, and responsible use of Bizagi AI Products and Services. It includes both global core principles and region-specific requirements that apply based on your contracting entity domicile and/or the region where you make your Output(s) available to end-users. You, along with those under their account, are expected to follow both the global core principles and any applicable region-specific requirements. Where there is any inconsistency, the provisions of the applicable region-specific requirements will take priority.

This policy forms part of, and is incorporated by reference into, the applicable main agreement between you and us. It is not a standalone policy and should be read together with the terms of the applicable main agreement.

1. Defined Terms: Capitalized terms used in this policy have the meaning given to them in the applicable main agreement between you and us, unless otherwise defined in this policy.

• 1.1 AUP means this Bizagi AI Acceptable Use Policy for Clients and includes both the Global Core Principles and any applicable Regional Supplements, which form integral parts of it.
• 1.2 Global Core Principles means the principles set out in Section 2 of this AUP and apply to you irrespective of where your contracting entity is domiciled or where you make your Output(s) available to end-users.
• 1.3 Regional Supplement means the principles set out in Section 3 and any applicable Attachment 1: EU Supplement, Attachment 2: UK Supplement and/or Attachment 3: US Supplement attached to this AUP.

2. Global Core Principles

• 2.1. When using
  • a) Understand and follow this AUP.
  • b) Use AI responsibly in a way that respects others, avoids misuse, and supports lawful, ethical outcomes.
  • c) Limit data input to information you have the legal right and authority to use,and avoid providing unnecessary personal or sensitive data.
  • d) Avoid making critical, unsupervised decisions that could affect individuals’ lives, rights, or safety using Output(s) — especially in areas such as employment, healthcare, credit, or legal matters — without qualified human oversight.
  • e) Ensure configurations are appropriate for your intended use and tested before deployment, particularly where your Output(s) could affect individuals or critical processes.
  • f) Provide transparency when AI-generated content is used in decision-making processes that affect individuals or groups.
  • g) Avoid using AI for professional advice (legal, medical, financial, or similar) without independent verification from a qualified professional.
• 2.2. What You Must Do: You are responsible for:
  • a) Understanding and following this AUP.
  • b) Reviewing Output(s) for accuracy, relevance, and appropriateness before use or distribution.
  • c) Limiting data exposure and respecting privacy, only inputting data you have the right to use.
  • d) Disclosing when AI-generated content is used in decision-making processes affecting individuals or groups.
  • e) Avoiding use of AI features for professional advice without independent verification.
  • f) Account Security: Protect your login details and account from unauthorized access.
  • g) Data Protection: Only input or share personal information for which you have explicit rights and permissions; handle any such data lawfully and securely.
  • h) Report Issues: Immediately inform us of suspected security incidents or policy violations.
• 2.3. Limitations and Disclaimers
  • a) Accuracy: Output(s) may not always be accurate or up to date; never rely solely on it for significant decisions.
  • b) Output Non-Uniqueness: Output(s) may not always be unique to you.
  • c) AUP Violations: Violating this AUP and/or any applicable Regional Supplement may result in suspension or termination of your access to Bizagi AI Products and Services, in line with your agreement.
  • d) No Legal Advice, and No Compliance Guarantee: The services we provide under the agreement this policy is incorporated by reference do not constitute legal advice and are not a guarantee of compliance with any law or regulation. We make no warranties, express or implied, regarding the performance, accuracy, or compliance of AI functionalities with your specific use cases or applicable regulations, except as expressly stated in the agreement. You are strongly encouraged to conduct regular audits of your Output(s), and to understand your Output(s) may be subject to complex intellectual property rights. You are solely responsible for determining the appropriate use and potential limitations of your Output(s), obtaining your own legal advice and determining your regulatory obligations for your deployments.
  • e) Azure OpenAI Data Handling: All Bizagi AI features are delivered via Microsoft Azure AI (Azure OpenAI Service). As described in Microsoft’s applicable terms and notices, your prompts and Outputs are not used to train Microsoft foundation models without your permission. Microsoft may retain limited data for service operation, safety, or abuse monitoring. Microsoft provides these capabilities independently, and we do not, and cannot, control Microsoft’s processing. Please review Microsoft’s terms referenced in section 5 below “Third-Party AI Terms (Microsoft Azure AI / Azure OpenAI Service)” and configure features and data flows as appropriate for your requirements. Microsoft’s terms may change from time to time. To maintain alignment with platform requirements, we may update this AUP and any applicable Regional Supplement(s). This paragraph is informational only, and does not modify Microsoft’s terms; you remain responsible for reviewing and complying with Microsoft’s terms.
• 2.4. Microsoft Azure AI / Azure OpenAI Service Terms: We leverage OpenAI models delivered via Microsoft Azure AI (Azure OpenAI Service). Your use of AI-enabled features is subject to, and you will comply with: (1) Microsoft’s Enterprise AI Services Code of Conduct (as updated); and (2) Microsoft’s Product Terms – For Online Services (as updated), including provisions on responsible/high-risk use, extracting data, and use of content for training. Where Microsoft requires eligibility, registration, or approval (including for Limited Access features), you will complete those steps. If there is any conflict between the terms of this AUP and any applicable Regional Supplement and the Microsoft Azure AI terms, the Microsoft Azure AI terms will take priority.

3. Regional Supplements

• 3.1. Applicability and Notice: Regional Supplements apply based on either (1) your contracting-entity’s domicile, or (2) the region where you make your Output(s) available to end users (i.e., where your end-users are located). If you deploy or use Output(s) in a different region than your contracting entity’s domicile, you must comply with the Regional Supplement for the region where those end-users are located.
  • a) Example: Your contracting entity, which is incorporated in the United States, uses Bizagi AI to distribute Outputs to end-users in the European Union. You must comply with both Attachment 1: EU Supplement and Attachment 3: US Supplement for that use case because, in addition to your contracting entity being domiciled in the United States, you have made your Outputs available to European Union end-users.
• 3.2. The Regional Supplements are designed to address specific region-based requirements and are as follows:
  • a) Attachment 1: EU Supplement: This Regional Supplement applies to you if you are based in the European Union.
  • b) Attachment 2: UK Supplement: This Regional Supplement applies to you if you are based in United Kingdom.
  • c) Attachment 3: US Supplement: This Regional Supplement applies to you if you are based in the United States.

4. Acknowledgement: By using Bizagi AI Products and Services, you confirm that you have read, understood, and agree to follow this AUP.

5. AUP Changes and Feedback: We commit to revising this AUP as regulations evolve and welcome your feedback to ensure continuous improvement and clarity for you.

Attachment 1: EU Supplement

Applicability: This EU Supplement applies when (i) your contracting entity is domiciled in the European Union; or (ii) you deploy or make Outputs available to end-users in the European Union. You are responsible for reviewing your deployments, determining whether this EU Supplement applies, and complying with it. We do not monitor your use cases. For clarity, nothing here limits any legal obligation that applies to us independently of your activities.

• I. Regulatory Framework
  • a. Compliance Approach: We make commercially reasonable efforts to design our products and services to enable compliance with applicable European Union regulations./li>
  • b. Shared Responsibility: You and we acknowledge that regulatory compliance in AI deployments requires cooperation, with us responsible for product design and you responsible for the compliance of your specific implementations.

• II. Our Commitments
  • a. Documentation: We have furnished reasonable documentation regarding the capabilities and limitations of our products and services to support your compliance efforts. This documentation is available at: Bizagi Cloud Platform
  • b. Data Processing: We process data in accordance with the Data Processing Agreement contained in the applicable contract between us and you.
  • c. Updates: We will use commercially reasonable efforts to adapt our products and services to material changes in European Union regulations during the term of our applicable contract with you.

• III. Your Commitments
  • a. Implementation Oversight: You remain responsible for:
    • i. Determining the appropriateness of our products and services for your specific use cases;
    • ii. Implementing appropriate safeguards based on your specific deployment context; and
    • iii. Ensuring end-user transparency in accordance with applicable European Union requirements.
  • b.Compliance Assessment: You acknowledge that you are best positioned to understand your regulatory obligations based on your specific implementation and use cases.

Attachment 2: UK Supplement

Applicability: This UK Supplement applies when (i) your contracting entity is domiciled in the United Kingdom; or (ii) you deploy or make Outputs available to end-users in the United Kingdom. You are responsible for reviewing your deployments, determining whether this UK Supplement applies, and complying with it. We do not monitor your use cases. For clarity, nothing here limits any legal obligation that applies to us independently of your activities.

• I. UK Regulatory Framework
  • a. Sectoral Regulation Approach: The UK employs a sector-specific regulatory framework where existing regulators apply AI governance principles within their respective domains. You acknowledge that compliance requirements may vary depending on the sector of deployment and applicable regulator jurisdiction.
  • b. Regulatory Principles: We make commercially reasonable efforts to design our products and services in alignment with the UK's core AI governance principles, including innovation, appropriate transparency, fairness, accountability and governance, and contestability and redress.
  • c. Council of Europe Framework: You acknowledge that the UK is a signatory to the Council of Europe's Framework Convention on Artificial Intelligence and agree to use our products and services in a manner consistent with its human rights, rule of law, and democracy principles.
• II. Sector-Specific Compliance
• a. Regulatory Cooperation: You acknowledge that AI governance in the UK operates through collaboration between sector-specific regulators and agree to comply with guidance issued by relevant authorities including:
  • i. Information Commissioner's Office (ICO) for data protection and privacy
  • ii. Office of Communications (Ofcom) for communications and online services
  • iii. Competition and Markets Authority (CMA) for competition and consumer protection
  • iv. Financial Conduct Authority (FCA) for financial services
• b. Innovation Commitment: We support the UK's pro-innovation AI strategy and commit to participating in voluntary frameworks and industry standards that promote responsible AI development while fostering innovation.
• III. Your Responsibilities
  • a. Sector-Specific Assessment: You remain responsible for:
    • i. Identifying applicable sector-specific regulatory requirements based on your deployment context
    • ii. Implementing appropriate governance measures consistent with relevant regulator guidance
    • iii. Ensuring compliance with industry-specific codes of practice and voluntary standards
  • b. Transparency and Contestability: Where you deploy our products and services in contexts affecting individuals, you shall implement reasonable measures to ensure transparency about AI use and provide appropriate mechanisms for individuals to understand and contest AI-driven decisions.
  • c. High-Risk AI Uses: You are solely responsible for determining whether your deployment constitutes a “high-risk” AI use under applicable UK law and for implementing any measures required by law, including, at a minimum, human oversight, logging/traceability, appropriate transparency to affected individuals, and risk controls proportionate to your context, and—where required—completing any conformity/risk assessments and registrations/notices to competent authorities. We do not monitor or police your use cases. We will work with you in good faith to support feature configuration and share product documentation to help you implement your chosen controls, while you remain responsible for your legal assessments and compliance decisions.
• IV. Regulatory Evolution
  • a. Adaptive Compliance: Given the evolving nature of UK AI governance, we will use commercially reasonable efforts to provide updates regarding material regulatory developments that may affect your use of our products and services.
  • b. Voluntary Framework Participation: We may participate in regulatory sandboxes, voluntary agreements, and industry initiatives that support responsible AI development within the UK framework.

Attachment 3: US Supplement

Applicability: This US Supplement applies when (i) your contracting entity is domiciled in the United States; or (ii) you deploy or make Outputs available to end-users in the United States. You are responsible for reviewing your deployments, determining whether this US Supplement applies, and complying with it. We do not monitor your use cases. For clarity, nothing here limits any legal obligation that applies to us independently of your activities.

• I. US Regulatory Framework
  • a. Sectoral Compliance: Our products and services facilitate your compliance with applicable US federal and state AI-related laws and regulations within relevant sectors, including but not limited to healthcare, financial services, consumer protection, and employment contexts.
  • b. Industry Standards: We implement commercially reasonable measures to align with evolving industry standards and voluntary AI frameworks recognized in the United States.
• II. Responsible AI Use
  • a. Accuracy and Non-Discrimination: You acknowledge that:
    • i. Output(s) may not always be accurate and should not be relied upon as the sole source for decision-making without appropriate verification.
    • ii. You are responsible for ensuring your specific implementation does not result in unlawful discrimination under applicable US laws.
  • b. Disclosure: When sharing Output(s) with third parties, you shall implement reasonable measures to indicate the automated nature of such Output(s) where material to the context of its use.
• III. Use Limitations
  • a. Professional Applications: You agree that our products and services are not designed to replace professional judgment. For applications involving healthcare, legal, financial, or other professional services regulated under US law, you shall ensure appropriate human review of Outputs.
  • b. Your Responsibilities: You retain responsibility for:
    • i. Determining the appropriateness of using our products and services for your specific use cases;
    • ii. Complying with industry-specific regulations applicable to your business operations;
    • iii. Implementing reasonable oversight measures appropriate to your particular context and risk profile.