AI Transparency Statement
1. Overview
ARRAC uses artificial intelligence to protect Microsoft 365 environments. Under the EU Artificial Intelligence Act (Regulation 2024/1689), we are required to clearly disclose when content has been generated by AI systems, and how autonomous decision-making is bounded. This page explains how we use AI, what it generates, how the AI Autonomy Engine's safeguards work, and how you can identify AI-generated content.
2. Our AI System
- AI provider: Anthropic (Claude)
- Models used: Claude Sonnet, Claude Haiku
- Purpose: threat analysis, incident investigation, report generation, security recommendations, and autonomous containment via the AI Autonomy Engine
- Classification under EU AI Act: Limited Risk system
- Human oversight: all autonomous containment actions operate within pre-approved boundaries set by your organisation, remain interruptible before execution, and are reversible for a fixed window afterward see Autonomy Safeguards below
3. Autonomy Safeguards
The AI Autonomy Engine is the orchestration layer that reasons across evidence from all nine ARRAC modules and executes containment. It benchmarks ≤30 seconds for novel threats and ≤5 seconds for known/recurring threats (12.3 seconds measured average across live tenants). Three mechanisms keep a human in control of what it does:
Before acting autonomously, the Engine also requires a minimum number of confirmed prior precedents, scaled to how much damage a mistaken action could cause the higher the confidence bar, the fewer precedents are required:
4. What AI Generates
| Content Type | How to Identify | Channel |
|---|---|---|
| Incident analysis summaries | "AI Generated" badge | Dashboard |
| Security incident reports | Footer disclosure on every PDF | PDF download |
| Incident alert emails | Disclosure notice in email footer | |
| ConnectWise/ServiceNow tickets | "[AI-Generated]" prefix in title | Ticketing system |
| Board reports | Footer disclosure on every PDF | PDF download |
| SLA reports | Footer disclosure on every PDF | PDF download |
| Security recommendations | Shown alongside analysis | Dashboard |
5. What AI Does Not Do
- AI does not make final decisions about your security posture
- AI does not act without operating inside boundaries your organisation has pre-approved, and every autonomous action stays interruptible and reversible as described above
- AI does not access data beyond your Microsoft 365 and Azure environment
- AI does not retain or train on your data (Anthropic's zero data retention policy applies)
6. Your Rights Under the EU AI Act
- Right to explanation: you can request an explanation of any AI-generated analysis or recommendation
- Right to human review: you can request human review of any AI decision by contacting [email protected]
- Right to opt out: autonomous AI actions can be disabled at any time from your platform settings
7. Data and Privacy
- AI analysis is performed on-demand only
- No customer data is used to train AI models
- All AI processing is logged with timestamps (available to platform administrators)
- Full audit trail maintained for regulatory purposes
8. Contact
For questions about how ARRAC uses AI, or to exercise your rights under the EU AI Act, contact us at: [email protected]
For technical questions about our AI systems: [email protected]
9. Last Updated
This statement was last updated: August 2026
Regulation reference: EU Artificial Intelligence Act (Regulation (EU) 2024/1689), Article 50 Transparency obligations for providers and deployers of certain AI systems