AI Transparency Statement
1. Overview
ARRAC uses artificial intelligence to protect Microsoft 365 environments. Under the EU Artificial Intelligence Act (Regulation 2024/1689), we are required to clearly disclose when content has been generated by AI systems, and how autonomous decision-making is bounded. This page explains how we use AI, what it generates, how the AI Autonomy Engine's safeguards work, and how you can identify AI-generated content.
2. Our AI System
- AI provider: Anthropic (Claude)
- Models used: Claude Sonnet, Claude Haiku
- Purpose: threat analysis, incident investigation, report generation, security recommendations, and autonomous containment via the AI Autonomy Engine
- Classification under EU AI Act: Limited Risk system
- Human oversight: all autonomous containment actions operate within pre-approved boundaries set by your organisation, remain interruptible before execution, and are reversible for a fixed window afterward — see Autonomy Safeguards below
3. Autonomy Safeguards
The AI Autonomy Engine is the orchestration layer that reasons across evidence from all nine ARRAC modules and executes containment. It benchmarks ≤30 seconds for novel threats and ≤5 seconds for known/recurring threats (12.3 seconds measured average across live tenants). Three mechanisms keep a human in control of what it does:
Before acting autonomously, the Engine also requires a minimum number of confirmed prior precedents, scaled to how much damage a mistaken action could cause — the higher the confidence bar, the fewer precedents are required:
4. What AI Generates
| Content Type | How to Identify | Channel |
|---|---|---|
| Incident analysis summaries | "AI Generated" badge | Dashboard |
| Security incident reports | Footer disclosure on every PDF | PDF download |
| Incident alert emails | Disclosure notice in email footer | |
| ConnectWise/ServiceNow tickets | "[AI-Generated]" prefix in title | Ticketing system |
| Board reports | Footer disclosure on every PDF | PDF download |
| SLA reports | Footer disclosure on every PDF | PDF download |
| Security recommendations | Shown alongside analysis | Dashboard |
5. What AI Does Not Do
- AI does not make final decisions about your security posture
- AI does not act without operating inside boundaries your organisation has pre-approved, and every autonomous action stays interruptible and reversible as described above
- AI does not access data beyond your Microsoft 365 and Azure environment
- AI does not retain or train on your data (Anthropic's zero data retention policy applies)
6. Your Rights Under the EU AI Act
- Right to explanation: you can request an explanation of any AI-generated analysis or recommendation
- Right to human review: you can request human review of any AI decision by contacting [email protected]
- Right to opt out: autonomous AI actions can be disabled at any time from your platform settings
7. Data and Privacy
- AI analysis is performed on-demand only
- No customer data is used to train AI models
- All AI processing is logged with timestamps (available to platform administrators)
- Full audit trail maintained for regulatory purposes
8. Contact
For questions about how ARRAC uses AI, or to exercise your rights under the EU AI Act, contact us at: [email protected]
For technical questions about our AI systems: [email protected]
9. Last Updated
This statement was last updated: August 2026
Regulation reference: EU Artificial Intelligence Act (Regulation (EU) 2024/1689), Article 50 — Transparency obligations for providers and deployers of certain AI systems