Artificial Intelligence Policy

1. Purpose and Scope of Application

2. Prohibited AI Practices (Art. 5 EU AI Act)

In compliance with Article 5 of the EU AI Act, EMSy DOES NOT use the following prohibited practices:

3. Transparency and Disclosure (Art. 50 EU AI Act)

3.1 AI Interaction Notice

In compliance with Article 50(1) of the EU AI Act, EMSy ensures that:

• All conversational AI systems (AI Assistant, AI Coach, Emergency Simulations) display a disclosure banner informing the user they are interacting with an AI system
• The disclosure is clear, visible and distinguishable, positioned above the chat interface
• The information is provided before the first interaction or at the time of exposure
• Includes links to this AI Policy and the problem reporting form

3.2 AI-Generated Content

Text content generated by EMSy's AI systems (chat responses, feedback, suggestions) is:

• Identifiable as AI-generated: Every response comes from an interface clearly labeled as "AI"
• Subject to human verification: Users are encouraged to verify information with official sources
• Not used for disinformation: EMSy does not generate deepfake content, synthetic audio/video or fake news articles

3.3 No Emotion Recognition or Biometric Categorization

EMSy DOES NOT use emotion recognition or biometric categorization systems. Therefore, the disclosure obligations under Art. 50(3) do not apply.

4. Third-Party AI Providers

EMSy DOES NOT develop proprietary AI models. We use advanced artificial intelligence models provided by industry-leading certified providers.

4.1 Certified AI Providers

Our AI systems are based on technologies provided by globally recognized companies, including:

4.2 Automatic Model Selection

EMSy uses an intelligent routing system that automatically selects the most appropriate AI model based on request complexity, ensuring:

• Optimal medical accuracy for complex clinical cases
• Response speed for emergency scenarios
• Service reliability and availability (99.9% uptime)
• Cost optimization for service sustainability

4.3 Zero Data Retention Policy

✅ EMSy user data is NOT used for AI model training

• Conversations with AI Assistant and AI Coach are private and encrypted
• We use "zero data retention" mode with providers
• No personal identifiable information (PHI/PII) is shared
• Users are instructed to NOT enter sensitive data from real patients
• GDPR Art. 25 compliance (Data Protection by Design)

5. Security and Data Protection Measures

5.1 Filters and Content Moderation

EMSy implements technical measures to ensure safe and appropriate AI outputs:

• Harmful content filters: Automatic blocking of outputs suggesting dangerous practices, incorrect dosages or non-evidence-based treatments
• Medical validation: RAG (Retrieval-Augmented Generation) system that verifies AI responses with official guidelines databases (ERC, ILCOR, WHO)
• Rate limiting: Request limits to prevent abuse and ensure response quality
• Logging and audit: Recording of AI interactions for quality assurance and incident response

5.2 Personal Data Protection (GDPR)

The use of AI systems on EMSy is subject to our Privacy Policy and complies with GDPR:

• Data minimization: Only strictly necessary data is processed (user prompt text, profession/level profile for contextualization)
• Pseudonymization: Conversations are anonymized on the AI provider side (session ID only, no username)
• GDPR rights: Access, deletion, AI data portability available via GDPR profile
• Legal basis: Contract performance (Art. 6.1.b GDPR) for AI services included in the subscription

6. AI Literacy and Training (Art. 4 EU AI Act)

In compliance with Article 4 of the EU AI Act, EMSy ensures an adequate level of AI literacy for:

• Internal staff: Periodic training on AI systems operation, limitations and risks
• Professional users: Documentation, FAQ, guides on responsible use of AI tools
• Stakeholders: Transparency on system capabilities and limitations through this policy

6.1 Internal AI Literacy Program

EMSy maintains a continuous training program that includes:

• Basic principles of machine learning and large language models (LLM)
• AI system limitations: hallucinations, bias, temporal drift
• EU AI Act prohibited practices and red flag identification
• Escalation procedures for incident response (dangerous outputs, malfunctions)
• Sensitive data management and privacy protection in AI context
• Training records (dates, participants, materials) kept for audit

6.2 User Resources

EMSy users have access to:

• AI FAQ: Frequently asked questions about how AI Assistant and AI Coach work
• In-app tutorials: Contextual guides on best practices for effective prompts and response verification
• Correct/incorrect use examples: Case studies on appropriate and inappropriate AI situations
• Reporting channel: Form for feedback and problem reporting

7. Problem Reporting and Incident Response

EMSy encourages users and stakeholders to report:

• Dangerous, incorrect or inappropriate AI outputs
• Suspected system malfunctions
• Bias or discrimination in responses
• Privacy or data security violations
• Improper use of the platform

7.2 Incident Management Process

Reports follow this workflow:

1. Receipt and triage (within 24h): Severity classification (critical/high/medium/low)
2. Investigation: Log analysis, problem reproduction, root cause identification
3. Corrective action: Model patch, filter update, system prompt modification, escalation to AI provider
4. User notification: Feedback to reporter with outcome and actions taken
5. Post-mortem and prevention: Incident documentation, training update, preventive improvements

8. AI System Classification

Under the EU AI Act, EMSy evaluates its classification as follows:

8.1 Not a High-Risk AI System (Currently)

EMSy is not currently classified as a High-Risk AI System (Annex III EU AI Act) because:

• NOT a medical device: Does not provide direct diagnosis, prognosis or therapeutic decisions (does not fall under MDR/IVDR Art. 2)
• Is an educational tool: Supports professional training and updates, does not replace clinical decisions
• Mandatory human supervision: All AI outputs require verification by the professional

8.2 Not a GPAI Model Provider

EMSy IS NOT a General-Purpose AI (GPAI) model provider under Art. 53 EU AI Act. We exclusively use third-party models via API. GPAI obligations (training data documentation, copyright measures, systemic risk assessment) apply to upstream providers (Anthropic, Google, OpenAI).

9. Updates and Version Control

This AI Policy may be updated to reflect:

• Changes to AI models used or providers
• New AI features added to the platform
• Regulatory updates (EU AI Act, AI Office guidelines, EDPB)
• Security and transparency measure improvements

Users will be informed of substantial changes via:

• In-app banner with link to new policy version
• Email to registered address (if communications consent is active)
• Version date update at the top of this page

10. Contacts and Questions

For any questions about the use of artificial intelligence on EMSy, your rights or for reports:

11. Regulatory References

This AI Policy is drafted in compliance with: