How AI uses your data
What the assistant can read, what it can change, where your data is processed, and how you tell afterwards.
This page is the short answer to the question every reviewer asks.
What the AI can read
The reporting standards themselves, plus material inside your own organisation, and of that only what your own account already has access to:
- the text of ESRS and VSME: disclosure requirements, application requirements, guidance and data point definitions,
- reports, disclosures and data point values,
- organisation files you have uploaded, and data point attachments you have chosen to index,
- public Swedish company register data.
It does not read other organisations' data, and uploading a file does not on its own make it readable by the AI. Indexing is a separate, explicit action.
What the AI can change
Nothing, on its own. Every AI feature produces a draft that a person has to accept:
- the assistant and suggestions require Apply to field,
- disclosure summaries require a Replace or Append choice.
The one exception is an external AI client connected through MCP with a write scope. Those tokens can change report content directly, without a per-change confirmation, which is why write scopes are marked with a warning when a token is created, and why they should be issued sparingly.
Where your data goes, and what happens to it
Nothing you write is used to train a model. Not by us, and not by the AI provider. Your reports, your files and your questions to the assistant are used to answer that request and nothing else.
AI requests run on Microsoft Azure, on servers hosted in Sweden. Your report content stays inside the EU, on the same cloud platform that runs the rest of the application.
How you can tell afterwards
The history panel on every data point records the origin of each saved version:
- AI: written by the assistant in the application,
- AI-generated: the content came from AI and has not been touched since,
- Edited after AI: a person revised it,
- Agent: written through an MCP token, naming whose token it was.
This is a per-field audit trail. If an auditor asks whether a human reviewed a figure, that is where the answer is.
What this means in practice
AI in The Cards is a drafting aid working from the standard and from your own material. It shortens the distance between the documents you already have and the wording the standard wants. It does not report on your behalf, and the accountability for what the report says stays with you.
