AI Governance

This AI Governance describes the principles, processes and technical measures that form the basis for the development, implementation and use of artificial intelligence at CitizenOne.

This governance has been prepared based on, among other things:

• EU AI Act
• General Data Protection Regulation (GDPR)
• Privacy by Design
• Security by Design
• Enterprise best practice from international software vendors

The purpose is to ensure that CitizenOne AI is used responsibly, securely, transparently and in accordance with applicable legislation, as well as our own requirements for information security, quality and ethics.

The purpose of AI at CitizenOne

CitizenOne uses artificial intelligence as an assistive tool to support employees in their daily work.

AI is not used for automatic case processing or to make independent decisions about citizens, employees or other data subjects.

The authorized user always has full responsibility for reviewing, validating and approving AI-generated content before it is potentially used or saved in CitizenOne.

AI is intended to help the user with, among other things:

• summarizing information
• preparing case notes
• structuring text
• improving wording
• drafting documents
• answering questions based on the organization's own records

Our AI principles

CitizenOne AI is developed based on a number of fundamental principles designed to ensure responsible use of artificial intelligence, high information security and respect for the data of users and citizens.

All AI functions are developed according to fixed governance principles.

These principles are applied when developing new AI functions, when changing existing functions, and as part of our ongoing compliance and security work.

Humans always have the final decision

CitizenOne AI functions exclusively as decision support and writing assistance.

All AI-generated suggestions must be assessed and approved by an authorized user.

AI can never automatically create, change or approve case record information or other entries without the user's active action.

Privacy by Design

Protection of personal data is built in as a fundamental part of CitizenOne's AI architecture.

The system is developed with a focus on data minimization, anonymization, access control and secure processing of information throughout the entire AI process.

Security by Design

Information security is integrated throughout the entire AI solution.

The AI functions are developed with a focus on secure communication, authorization, audit, logging and continuous monitoring.

Data minimization

CitizenOne only processes the information necessary for the specific AI task.

No more information is ever processed than necessary to deliver the desired functionality.

Transparency

The user must be able to understand when AI is being used, what information is included in the processing, and what limitations AI has.

CitizenOne works actively to make the AI process as transparent as possible without compromising security.

Responsible AI

We develop AI with a focus on accountability, ethics and respect for citizens' rights.

AI must never be used in a way that could lead to unlawful processing of personal data or the disregard of professional assessments.

Continuous improvement

CitizenOne AI is continuously developed.

We continuously evaluate functionality, security, user experience, data protection and legislation to ensure that the AI solution continues to meet applicable requirements and best practice.

Governance Framework

CitizenOne's AI Governance is based on six central governance areas.

All new AI functions are assessed against these governance areas prior to implementation.

The purpose is to ensure a consistent development process with a focus on compliance, information security, quality and responsible use of artificial intelligence.

The Governance Framework covers the following areas:

• Legislation and compliance
• Information security
• Data protection
• Technical architecture
• Human oversight
• Continuous improvement and risk management

Roles and responsibilities

CitizenOne

CitizenOne is responsible for the development, operation, security, maintenance and continuous improvement of the AI platform.

We ensure that the AI solution is developed in accordance with applicable legislation, contractual obligations and internal security requirements.

The Customer

The individual organization is responsible for the specific use of the AI functions and for ensuring that employees use AI in accordance with the organization's own policies and procedures.

The User

The authorized user always bears responsibility for reviewing, validating and approving AI-generated content.

AI functions solely as an assistive tool.

AI architecture and AI workflow

CitizenOne AI is developed according to the principles of Privacy by Design, Security by Design and Human in the Loop. AI functions as an assistive tool that supports authorized users in their daily work, but never makes independent decisions or automatic changes to the organization's data.

AI functions exclusively as decision support.

All AI-generated suggestions must always be reviewed, assessed and approved by an authorized user before they are potentially used or saved in CitizenOne.

Overall AI workflow

• The user actively selects an AI function.
• CitizenOne identifies the relevant function and the necessary data basis.
• Only the information necessary for the specific AI task is selected.
• Directly identifiable personal information is anonymized or removed before AI processing.
• The anonymized data basis is processed via an encrypted connection.
• AI generates a suggestion based on the available data basis.
• The user receives the AI suggestion.
• The user reviews, edits and approves the result themselves.
• Only after the user's active action can the content be saved in CitizenOne.

How AI is used at CitizenOne

Assistive technology

CitizenOne AI is developed to support employees through intelligent suggestions, summaries and text generation. AI functions as a professional support tool and does not replace the employee's judgment or responsibility.

No automatic decisions

AI does not make automatic decisions about citizens, employees or the organization's records. All actions require an authorized user's active approval.

Human oversight

Human in the Loop is a fundamental principle in CitizenOne AI. The authorized user always bears full responsibility for validating, editing and approving AI-generated content.

AI functions

CitizenOne offers several AI functions, all of which are based on the same overall governance model and the same security principles.

Ask AI

An intelligent AI assistant that helps authorized users answer questions based on the organization's own records and the relevant data basis.

AI-assisted case note generation

AI can help prepare draft case notes and other documentation based on the specific task and the relevant data basis.

Own ChatGPT

Organizations can choose to use their own OpenAI account through CitizenOne. This function is managed separately from CitizenOne's standard AI solution and follows the security and governance principles that apply to this integration.

Data basis and AI processing

CitizenOne AI only processes the information necessary to perform the specific AI function that the user has actively selected.

AI never processes more information than necessary.

Data minimization is a fundamental principle in CitizenOne's AI architecture and is an integral part of the processing of all AI requests.

Principles for data processing

• Only relevant information is used for the specific AI task.
• Data processing follows the principle of data minimization.
• Organizations' data is processed with logical separation.
• AI only uses the organization's own records.
• The data basis is delimited based on the selected AI function.
• All AI requests are processed via encrypted connections.

How AI selects the data basis

CitizenOne automatically assesses which information is necessary to carry out the specific AI task. The data basis depends, among other things, on the AI function the user has selected, the current work context and the records relevant to the specific action.

Ask AI

Ask AI uses the organization's relevant records as context to answer the user's question. Only information deemed necessary for the specific request is included in the processing.

Case note generation

With AI-assisted case note generation, the data basis is limited to the specific citizen and the relevant records that support the preparation of the requested suggestion.

Own ChatGPT

Organizations using Own ChatGPT use their own OpenAI account and their own data environment. This function is managed separately from CitizenOne's standard AI solution.

Access control

CitizenOne uses authorization management to ensure that AI can only work with information that the specific user is authorized to access.

Access principles

• AI respects the organization's access rights.
• Users can only use information they are authorized for.
• Data is separated between organizations.
• Case note functions only work with the current citizen.
• Access is checked before AI processing.

Anonymization and data minimization

Before information is processed by AI, CitizenOne uses technical mechanisms to reduce the amount of directly identifiable personal information, where this is relevant to the specific AI function.

Directly identifiable personal information is processed according to the principle of data minimization.

CitizenOne is continuously working to further develop anonymization, redaction and protection of information as part of the platform's security architecture.

Protection of information

• Redaction of directly identifiable personal information.
• Protection of national ID numbers.
• Protection of names, addresses and contact information.
• Redaction of information in text fields.
• OCR-based processing of documents and images before AI processing.
• Continuous further development of data protection.

Information security and AI security

Information security is a fundamental part of CitizenOne's AI platform. The AI functions are developed with a focus on confidentiality, integrity, availability and traceability throughout the entire data processing lifecycle.

Security is built into the entire lifecycle of the AI solution.

CitizenOne is continuously working to further develop the platform's security measures in line with technological developments, changes in legislation and new threat landscapes.

Information security includes, among other things

• Encrypted communication.
• Authentication and authorization.
• Access control.
• Audit and traceability.
• Automated data protection.
• Continuous security improvements.

Encryption and secure communication

Communication between CitizenOne and the AI services used takes place via encrypted connections. Data is transferred using modern transport encryption to protect information against unauthorized access during transmission.

Transport

AI communication takes place via secure, encrypted connections between CitizenOne and the AI services used.

Data protection

Data is processed under controlled security measures with a focus on confidentiality and integrity.

Secure architecture

AI communication is an integral part of CitizenOne's overall security architecture.

Logging and Audit Trail

CitizenOne logs relevant AI events to support security, compliance, troubleshooting and documentation.

The audit log supports traceability and verifiability.

Logging is used for security, compliance, incident investigations and continuous improvement of the platform.

Examples of logged information

• The AI function that was used.
• Time of processing.
• Authorized user.
• AI model used.
• Data sources used for the AI processing.
• Relevant events in the AI process.

Data retention and automatic deletion

CitizenOne follows the principles of data minimization and does not retain AI-related information longer than necessary.

Retention principles

• Automatic retention rules.
• Automatic cleanup of AI data.
• Deletion in connection with statutory deletion requirements.
• Ongoing maintenance of AI-related data.
• Controlled lifecycle for AI information.

Continuous security improvements

CitizenOne is continuously developed with a focus on improving security, data protection, transparency and compliance.

AI Governance is a dynamic process.

New AI functions and security improvements are continuously assessed in relation to applicable legislation, technological developments and best practice.

Examples of continuous improvements

• Improved anonymization and data protection.
• Expanded access control.
• Improved audit and logging.
• Optimization of AI architecture.
• Continuous risk assessments.
• Adaptation to new legislation and AI standards.

Compliance and legislation

CitizenOne develops and operates the AI functions with a focus on compliance with applicable legislation, recognized security standards and responsible use of artificial intelligence.

Compliance is an integral part of the development process.

New AI functions are continuously assessed in relation to applicable legislation, data protection, information security and risks before they are made available to customers.

AI Governance supports, among other things

• EU AI Act.
• General Data Protection Regulation (GDPR).
• Privacy by Design.
• Security by Design.
• Enterprise best practice.
• Continuous risk management.

Data protection (GDPR)

Protection of personal data is a central part of CitizenOne's AI Governance. The AI functions are developed with a focus on data minimization, access control, traceability and responsible processing of information.

Data minimization

CitizenOne only processes the information necessary for the specific AI function.

Privacy by Design

Data protection is an integral part of architecture, development and operations.

Secure processing

Personal data is processed under appropriate technical and organizational security measures.

Human control (Human Oversight)

CitizenOne AI is developed according to the principle of Human in the Loop.

AI never makes independent decisions.

All AI-generated suggestions require an authorized user's active assessment and approval before they are potentially used or saved.

Human Oversight includes, among other things

• The user actively starts the AI function.
• The user assesses the AI suggestion.
• The user can edit the AI content.
• The user decides for themselves whether the result should be used.
• AI makes no automatic decisions.

AI models and AI providers

CitizenOne may use external AI services as part of the platform's AI functions.

Any AI providers are continuously assessed based on requirements for security, data protection, functionality and compliance.

General principles

• AI providers are continuously assessed.
• Data processing takes place under relevant agreements.
• AI models are used solely as assistive technology.
• Customer data is not used to train AI models unless this is expressly stated in the specific AI provider's terms and the chosen solution.
• CitizenOne continuously evaluates alternative AI technologies.

Limitations of AI

Artificial intelligence can generate imprecise, incomplete or erroneous suggestions.

AI must never replace professional judgment.

CitizenOne always recommends that AI-generated content be critically reviewed by an authorized user before use.

The user should be aware that

• AI can make mistakes.
• AI may lack context.
• AI may suggest imprecise wording.
• AI does not replace professional judgment.
• The user always bears the final responsibility.

Governance, revision and document management

AI Governance is a living governance document that is continuously maintained and updated in line with the development of CitizenOne, changes in legislation, new AI technologies and changed security and compliance requirements.

AI Governance is a continuous process.

CitizenOne continuously reviews AI functions, security measures and governance principles to ensure continued compliance with applicable legislation and best practice.

Governance includes, among other things

• Continuous review of AI functions.
• Assessment of new AI technologies.
• Updating of security measures.
• Adaptation to new legislation.
• Continuous risk assessments.
• Continuous improvement of the AI platform.

Changes to this AI Governance

CitizenOne may continuously update this AI Governance to reflect changes in AI functionality, security measures, legislation or other matters of relevance to the use of artificial intelligence.

When is the document updated?

The document is updated, among other things, in the event of significant changes to the AI platform, changes in applicable legislation, or the implementation of new security measures.

Versioning

CitizenOne works with continuous versioning of the AI Governance, so that customers and partners always have access to the current version.

Transparency

We strive for the greatest possible transparency regarding the development and use of AI at CitizenOne.

Contact regarding AI

If you have questions about CitizenOne's AI Governance, AI functions, data protection or information security, you are always welcome to contact us.

Contact

• CitizenOne
• Email: support@citizenone.dk
• Web: https://citizenone.dk

Document information

This AI Governance describes the overall principles for the development, operation and use of artificial intelligence at CitizenOne.

This document should be read together with CitizenOne's other legal and security documentation, including our terms and conditions, privacy policy, data processing agreement and other security documentation.

Document details

• Document: AI Governance
• Product: CitizenOne
• Document type: Governance
• Status: Current
• Version: 1.4
• Last updated: April 2026

Closing remarks

CitizenOne believes that artificial intelligence should support people - not replace them. Our AI is developed with a focus on accountability, transparency, information security and respect for each organization's data. We continuously work to further develop both our AI platform and our governance model, so that CitizenOne continues to meet the highest standards for safe and responsible use of artificial intelligence.