Anyone operating an AI chatbot must be able to demonstrate to data protection officers, internal audit, and regulatory authorities that both the GDPR and the EU AI Act are complied with. Evidence originates in three places: in the contract with the vendor, within the platform itself, and inside your own organization. A dedicated compliance dashboard is rarely required for this. What matters is that each party delivers its part and that someone knows where it is located. This article outlines the required records, explains what a vendor should provide, and concludes with a checklist for your next audit.

At a Glance

• The deployer bears responsibility for the purpose and conformity of the specific deployment. The vendor provides the foundation.

• Transparency under Art. 50 EU AI Act: Users must recognize that they are interacting with an AI. The proof is the label in the chat and its configuration.

• GDPR records are documented in the DPA, TOMs, the Record of Processing Activities, and, where necessary, the Data Protection Impact Assessment.

• Operational proof is provided by the platform: audit logs, versioning, retention periods, and the origin of every response.

• AI literacy is the responsibility of your own organization and is documented through training records.

Who Must Prove What

The EU AI Act distinguishes between the provider of an AI system and the deployer who implements it. For a customer service chatbot, this means: the deployer decides what the chatbot is used for, with what data, and for whom. The deployer is therefore responsible for the compliance of this specific use case.

The vendor is accountable for what the platform delivers and how it is operated. In the case of Mercury.ai, this is an AI system that embeds licensed models. It does not provide its own General Purpose AI Model and does not make automated decisions about individuals in sensitive areas. Mercury.ai is not a high-risk system. The specific deployment remains decisive, and classification is carried out by the deployer.

A similar division applies under the GDPR. The enterprise is the data controller, while the vendor acts as a processor. The legal foundation is a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.

Overview of Required Records

Contractual Documentation

The DPA is the first document requested by data protection officers. It outlines which data is processed, who the data subjects are, and which sub-processors are involved. Ensure that the annex is complete and that the vendor is obligated to announce any changes to sub-processors in advance.

The technical and organizational measures describe how data is protected: encryption, access control, multi-tenant separation, and logging. Many vendors provide TOMs upon request. For an audit, this is sufficient as long as the document is up to date and aligns with the DPA.

The contract must also govern notification obligations: how quickly does the vendor report a data breach, and how does it handle requests from authorities? Both must be clearly specified in the DPA.

Platform-Generated Evidence

A significant portion of the compliance records is generated during ongoing operations. A platform should provide this automatically, without requiring manual compilation.

Labeling. The chat indicates that an AI is responding. What matters for compliance is that this labeling is active by default and cannot be accidentally disabled without being noticed.

Audit Log. Who approved a knowledge source, modified a dialogue, or adjusted a setting, and when? A comprehensive audit log answers these questions and is among the first things internal audit will ask to see.

Versions and Environments. Changes should always be tested in a staging environment before going live. Separate environments for draft, test, and production ensure complete traceability of which version was active at any given point in time.

Origin of Responses. Every answer should be traceable back to its source, document version, or rule. This serves as proof that the chatbot generates responses exclusively from verified content.

Retention Periods. How long conversations are retained is defined by the deployer. Proof is established through the retention rules configured directly within the platform.

Internal Organizational Evidence

Certain obligations cannot be outsourced to a vendor. The Record of Processing Activities must be maintained by the controller itself. Whether a Data Protection Impact Assessment is required depends on the specific use case—such as what data the chatbot captures and which downstream systems it interfaces with. The vendor supports this by providing details on data flows, storage locations, and protective measures.

For AI literacy under Art. 4 of the EU AI Act, it is essential that the personnel who maintain, monitor, and operate the chatbot understand its capabilities and limitations. Documented training sessions for editorial, service, and administrative staff provide the most straightforward proof.

Do You Need a Centralized Compliance Dashboard?

For the chatbot alone, usually not. The required records reside in the contract, within the platform, and across your own organization, each managed by its respective owner. A compliance management tool can be beneficial when an enterprise needs to consolidate numerous AI systems and processing activities across multiple departments, aggregating documentation from all three sources. More important than the tooling itself is having clear ownership and knowing where every record is maintained.

Checklist for Your Next Audit

1. Is the DPA available with a complete annex covering data categories and sub-processors?

2. Do you have the vendor’s current TOMs?

3. Is the chatbot documented in the Record of Processing Activities?

4. Has the necessity of a Data Protection Impact Assessment been evaluated and documented?

5. Is AI labeling active in the chat, and is this verifiable?

6. Are deletion periods configured and aligned with your data retention policy?

7. Can the audit log demonstrate who modified content and system settings?

8. Can individual responses be traced back to their exact source?

9. Have the teams managing the chatbot received appropriate training, and is this documented?

How Mercury.ai Supports Compliance

Mercury.ai provides a DPA pursuant to Art. 28 GDPR, TOMs upon request, and comprehensive EU AI Act documentation for you as the deployer. Art. 50 AI labeling is active by default in the chat widget. The platform logs all changes seamlessly in the audit log, strictly separates draft, test, and production environments, and ensures every response is traceable to its source, document version, or rule. Retention periods can be configured directly within each project, ranging from immediate deletion after input to the end of the contract term.

There are no generic templates for the Record of Processing Activities or DPIAs. Instead, Mercury.ai provides the project-specific technical specifications you need for your internal documentation. For an overview of the compliance model, refer to our Security Paper on the EU AI Act. For fundamental insights on GDPR and AI regulation for chatbots, see our article on GDPR- and EU AI Act-compliant AI chatbots.

Summary

Proof of GDPR and EU AI Act compliance in chatbot operations is distributed across three pillars, each with clear ownership. The contract governs data processing, the platform logs operations, and your own organization documents purpose, processing activities, and training. Establishing this structure in advance ensures complete confidence during your next audit.

Preparing for a chatbot data protection audit? Talk to our team.