awork and AI

Our approach to AI

AI should support people in their work - not make decisions or take on responsibility.

awork AI helps users with things like:

• Summarizing information from their work context,

• Creating or editing content,

• Answering questions about projects and tasks,

• Preparing workflows,

• and executing explicitly triggered actions within awork.

AI results can be incorrect and should be reviewed before you use them.

No autonomous action

awork AI operates based on user initiation or on the basis of prior configuration by the customer.

Agents and AI features are started by a query, a defined action, a scheduled trigger, or another configured workflow. This way, they don't get unlimited access to a workspace on their own.

Your existing awork permissions still apply to all actions.

What AI technology does awork use?

awork isn't locked into a single language model.

Depending on the feature and the model you choose, models can be provided through different controlled AI infrastructures, specifically:

• Microsoft Azure AI Foundry,

• Google Vertex AI,

• Amazon Bedrock,

• TensorX for selected open-source models.

Which infrastructure is used depends on the specific model you select.

You'll find details about the respective data processing locations under "Sub-processors & Data flows".

Your control

The awork platform can be used without any AI data processing.

Workspace admins can:

• Turn off AI features,

• disable the AI models available for regular use,

• and decide whether the separate awork AI add-on is purchased for the workspace.

Some technical or basic AI features may be based on fixed predefined models that aren't part of the regular model selection.

This way, every organization can determine how much AI is used within their workspace.

Data protection for AI requests

AI processing follows the same core principles as all other data processing in awork:

• Only the data required for each specific request is processed.

• Your existing awork permissions are respected.

• Data is transmitted encrypted.

• Your data is not used to train general AI models.

• Providers are reviewed for data protection and security before we use them.

The technical AI providers handle processing for each request. Content that awork itself needs to store - like AI conversations or configurations within the product - is stored within awork's infrastructure.

If you connect external systems or MCP servers yourself, the third party's respective terms, data protection rules, and processing locations apply to those as well.

Security mechanisms

Depending on the model and provider used, additional protective mechanisms are in place, such as:

• Content and security filters,

• technical access restrictions,

• encryption,

• processing region limitations,

• permission checks within awork.

AI and the EU AI Act

Based on the functionality currently planned, awork doesn't provide high-risk AI systems as defined by the EU AI Act and doesn't use any AI practices prohibited by the AI Act.

Regardless, the AI Act sets transparency requirements for certain AI systems. That's why we make AI use within awork visible to you and inform you about how it works, its limitations, and responsible use.

We continuously review how our AI features are classified under the AI Act as part of our product and compliance processes.

Governance and responsibilities

AI use at awork is integrated into our existing governance, data protection, and information security processes.

This includes specifically:

• internal policies and review processes for implementing and developing AI,

• clearly defined responsibilities for product, data protection, and information security,

• privacy and security reviews of new AI providers and technical components,

• and continuous review of regulatory requirements, especially from GDPR and the EU AI Act.

Responsible AI use

Generative AI can produce incorrect or incomplete results.

That's why:

• You should review AI-generated results.

• Don't use unreviewed AI as the basis for decisions that are sensitive or legally significant.

• You and your organization remain responsible for how you use the result.