Know what an AI system can access, do and change.
Every implementation needs rules for data, permissions, approvals and operational responsibility. We define these with the client before a solution goes live. The controls depend on the process, its risks and the connected services.
Access limited to the work required
Role-based access
Define permissions by function and responsibility, not informal arrangements between individuals.
Least privilege
Grant only the access needed for a task.
Service identities
Where supported, automation uses dedicated identities rather than an employee’s personal account.
Credential management
Store secrets securely, not in application code.
Access lifecycle
Agree how permissions are issued, reviewed and removed.
Human approval where it matters
We distinguish between reading information, preparing a recommendation, taking an approved action and completing a step that requires a person’s decision. Financial impact, sensitive information, external communication and uncertain results may require additional controls.
- financial impact
- sensitive information
- external communication
- uncertain results
A record of important actions
We agree what should be logged, who may review the logs and how long records are retained. Relevant records may include the input, action, outcome, approval, error and software version, subject to data protection and technical constraints.
- input
- action
- outcome
- approval
- error
- software version
Support and handover are part of the design
Before launch, we agree who monitors the solution, how issues are escalated, what recovery procedures exist and what documentation the client receives. Contracts define support scope, software and data rights, and exit arrangements.
Where your data is processed depends on the services used
We document relevant hosting, storage, model services, processors and international data transfers for the proposed solution. A custom application running on your own infrastructure does not necessarily mean every connected AI service processes data there.
- Typical environment
- Microsoft 365 and existing business applications.
- Possible model providers
- Microsoft, Anthropic and OpenAI, selected according to use case and contractual requirements.
- Deployment options
- Subject to technical feasibility and the specific service, components may run in the client’s environment, private cloud or a managed service.
EU AI Act: assess the actual use case
Legal requirements depend on what the AI system does, who provides or deploys it and whether it falls into a regulated category. We support the technical and organizational assessment; legal classification and compliance obligations must be confirmed for the specific use case.
EU timeline summary, checked 15 October 2026. Source: European Commission — AI Act. Information only; not legal advice.
Partnerships and certification
- Microsoft Solutions Partner.
- TD SYNNEX Destination AI.Partner programme approved by TD SYNNEX.
- GDPR.We explain our website’s data processing in the Privacy Policy. Actual project compliance depends on the agreed solution and contractual arrangements.
- ISO 27001.ENTER does not currently claim to hold an issued ISO 27001 certificate.
Security or incident inquiry
Email milo@enterai.cz. Client-specific incident contacts, support windows and escalation arrangements are defined in the relevant agreement.
Discuss security requirements
Tell us about the process and the systems involved. In a 30-minute call, we will discuss the access, approvals and data processing it would require.