Compliance: ENS, EU AI Act and GDPR

Spanish National Security Scheme (ENS)

• Service designed for the ENS basic-level conformity declaration
• Application and database on a server in the European Union (Frankfurt)
• Daily database backup
• Console access with personal accounts, and each account only sees its own town

EU AI Act

• The transparency obligation in Article 50 of Regulation (EU) 2024/1689 applies from 2 August 2026: a system that talks to people must identify itself as automated. EnaChat does it out of the box
• "Automated assistant (AI)" notice in the chat header from the first message
• An "AI" mark on every generated answer
• No profiling and no automated decisions about people: information with sources, nothing else

GDPR

• The council is the data controller and Enantena the processor, under a data-processing agreement
• Conversations kept for 90 days and deleted automatically
• We don't store IP addresses: they are only used in memory to limit abuse
• The chat asks people not to enter personal data (ID number, address, health…)

Where the data is processed

• Application and database: a server in the European Union (Frankfurt)
• Writing the answers: Google's Gemini models, which receive the question and the source passages needed. The move to EU-located endpoints (Vertex AI) is planned
• Observability traces: metadata only (response times, counters), never citizens' text
• Indexed content: the town's official public documents, nothing else

Zero cookies on the citizen's side

Neither the chat nor this website sets cookies or tracking identifiers. The chat only keeps the conversation id in the browser, so the conversation can continue. The page where you install it needs no consent banner.

Accessibility

The chat is designed to meet WCAG 2.1 AA (EN 301 549): it works with a keyboard, has regions for screen readers and computes the contrast of each town's colours. The office's phone and hours are always visible: the digital channel adds to in-person service, it never replaces it.

What we prepare for the procurement file

• Service description and ENS basic-level measures
• Data-processing agreement
• Accessibility statement for the chat
• Description of the AI transparency measures for the contract report