Compliance

How Kody helps you meet EU AI Act and GDPR requirements for AI chatbots.

AI Act Article 50 (Transparency)

Under the EU AI Act, chatbots are classified as "limited risk" AI systems. Article 50 requires that users are clearly informed when they are interacting with an AI system. The disclosure must be clear and distinguishable and presented at the point of first interaction — before the user engages in conversation.

This obligation applies regardless of how the AI system is distributed. Open-source deployments are not exempt from Article 50 — if you deploy a chatbot that interacts with EU users, you must provide the disclosure. The transparency requirements under Article 50 take effect on August 2, 2026.

Kody's Built-In Compliance

Kody includes built-in AI disclosure support through two configuration fields:

compliance.aiDisclosureEnabled — when set to true (the default), the widget displays a disclosure notice informing users they are communicating with an AI assistant. The notice is shown at the start of every new conversation, before the user sends their first message.
compliance.aiDisclosureMessage — customize the disclosure text to match your brand voice and language requirements. The default message clearly states that the user is interacting with an AI assistant, not a human.

Tip: Even if your users are outside the EU, AI transparency is considered a best practice and builds trust. We recommend keeping aiDisclosureEnabled turned on.

GDPR Data Minimization

Kody is designed with data minimization at its core, following the GDPR principle of collecting only the minimum data necessary for the service to function:

In-memory conversations — conversation history is stored in server memory with a 30-minute TTL (time to live). After 30 minutes of inactivity, the conversation is automatically purged. There is no permanent server-side storage of chat messages.
No persistent storage — Kody does not write conversation data to disk, databases, or external services. When the server restarts, all conversations are gone.
IP addresses — IP addresses are used only for rate limiting and are held in memory for the duration of the rate limit window. They are not persisted to disk or logged.
Client-side localStorage — the widget uses the browser's localStorage to remember the session ID so returning users can resume their conversation within the TTL window. This data is stored entirely on the user's device and is never sent to third parties.

Right to Erasure

GDPR Article 17 gives users the right to request deletion of their personal data. Kody provides two mechanisms for this:

Delete Conversation Button

When compliance.conversationDeletionEnabled is set to true (the default), the widget displays a delete button that allows users to erase their conversation at any time. This immediately removes the session from server memory and clears the local session reference from the browser.

API Endpoint

The DELETE /api/sessions/:sessionId endpoint allows programmatic deletion of a specific conversation session. This can be integrated into your existing data subject access request (DSAR) workflows to handle erasure requests at scale.

Data Processing Agreements

When you use Kody with a US-based LLM provider (such as OpenAI or Anthropic), user messages are sent to that provider's API for processing. Under GDPR, this constitutes a data transfer to a third country and requires:

A Data Processing Agreement (DPA) with the LLM provider, establishing them as a data processor
A valid transfer mechanism — either Standard Contractual Clauses (SCCs) or certification under the EU-US Data Privacy Framework (DPF)

Most major LLM providers offer DPAs and are certified under the EU-US DPF. Check your provider's trust or legal page for details.

Maximum compliance: For the strongest data sovereignty posture, use an EU-hosted LLM backend. Kody works with any OpenAI-compatible API, so you can point it at self-hosted solutions like Ollama or vLLM running on EU infrastructure. This eliminates international data transfers entirely.

For Self-Hosters

If you self-host Kody, you are the data controller under GDPR. This means you are responsible for:

Your own DPAs — you must establish Data Processing Agreements directly with your chosen LLM provider and any other sub-processors
Data Protection Impact Assessment (DPIA) — depending on your use case and the sensitivity of the data your chatbot handles, you may need to conduct a DPIA under GDPR Article 35. This is especially relevant if the chatbot processes data from vulnerable groups or handles sensitive categories of data.
Privacy notices — your website's privacy policy should describe the chatbot, the data it processes, your legal basis, and any third-party providers involved
Record of processing activities — the chatbot should be included in your ROPA under GDPR Article 30

Note: Kody's architecture — in-memory conversations with automatic TTL expiration and no persistent logging — significantly simplifies your DPIA. There is minimal personal data at rest to account for.

Configuration Reference

The following configuration fields control Kody's compliance features. All fields have sensible defaults that favor compliance out of the box:

{
  "compliance": {
    "aiDisclosureEnabled": true,
    "aiDisclosureMessage": "You are chatting with an AI assistant, not a human.",
    "conversationDeletionEnabled": true
  }
}

Field	Default	Description
`aiDisclosureEnabled`	`true`	Show an AI disclosure notice at the start of each conversation. Required by EU AI Act Article 50 for chatbots targeting EU users.
`aiDisclosureMessage`	`"You are chatting with an AI assistant, not a human."`	Custom text for the AI disclosure notice. Supports plain text.
`conversationDeletionEnabled`	`true`	Show a delete button allowing users to erase their conversation. Supports GDPR right to erasure (Article 17).