Legal
Meet us at Web Summit · Lisbon, 9–12 November.
Learn moreLegal
What our free AI audit reads, how it reaches its estimates, and what it can't tell you.
Effective Version 1.1
This page explains how our free AI audit at colchix.com/ai-audit works: what it reads, how it reaches its figures, and what it can and can't tell you. What happens to personal data is in our Privacy Policy.
The AI audit is a free tool from Colchix B.V. that gives an organization a quick, rough picture of its AI use: how many people likely use AI, on which accounts, what it may cost, what its public records show, which laws and standards commonly apply to its sector, and where to start. It is meant for people who work for or with the organization they audit.
The report is an estimate, not a measurement. It is not legal advice, not a compliance assessment, and not a security test.
If you type in a website, our server reads only what that organization publishes to anyone:
It only reads. It names itself as "ColchixAudit" in every request, never signs in, never tries a password, never probes for weaknesses and never sends anything to the organization's systems beyond an ordinary page request. It reads no one's private data, and it can't see what any person does with AI.
What the records showed is then carried in your report's link, signed by our server so it can't be changed: the report, the email that delivers it and the picture in that email all show the records as they were when you ran the audit. Only the organization's icon is read again when they're opened.
Everything else comes from your answers (the organization's size, the AI tools you know of, how you'd find out about a leak, its sector if the records don't say, and whether its people are trained on AI) combined with published research:
So the figures describe an organization of that size and kind, not this one in particular. The live count of prompts is an illustration of a working day at that pace; it is not traffic we observed. The tools "likely in use" are the ones common at work, not tools we detected. The score sums up the checks in the report; it is not a rating of the organization.
The frameworks named for a sector are the laws and standards that commonly reach organizations in it when their people use AI, such as the EU AI Act, the GDPR, NIS2 and DORA. Whether and how each one applies depends on facts the audit doesn't know. Ask a lawyer before relying on it.
Only a measurement shows the real numbers: that's what our product does, with the organization's agreement.
The report's link carries your answers, the website and what its public records showed (with the organization's name as its website gives it), but no name, email or other words of yours, so anyone you share it with sees the same report. Organizations' names and icons are shown only to identify them; they belong to their owners, and showing them doesn't mean they endorse Colchix or the report.
We count, without any website or name, how many audits run by sector, size and the AI vendors found, to understand the market.
The audit is free and provided as is. We try to keep its sources current, but we don't promise that the figures, the findings or the frameworks are complete, accurate or right for your organization, and we may change or stop the audit at any time. Decisions you make with it are yours.
As far as the law allows, Colchix is not liable for any loss arising from the use of the audit or reliance on its report. Nothing here limits liability that the law doesn't allow us to limit, such as for intent or gross negligence.
Write to hello@colchix.com about the audit, or to privacy@colchix.com about your personal data. If you think the audit read something it shouldn't have, write to security@colchix.com.
