Responsible AI

Responsible AI: Our principles and safeguards

Scrive is a leading European provider of digital trust solutions, including electronic signatures (e-signing), contract lifecycle management (CLM), and electronic identification (eID). As artificial intelligence continues to transform digital workflows and document management, Scrive recognises the immense opportunity to enhance productivity, speed up agreement processing, and unlock business insights.
However, we also acknowledge the inherent compliance, privacy, and security risks associated with AI usage. This white-paper outlines Scrive’s foundational philosophy, technical architecture, legal positioning, and operational controls to ensure that AI capabilities integrated into our products remain ethical, transparent, and compliant.

Core Principles of Scrive AI

Transparency
Every AI-enabled feature within Scrive’s user interface is explicitly labeled with visual indicators. Users are always made aware when text, metadata, or document insights have been generated or suggested by AI systems.

Optionality
AI features are strictly optional and designed to assist users in finding, summarising, and categorising contract content faster. Core operations such as identity verification, e-signing, and audit trail generation function without requiring these AI features to be active.

Compliance with the EU AI Act & Human-in-the-Loop Principle
Under the EU AI Act framework, Scrive acts as the provider of AI capabilities, whereas our customers act as the deployers. Our AI functionality is not intended for high-risk applications. A central pillar of our AI compliance architecture is also the Human-in-the-Loop (HITL) principle. Data generated or extracted by AI remains clearly designated as unverified suggestions until a human user reviews and confirms the input via our intuitive review tools.

Governance, Data Protection & Security Protocols

Strict Governance and Approval Workflows
Before any AI capability or supplier is introduced at Scrive, it undergoes rigorous vetting by our Compliance, Security, and Legal (CSL) team. Furthermore, per Scrive’s internal AI Usage Policy, every new AI feature requires explicit, prior written approval from both Scrive’s Chief Legal Officer (CLO) and Chief Information Security Officer (CISO).

No Data Training
Our customers’ agreement contents and personal data processed through AI features are not used to train AI models.

Contractual Framework
AI functionality is enabled strictly for customers who have executed an AI-compliant agreement with Scrive. This legal framework includes explicit Data Processing Agreement (DPA) instructions, a transparent sub-processor list, and explicit terms detailing our role as an AI provider and our customers’ role as AI deployers.

Data Sovereignty

EU Data Processing and Infrastructure
Scrive leverages Microsoft’s data centres situated within the European Union to power its cloud AI capabilities. All processing is strictly bound by Microsoft’s EU Data Boundary commitments, ensuring data resides and is processed within the EU/EEA.

Model Context Protocol (MCP) Integration
To accommodate organisations with dedicated AI infrastructures, Scrive supports Model Context Protocol (MCP) integrations (available remotely or for self-hosting). This open approach allows customers to securely connect their own preferred LLMs and custom AI tooling directly to Scrive’s trusted signing infrastructure.

Trust Services as the Core Foundation

Scrive operates as a regulated Trust Service Provider under the EU eIDAS Regulation (Regulation (EU) No 910/2014). Notably, Scrive AS is a Qualified Trust Service Provider (QTSP). Operating in this highly regulated domain imposes strict legal obligations and high societal expectations regarding how we handle sensitive digital assets and identities.

Trust is the bedrock of our business. To safeguard the integrity and evidentiary value of our core services, Scrive maintains a strict operational boundary between regulated trust services and AI-driven capabilities:

• Separation of Layers: AI functionality is delivered strictly as an optional layer on top of our core trust platform, not as part of the trust services, ensuring that e-signatures and eIDs retain full legal validity independently of AI processes.
• No Automated Legal Decisions: We do not permit AI systems to make automated legal decisions or execute transactions without explicit human intervention.