Compliance: ENS, AI Act and GDPR
In the public sector, compliance isn't fine print: it is the product. This page is the one the town secretary can attach to the procurement file.
Spanish National Security Scheme (ENS)
- Service designed for the ENS basic-level conformity declaration
- Hosted entirely in the European Union
- Audit logging, backups and staff access control with 2FA
EU AI Act
- The transparency obligation in Article 50 of Regulation (EU) 2024/1689 has applied since 2 August 2026: any system interacting with people must identify itself as automated. EnaChat does it out of the box
- Visible “automated assistant” disclosure in the widget from the first message — transparency obligation met
- AI indicator on every generated answer
- No profiling, no automated decisions about people: information with sources, nothing else
GDPR
- The council is the data controller; Enantena is the processor, with a standard DPA included
- Conversations kept 90 days by default (configurable) and purged automatically; IP addresses never stored raw
- AI models on EU endpoints; no citizen data leaves the European Union
- Data-rights requests (access, erasure) recognized and routed to the town's DPO
Where the data lives
- Database and application: our own EU infrastructure
- Observability traces: metadata only (latencies, token counts) — never citizen text
- Indexed content: the town's official public documents, nothing else
Zero cookies on the citizen's side
Neither the widget nor this website sets cookies or tracking identifiers on a citizen's device: only the storage strictly necessary to keep the conversation open. So the page where you install it needs no consent banner, and you have nothing new to defend before the data-protection authority.
Accessibility
The widget meets WCAG 2.1 AA (EN 301 549): keyboard navigable, screen-reader friendly, and with the citizen office's phone and hours always visible — the digital channel adds to in-person service, it never replaces it.
What we hand over for the procurement file
- ENS basic-level compliance sheet and service description
- Data-processing agreement (DPA) ready to sign
- Widget accessibility statement under RD 1112/2018
- Description of the AI transparency measures for the contract report