Does the privacy notice reflect what's technically actually running?
Data protection officers document AI-related processing in the privacy notice, in the record of processing activities under Art. 30, and in the DPIA — but the technical reality on the domain often diverges from the documented statement. CERTavia checks exactly this gap: whether AI governance declarations are technically actually live and consistent.
Paper is not infrastructure
The privacy notice describes how AI crawlers, training data opt-out, and automated decisions are handled. Whether that description matches the actual technical configuration — robots.txt directives, AI policy URL, deepfake disclaimer, contact point for AI inquiries — is hard to verify without a technical check. This gap is a risk both for GDPR documentation obligations and for the overlap with Art. 50 of the EU AI Act.
CERTavia checks the technical infrastructure layer independently of the documentation and delivers a deterministic, cryptographically signed comparison: is what's stated in the privacy notice technically actually implemented?
AI Governance Hard Gate in detail
For data protection officers, this cluster is the immediately relevant check area.
ai.txt and AI policy URL
Checks whether a machine-readable AI policy is actually reachable at the expected address and whether its content is consistent with the AI use described in the privacy notice.
Privacy AI section
Checks whether the privacy notice contains an AI-specific section and whether it matches the technical robots.txt and crawler configuration.
AI training opt-out status
Checks whether declared opt-out signals for AI training data are technically consistently implemented via robots.txt, meta tags, and HTTP headers — not merely claimed in a document.
Deepfake disclaimer and contact point
Checks the presence and technical reachability of a deepfake disclaimer and a dedicated contact point for data subjects' AI-related inquiries.
Note on the parameter base: This cluster is the layer at which the regulatory requirements from Art. 50 of the EU AI Act become technically verifiable — complementing the GDPR documentation obligations data protection officers already maintain.
A technical proof for the documentation
For the record of processing activities under Art. 30 GDPR and for data protection impact assessments (DPIA) of AI-supported processing, a technical proof showing that the declared safeguards are actually active is helpful. The CERTavia report delivers this proof as a cryptographically signed, timestamped document — not a substitute for the legal DPIA assessment, but a technical building block within it.
The overlap between GDPR requirements and the EU AI Act particularly concerns automated decision-making and the transparency obligations under Art. 50. More on the EU AI Act overview page.
A shared finding instead of separate perceptions
The CERTavia report gives data protection officers and IT leaders the same deterministic finding — a shared basis for identifying and closing discrepancies between documented and actual configuration, instead of managing them in separate review processes.
Can I use CERTavia as a data processor?
Yes. The first question any data protection officer asks when adopting a new tool is: what about the provider's own data protection compliance? Here are the answers:
DPA available
A data processing agreement under Art. 28 GDPR with a full sub-processor list (Hetzner, Cloudflare, Stripe, Resend) and TOMs is available and is deemed agreed upon contract conclusion. Countersigned within 2 business days on request.
Get the DPA →Scan = public data
CERTavia scans exclusively publicly accessible technical infrastructure parameters (DNS, HTTP headers, public web content). Page content, your visitors' user data, and internal system data are not collected.
§ 19 Privacy notice →Hosting in the EU
The scan API and database run at Hetzner in Germany. The website runs on Cloudflare Pages (EU-US DPF). Payments via Stripe (EU-US DPF). Email via Resend (SCCs). All sub-processor details in the DPA.
Sub-processor list →Pricing for data protection officers
PDF audit report, cryptographic signature, Sovereign Vault available for 90 days (local archiving required afterward). Suitable for the initial comparison check between privacy notice and technical reality.
Sovereign Vault with no automatic expiration date, machine-readable verification URL, JSON output. Suitable as technical proof for Art. 30 documentation and DPIA.
The report is delivered directly by email; customer portal access is available on request (automatically included with Annual and Enterprise plans).
Further reading
Technical requirements, timeline, and infrastructure implications.
For compliance managers and GRC teams →The Art. 50 evidence for the conformity assessment dossier.
How CERTavia works →The deterministic validation process and the check procedure explained.
Evidence and benchmark →Verified scan results from practice — cryptographically signed and verifiable via the Sovereign Vault.
Whitepaper: EU AI Act infrastructure compliance →Infrastructure requirements from Art. 50, GDPR interfaces, and technical evidence for data protection officers.
Art. 50 – Transparency obligations from August 2026 →Labeling obligations for AI-generated content, chatbots, and deepfakes — directly relevant for GDPR-compliant AI adoption.
Managing multiple clients?
As an external DPO, you typically scan not one domain but a portfolio. CERTavia is suitable for use across multiple clients: you receive an independent, cryptographically signed result per scan — directly forwardable to the respective contact at the company.
For portfolio-based use and volume terms: request via the contact form, noting the number of clients.
Comparison in 90 seconds
The quick scan delivers your domain's Layer 0 result in 90 to 120 seconds. Free, with immediately available JSON output in the Full Scan.
CERTavia analyzes technical infrastructure signals. The result is a machine-readable finding, not a legal opinion and not a certification within the meaning of the EU AI Act conformity assessment under Article 43. For legally binding compliance and data protection assessments, consult qualified legal and data protection advisors.