Is AI in grant management software safe under GDPR?

It depends on what data the AI processes, where, and what controls you have. For Flexigrant’s AI Due Diligence Checker, the AI step runs on Azure OpenAI in the EU, uses only the organisation name and numbers you type, is not used for training, and can be restricted by role or switched off. Your own assessment makes the final call.

Does Flexigrant send our grant data to the AI?

No. The only data used from Flexigrant is the organisation name and registration numbers your user types into the checker. Application forms, applicant contact details, grant records and documents are not sent.

Where is the AI processing carried out?

The AI step is processed in the EU, on Azure OpenAI. Flexigrant does not claim UK processing for the AI step. Your Flexigrant data itself is not sent to the AI step at all.

Is our data used to train the AI model?

No. Data sent to Azure OpenAI by the checker is not used to train the models. Microsoft’s abuse monitoring may store a sample of a flagged request for review; for the checker, that would be an organisation name and its registration numbers.

What is Microsoft abuse monitoring?

It is a check Microsoft runs on Azure OpenAI to detect misuse of the service. If a request is flagged, Microsoft may store a sample of it for review. The checker sends only organisation names and registration numbers, so that is what any stored sample would contain.

Can we restrict who uses the AI Due Diligence Checker?

Yes. By default it is available to users of the Manage Grants menu. A dedicated role limits it to the users you choose. Ask Flexigrant support to enable the role through a support ticket, then assign it to your due diligence team.

Can we switch the AI Due Diligence Checker off?

Yes. A tenant setting switches the checker off for every user in your organisation, and nothing is sent to Azure OpenAI while it is off. Request it through a support ticket, and request it back on the same way.

Is the risk score in Flexigrant’s AI Due Diligence Checker produced by AI?

No. A fixed formula calculates the score from public register data, and the same inputs always give the same result. Azure OpenAI writes only the plain-English summary and analysis notes, which are labelled as AI-generated and should be checked against the source records.

What does a grant applicant risk score of 45% mean?

A score of 45% falls in the Medium band, which runs from 31 to 60%. It means the register data raised some concerns but not many. Read the factor breakdown and any red flags to see where the points came from, then apply your funding policy.

Why is the score out of 80 and not 100?

Because one of the five factors had no data in the registers, so the checker excluded it rather than guessing. Each factor with data is scored, and the percentage shows points scored against points available. The screen tells you which factors were assessed.

Does a High score mean we should refuse the grant?

No. A High score, 61 to 100%, means the register data raised several concerns. Your funding policy decides what follows, such as a second review or a request for more information. The checker is advisory and does not make funding decisions.

What is a red flag in the AI Due Diligence Checker?

A red flag is a specific finding in the register data that the checker highlights separately from the overall score, with a link to the register that raised it. It shows you where to look and what to ask the applicant about.

Can we see how the score was calculated?

Yes. The checker shows the score, the breakdown by factor, which factors were assessed, and any red flags. Each register field is labelled by its source and linked to the original record, so you can follow every point back to the data.

Does the risk score replace our due diligence policy?

No. The score is advisory. It gives every applicant the same documented starting point from public register data. Your policy decides what each band and each red flag requires, and your team records the decision.