A subject access request for AI. Can your company answer it?
A claims adjuster pastes a claimant medical report into ChatGPT on a personal login. Six weeks later a regulator asks which automated system processed that data, on what date and at whose instruction. This follows the incident end to end: where the capture sits, why the hash chain is the property an auditor actually tests, and how one capture answers two different regulators.
Article 12Subject accessTamper evidenceShadow AI
See the obligation mapping