Manus AI

Data-handling profile

Trains on input

Unknown / not publicly stated

Retention

unknown

Data region

unknown

Certifications

none listed

DPA available

No

Breach history

none

EU AI Act

As a general-purpose agentic AI capable of executing code and web automation, Manus AI likely falls under the General Purpose AI (GPAI) classification of the EU AI Act. Depending on its training compute thresholds and deployment contexts, it may be subject to strict transparency, risk assessment, and technical documentation standards.

Sources

• https://manus.im/privacy
• https://manus.im/terms

Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes.

Control mapping

Obligations this vendor triggers, each attributable to the fact it rests on — for your supplier register, not a compliance determination.

• EU AI Act Art. 50 — Transparency obligations for AI systemsunknown

  Vendor does not publicly state whether it trains on inputs. Unresolved: treat as a question for the vendor, not as a pass.

• EU AI Act Art. 26 — Obligations of deployers of high-risk AI systemsapplies

  Applies to your organisation as deployer, independent of vendor. Assign human oversight, keep logs, and monitor operation where this tool is used in a high-risk context (Annex III duties apply from 2 Dec 2027).

• ISO/IEC 27001 A.5.19 — Information security in supplier relationshipsapplies

  Manus AI processes organisational data as a supplier. Include this vendor in the supplier register and risk assessment.

• ISO/IEC 27001 A.5.20 — Addressing information security within supplier agreementsgap

  dpa_available = false. No DPA identified — security and processing terms are not contractually established.

• ISO/IEC 27001 A.5.23 — Information security for use of cloud servicesapplies

  Cloud AI service; trains_on_input = unknown. Define acceptable-use and configuration rules for this cloud service.

• ISO/IEC 42001 A.10.3 — Suppliers of AI systems and servicesapplies

  No certifications listed. No AI-management certification identified; assurance must come from your own supplier assessment.

• GDPR Art. 44–49 — International transfers of personal dataunknown

  Vendor does not publicly state its processing region. Residency unresolved — required before transferring personal data.

• NIS2 Art. 21(2)(d) — Supply chain securityapplies

  AI vendor forms part of your ICT supply chain. In scope for entities covered by NIS2; include in supply-chain risk measures.

• DORA Art. 28 — General principles for ICT third-party riskapplies

  AI vendor is an ICT third-party service provider. For financial entities: register of information and contractual requirements apply.

Change history

No material changes recorded since monitoring began.