Zendesk AI

Data-handling profile

Trains on input

Yes, on the consumer tier (enterprise tier excluded)

Retention

Zendesk builds account-specific models trained only on that account's data, plus generic cross-account models trained on aggregated/sanitized (PII-scrubbed) service data; third parties do not use customer inputs to train their own models; sanitization/anonymization applied before any cross-account use, with Advanced Data Privacy add-on offering BYOK and stricter retention controls.

Data region

Global

Certifications

SOC 2 Type IIISO 27001ISO 27017ISO 27018ISO 27701ISO 42001FedRAMP LI-SaaS

DPA available

Yes

Breach history

none known

EU AI Act

Embedded customer-service AI; ISO 42001 AI management certification directly supports EU AI Act governance-documentation expectations.

Sources

• https://support.zendesk.com/hc/en-us/articles/5729714731290-Zendesk-AI-Data-Use-Information
• https://www.zendesk.com/trust-center/
• https://support.zendesk.com/hc/en-us/articles/4408828745626-Zendesk-s-Commitment-to-International-Standards-for-Information-Security-Privacy-and-AI-Governance-ISO-27001-ISO-27018-ISO-27701-and-ISO-42001

Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes.

Control mapping

Obligations this vendor triggers, each attributable to the fact it rests on — for your supplier register, not a compliance determination.

• EU AI Act Art. 50 — Transparency obligations for AI systemsattention

  trains_on_input = consumer_tier. Inputs may be reused for model training — users interacting with this system need to be informed accordingly.

• EU AI Act Art. 26 — Obligations of deployers of high-risk AI systemsapplies

  Applies to your organisation as deployer, independent of vendor. Assign human oversight, keep logs, and monitor operation where this tool is used in a high-risk context (Annex III duties apply from 2 Dec 2027).

• ISO/IEC 27001 A.5.19 — Information security in supplier relationshipsapplies

  Zendesk AI processes organisational data as a supplier. Include this vendor in the supplier register and risk assessment.

• ISO/IEC 27001 A.5.20 — Addressing information security within supplier agreementsok

  dpa_available = true. A data processing agreement is available and should be executed.

• ISO/IEC 27001 A.5.23 — Information security for use of cloud servicesattention

  Cloud AI service; trains_on_input = consumer_tier. Data submitted to this cloud service may be retained or reused — define acceptable-use rules for it.

• ISO/IEC 42001 A.10.3 — Suppliers of AI systems and servicesok

  certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, FedRAMP LI-SaaS Vendor holds an AI management system certification — usable as supplier assurance evidence.

• GDPR Art. 44–49 — International transfers of personal dataattention

  data_region = Global. Processing occurs outside the EU/EEA — a transfer mechanism (SCCs or adequacy) must be in place.

• NIS2 Art. 21(2)(d) — Supply chain securityapplies

  AI vendor forms part of your ICT supply chain. In scope for entities covered by NIS2; include in supply-chain risk measures.

• DORA Art. 28 — General principles for ICT third-party riskapplies

  AI vendor is an ICT third-party service provider. For financial entities: register of information and contractual requirements apply.

Change history

No material changes recorded since monitoring began.