Product News: Policy and Disclosure Updates for AI, Automated Decisions, and TCF v2.4

This release updates Concord's policy templates and disclosures for AI and automated decision-making, adds the IAB TCF v2.4 disclosures to the consent banner, makes Terms of Service and Impressum available on every plan, and lets you bring existing policies up to date without losing your own edits.

Automated Decision-Making Disclosures in Your Privacy Policy

The Privacy Policy template has a new optional section on AI and automated decision-making (ADMT), which some US states (California and Colorado, for example) and the EU require. Turn it on and choose the practices that apply to you:

AI chatbots or assistants that interact with people
Automated decision-making or profiling that may significantly affect people
Using personal information to train or improve AI
Sharing personal information with third-party AI providers
Publishing AI-generated or synthetic content

The section also tells people their rights when AI makes a decision with legal or similarly significant effects: to be told, to have a person review the decision and appeal it, to get an explanation of how automated decision-making affects them, to correct the information used, and to opt out where the law requires. People verify their identity before getting information about automated decisions, but never to opt out.

The 2026 AI Policy

The AI Policy template is updated for 2026. Questions about how you use AI to make decisions about people, whether you train or fine-tune your own models, and whether you offer AI systems or AI-generated content to people in the EU tailor the policy, which now covers:

Generative AI and approved tools
Automated decision-making
Data, training, and model provenance, including AI vendor due diligence
Transparency and disclosure
Training and competence
AI incidents
How the policy is reviewed

The policy references ISO/IEC 42001 and the NIST AI Risk Management Framework. If you offer AI to people in the EU, it adds the EU AI Act's Article 50 transparency obligations: disclosing when people interact with AI, marking AI-generated content, and disclosing deepfakes and AI-generated text on matters of public interest.

More Privacy Policy Updates

The Privacy Policy template also covers:

Texas notices. If you sell sensitive or biometric personal data, the policy includes the notices Texas law prescribes, word for word.
The Data Privacy Framework. If you're certified under the EU-U.S. Data Privacy Framework (and its UK Extension) or the Swiss-U.S. Data Privacy Framework, the policy includes the disclosures that go with it, including your independent dispute resolution body.

If you use IAB TCF, your consent banner shows the disclosures added in TCF v2.4, ahead of IAB Europe's October 23, 2026 deadline for websites: the standard explanation of each vendor Feature from the Global Vendor List, the Special Purposes notice, and the multi-device consent statement, in every banner language. There's nothing to set up.

Terms of Service and Impressum on Every Plan

The Terms of Service and Impressum templates are available in the Policy Builder on every plan.

Terms of Service. Write it for consumers or for business customers. The consumer version includes the clearly labeled online withdrawal function EU law has required since June 19, 2026, along with subscriptions and renewals, refunds, and user content. The business version covers subscription terms, payment, liability, data protection and security commitments, and optional sections like an SLA and support.
Impressum. The provider identification German law requires on commercial websites and apps (§ 5 DDG), in German by default or in English.

Data Processing Agreement on Premium and Enterprise

The Data Processing Agreement template covers the terms for processing personal data on behalf of your customers, as GDPR Article 28 and US state privacy laws require. It incorporates the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and Swiss adjustments, with optional US state service provider terms. It's included on Concord Privacy Premium and Enterprise and on paid Concord Trust plans.

Policy Updates That Keep Your Edits

When a Concord template gets a new version, policies built from it show Template update available. Choose Review Update, answer any new questions (your saved answers are already filled in), and compare your current policy and the updated one side by side before you choose Regenerate Policy.

Your edits carry over. Text you added or changed in your policy is kept in the updated version. If you and the update changed the same paragraph, the update's wording is used and the review shows how many of your edits overlapped.
Nothing is lost. Your previous version stays in History, and you can go back to it at any time.

Policies Linked to the Controls They Cover

For teams running controls in Concord Trust, a policy's Controls tab shows the controls it serves as evidence for and the frameworks they support. New policies are mapped automatically, and you can add mappings yourself or reset to Concord's recommendations.

Get Started

Create a new policy from Documents > Policies > Add Policy > Create with Policy Builder, and open existing policies to choose Review Update where it appears. The Privacy Policy, Terms of Service, and Impressum are available on every plan. The AI Policy and the Data Processing Agreement are included on Concord Privacy Premium and Enterprise and on paid Concord Trust plans. Book a demo and we'll walk you through it.