ARTIFICIAL INTELLIGENCE FEATURES ADDENDUM

Last Updated: July 6, 2026

This Artificial Intelligence Features Addendum (this “Addendum“) is effective as of the date Customer (as defined herein) initially enables or uses any AI Features provided to it by Provider or Provider’s Affiliates in connection with Customer’s subscription for one or more Offerings under an Order Form. This Addendum governs the rights and obligations with respect to Customer’s use of the AI Features and, in connection therewith, supplements and forms part of the Order Form, the Master Services Agreement, and all applicable exhibits and attachments thereto or incorporated by reference therein (collectively, the “Agreement“).

IF CUSTOMER DOES NOT AGREE WITH THE TERMS OF THIS ADDENDUM, CUSTOMER SHOULD NOT USE OR OTHERWISE ENABLE ANY AI FEATURE WITHIN THE OFFERINGS.

1. Definitions

Capitalized terms used in this Addendum will have the meanings set forth below. Any capitalized terms used in this Addendum, but not defined herein, will have the meanings given in the Agreement (including the Data Processing Agreement).

1. “AI Features” means any specification, service or functionality within the Offerings that use machine learning, large language models, or AI-based reasoning to detect patterns, generate insights, automate workflows, or support decisioning, including but not limited to GeoSentry and any virtual data analysts or chat bots included therein, and the GeoComply MCP and any agentic connectors thereto.
2. “Biometric Data” means data relating to the physical, physiological, or behavioral characteristics of a natural person (including facial images, voiceprints, or other biometric identifiers) that constitutes “biometric data,” “biometric information,” or a similar term under Applicable Data Protection Laws.
3. “Content” means collectively, Input and Output.
4. “EU AI Act” means the European Union’s Artificial Intelligence Act – Regulation (EU) 2024/1689, as may be amended, superseded, or replaced from time to time, together with any implementing or delegated regulations issued thereunder.
5. “GDPR” means the EU General Data Protection Regulation ((EU) 2016/679), as amended.
6. “Input” means any data, content, or information that Customer or its Authorized Users submit to an AI Feature.
7. “Output” means any result generated by an AI Feature in response to Input.

2. Provision of AI Features

Provider may, from time to time, make available to Customer and its Authorized Users certain AI Features in connection with the Offerings. AI Features are optional and are provided to Customer at Provider’s sole and absolute discretion. Provider may modify any AI Features at any time or deny, suspend, or terminate Customer’s access to or use of any AI Features either: (i) upon thirty days written notice to Customer; or (ii) immediately upon a material breach of this Addendum or the Agreement; or (iii) immediately if Provider reasonably determines that doing so is necessary to comply with Applicable Law (including the EU AI Act), to mitigate legal, regulatory, or reputational risk, or to prevent harm to Provider, other customers, or third parties. Customer’s access to and use of the AI Features will automatically terminate upon the expiry or termination of the Agreement.

3. Customer Responsibilities

In connection with its use of any AI Features, Customer represents, warrants, acknowledges and agrees that (i) it will not and will cause its Authorized Users to not use the AI Features and Content in violation of the Agreement, this Addendum or the rights of any third party; (ii) it is solely responsible for the development, operation, maintenance, and use of the Content; (iii) it will defend, indemnify and hold harmless Provider from all third party claims arising from its use of the AI Features in violation of the Agreement or this Addendum; (iv) it hereby instructs Provider to process the Content in accordance with this Addendum; (v) it has obtained all applicable rights, authorizations, permissions and consents necessary to submit any Inputs to the AI Features or otherwise connect its systems, services, or content to any AI Features; and (vi) it is solely responsible for the configuration, actions, and output of any AI agent, model, or other automated or autonomous system that Customer or its Authorized Users connect to, orchestrate through, or otherwise use in conjunction with any AI Feature (including via machine-to-machine or agentic access), and Provider is not responsible for any action taken autonomously by any such agent, model, or system.

4. Disclaimer

The AI Features rely upon Inputs submitted by or on behalf of Customer, the Customer’s Content, as well as user interactions, feedback, and system configurations. Due to the nature of artificial intelligence generally, Customer acknowledges that Outputs may contain errors and misstatements and may be incomplete or inaccurate. Before leveraging any Outputs, Customer is responsible for its own human-led determination that the Outputs are suitable, and Customer is solely responsible for reviewing such Output together with any reliance on the accuracy, completeness, or usefulness of any Outputs. Except as expressly set forth in this Addendum, the AI Features and all Output are provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, or non-infringement, and Provider does not warrant that any Output will be accurate, complete, reliable, or free of bias.

5. Ownership

In connection with the use of any AI Feature, Customer owns and retains all rights, title and interest in and to its Content, and Provider does not and will not acquire any ownership rights or interests in or to any such Content; provided, however, that any Output provided by an AI Feature may be the same or similar to the Output provided to other users of the AI Features, and that such Output provided to other users will not be owned by Customer. Provider owns and retains all rights, titles and interest in and to the AI Features, the underlying models, and any improvements made thereon as permitted under Section 9. Nothing in this Addendum is intended to limit, modify or alter in any way Customer’s rights with respect to any Content that constitutes Confidential Information under the Agreement.

6. Acceptable Use

Customer will not and will cause its Authorized Users to not use the AI Features:

1. for automated decision-making or for other processes that have legal or similarly significant effects on an End User, unless it does so with meaningful review by a trained, competent individual who has the authority to alter or reject the outcome and in compliance with Applicable Laws;
2. to generate, distribute, or use Output in a manner that is unlawful, harmful, fraudulent, deceptive or otherwise in a manner that infringes upon the rights of any third parties;
3. to attempt to reverse engineer, extract, or discover underlying models, system prompts/instructions, or technical safeguards of the AI Features;
4. to develop or train any product or model that competes with the Offerings or AI Features;
5. for any purpose prohibited by Applicable Law or in a manner that otherwise breaches or is prohibited by the Agreement or any Documentation; or
6. in any manner that would constitute a prohibited artificial intelligence practice under Article 5 of the EU AI Act, including any use involving subliminal or manipulative techniques, exploitation of vulnerabilities of a specific group of persons, social scoring, biometric categorization to infer or deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation, or emotion recognition, in each case except as and to the extent expressly permitted under Applicable Law; or
7. to submit or otherwise process any Biometric Data as Input through an AI Feature, unless (i) Provider has expressly designated that AI Feature, in the Documentation or in writing, as supporting the processing of Biometric Data, and (ii) Customer has obtained all consents, provided all notices, and established a valid legal basis required under Applicable Law (including Article 9 of the GDPR and any applicable biometric privacy statutes) prior to submitting such Biometric Data.

7. Compliance with Applicable Laws

Each party is independently responsible for its own compliance with Applicable Laws in connection with its use or provision of the AI Features, including Applicable Laws relating to the use of automated decision-making (including but not limited to Article 22 of the GDPR). Each Party will take reasonable measures to ensure a sufficient level of AI literacy among its personnel involved in the use or oversight of the AI Features. Without limiting the foregoing, if Customer, an Authorized User, or an End User impacted by an AI Feature is located in the European Union, or the output of an AI Feature is otherwise used within the European Union (i.e., where the EU AI Act applies under Article 2 thereof), the following terms also apply, in addition to the parties’ other obligations under this Addendum:

1. Unless the parties otherwise agree in writing, Provider generally acts as the “provider” (as defined in Article 3(3) of the EU AI Act) and Customer generally acts as the “deployer” (as defined in Article 3(4) of the EU AI Act) of the AI Features.
2. Without limiting Customer’s independent compliance obligations, Customer will: (i) use the AI Features in accordance with the Documentation and any instructions provided by Provider; (ii) assign human oversight of the AI Features to competent, trained individuals with the authority to interpret Output and intervene in or disregard it; (iii) monitor the operation of the AI Features for risks to health, safety, or fundamental rights and suspend use and notify Provider if such a risk arises; and (iv) to the extent Provider does not already do so, retain any logs automatically generated by the AI Features that are under Customer’s control for the period required by Applicable Law.
3. Provider will, upon Customer’s reasonable request, make available such information about the AI Features as Provider generally makes available to its customers to support Customer’s compliance with its deployer obligations.
4. Each party will promptly notify the other in writing if it becomes aware of any serious incident (as defined under the EU AI Act) or other malfunction of an AI Feature presenting a risk to health, safety, or fundamental rights, and the parties will reasonably cooperate with each other, and with any competent authority, in connection with any resulting inquiry, investigation, or reporting obligation.
5. Provider will use commercially reasonable efforts to ensure that its agreements with Third-Party Suppliers provide Provider with sufficient information, assistance, and access to enable Provider’s compliance with the EU AI Act.
6. Customer will not, and will cause its Authorized Users to not, rebrand, substantially modify, or change the intended purpose of any AI Feature in a manner that would cause Customer to be treated as a provider of that AI Feature under Article 25 of the EU AI Act. If Customer does so, Customer will be deemed a provider of that AI Feature for purposes of the EU AI Act and will assume all attendant compliance obligations, and will defend, indemnify, and hold harmless Provider from any resulting claims or regulatory action.

8. Data Processing & Training

Provider will only use, process and store the Content as necessary to perform its obligations under the Agreement, to provide and maintain the AI Features and Offerings, or to otherwise comply with Applicable Law. Provider will not use the Content to train or improve AI Features, except (i) for customized training or improvement of the AI Features only for Customer’s benefit, or (ii) with Customer’s prior written permission or instruction. Notwithstanding the foregoing, Provider may compile statistical and technical Usage Data collected from the use of AI Features, which includes the types of actions, queries, or tasks performed by the AI Features, for the purposes of operating, maintaining, securing, and improving the AI Features. To the extent Provider (or its subcontractors) processes Personal Information on behalf of Customer in connection with any Content or AI Features, such processing is governed by the Data Processing Addendum and the parties’ roles will remain as set out in the Data Processing Addendum. This Addendum is not intended to modify Provider’s Privacy Policy or any controller or processing activity described in the Agreement or Data Processing Addendum. To the extent any AI Feature processes Biometric Data submitted in accordance with Section 6, such Biometric Data will be treated as sensitive or special category Personal Information subject to the safeguards described in the Data Processing Addendum, and Provider will handle such Biometric Data on a basis no less protective than that described in Annex I-B of the Data Processing Addendum. Content processed by the AI Features will be returned, deleted, or disposed of upon expiration or termination of the Agreement in accordance with Section 2.5 of the Data Processing Addendum.

9. AI Features Feedback

From time to time Customer may provide Provider with suggestions, comments, enhancement requests, recommendations, or any other feedback and report issues or problems related to Customer’s access, use, testing, or evaluation of the AI Features (collectively, “Feedback“). Feedback will not be considered Customer’s Confidential Information or its intellectual property, and nothing in this Addendum will restrict Provider’s right to use, sell, reproduce, modify, distribute, make available, publicly display, and perform, disclose, and otherwise exploit the Feedback, in whole or in part, without restriction or obligation, except that Provider will obtain Customer’s written approval prior to identifying Customer or ascribing any Feedback to Customer. Notwithstanding the foregoing, Feedback will not include, and Provider’s rights under this Section will not extend to, any Content or Confidential Information of Customer that may be incidentally included within Feedback. Feedback may constitute or include Provider’s Confidential Information; accordingly, Customer will not disclose any Feedback or other information regarding the AI Features to any third party without the prior written consent of Provider.

10. Third-Party Suppliers

Provider may use Third-Party Suppliers to deliver some or all of the functionality for certain AI Features. By using the AI Features, Customer acknowledges and permits Provider and its Affiliates to transmit any Input to such Third-Party Suppliers for processing in accordance with such Third-Party Suppliers’ terms of service. Provider will not disclose Content to a Third-Party Supplier for the purpose of training or fine-tuning that Third-Party Supplier’s underlying base models. Provider will use commercially reasonable efforts to ensure that its agreements with Third-Party Suppliers provide Provider with sufficient information, assistance, and access to enable Provider’s compliance with the EU AI Act and other Applicable Law. Provider will maintain an updated list of its Third-Party Suppliers with respect to AI Features, a copy of which is currently available at https://www.geocomply.com/geocomply-subprocessors/.

11. General

In the event of any conflict between the terms of this Addendum and the Agreement, the terms of this Addendum will control with respect to the use of AI Features. Except as expressly modified herein, all terms and conditions of the Agreement, including but not limited to those relating to limitation of liability, disclaimers, governing law, and dispute resolution, will apply in full to each party’s respective rights and obligations with respect to the AI Features. Provider may update this Addendum from time to time, and will provide reasonable notice of any material update, and such updates will take effect: (i) in the case of updates necessary to comply with Applicable Law or pertaining to new Offerings or features, immediately upon the delivery of such notice (or as otherwise specified therein), or (ii) in all other cases, upon the start of the next Order Form Renewal Term beginning on or after the “Last Updated” date above.