How DPCert uses artificial intelligence

Our position

At DPCert, AI works as a supporting tool, never as a judge. Six principles guide every use:

• People in charge: every decision that affects a candidate is made by a published rule or by a person, never by a model.
• Out of assessment: AI does not score exams, does not pass or fail anyone, does not watch candidates and does not decide revocations.
• Transparency: every use is described on this page, and an AI assistant presents itself as one.
• Privacy by design: texts leave without personal identifiers, and providers may not use them to train models.
• Fail safe: without AI, everything keeps working through the manual path. AI can be switched off at any time and is off by default.
• Accountability: every use has an owner, cost and volume limits, and human review proportionate to the risk.

Where we use AI

When the feature is switched on, AI is used only in these places, and in each of them a rule or a person comes after it:

• FAQ assistant: answers only from the published FAQ, the candidate handbook and the privacy policy, always with the source. When it cannot find the answer, it says so and offers to put you in touch with the team rather than guessing. It presents itself as an AI answer and has no access to your account.
• Suggestions in the free tools: some tools offer an AI-generated draft that you edit as you like. If the AI fails or is slow, the tool produces the result from its fixed template.
• Testimonial triage: AI can only hold a testimonial for human review, never release it. Publication is decided by rules and by people.
• Study guides and glossary: AI drafts texts anchored to numbered excerpts of each certification’s official guides and translates them into Portuguese and Spanish. Each text goes through automated checks; anything that fails goes to a person, and a 10% sample of what passes is also reviewed by a person.
• Question drafts for free assessments: no draft is used without a person reviewing it, and an approved question first goes through a trial period that does not count towards the score.

What AI never does

We have deliberately stayed out of the uses that the EU AI Act classifies as high-risk in education and vocational training (Annex III, point 3): evaluating learning outcomes, deciding access and monitoring prohibited behaviour during tests. That is why:

• Scoring of the certification exam is deterministic: each answer is compared with the answer key, with no partial credit, and the score with the pass mark published in the blueprint. No model takes part.
• Issuing, deferring and revoking a credential are decided by a published rule or by a person, with a recorded reason.
• Integrity does not use AI: there is no facial recognition and no video, voice or behaviour analysis. Integrity signals are reviewed by people.
• Appeals and result reviews are examined by a person who did not take the original decision.
• No certification exam question enters the draw without review by a qualified person.

How exam questions are made

The certification exam is DPCert’s product, and the quality of its questions is what gives the credential its value. The process is designed with reference to ISO/IEC 17024:

• Each certification has a published blueprint with domains and weights, and each question is written for one domain and cognitive level of that blueprint.
• If AI helped with a draft, it is raw material only: a qualified person checks accuracy against the sources, the answer key, clarity and bias, and a second, independent review confirms the key.
• Every question starts as a draft. Only questions activated by a person enter the draw, and the same item never appears in two languages in the same exam.
• Once in use, each question is tracked with difficulty and discrimination statistics. A question that suddenly everyone gets right may have leaked, and a person decides to retire it.

AI and candidates

The exam measures your judgement, not a model’s. That is why using AI during the certification exam is prohibited, and it is a ground for revoking the credential.

• Prohibited during the exam: chat assistants, browser extensions, screen capture or automatic translation tools, and any other AI system.
• Allowed: the assistive technology you need for accessibility, such as a screen reader. If you are unsure about a tool, ask support before the exam.
• Outside the exam, studying with AI is up to you. Free practice and open assessments are study, and there are no restrictions there.

What happens to the data

Before any text goes to an AI provider, detected emails, phone numbers, web addresses and personal names are removed from it. No account, purchase or certification exam data is sent, and the question asked to the FAQ assistant is not stored.

We only use providers under business terms that prohibit using the data sent to train models, and requests are sent with storage switched off where the provider offers that option. When an AI feature is on, the provider is listed among the recipients in the privacy policy.

Human oversight and accountability

The way we govern our own AI follows the four functions of the NIST AI Risk Management Framework:

• Govern: AI is off by default and only switched on by the administration, after this policy has been published. Every use has an owner.
• Map: every use is described on this page, with what goes in, what comes out and who decides afterwards.
• Measure: we track errors, cost and volume for each use, with daily and monthly limits, and review samples of what the AI produces.
• Manage: if a use fails, it falls back to the manual path on its own. Seen a wrong AI answer on the site? Write to support, and a person will correct it.

References

This policy was written with reference to the transparency obligations of the EU AI Act (Regulation (EU) 2024/1689, Art. 50), the NIST AI Risk Management Framework 1.0, the GDPR and the LGPD. It is not a statement of compliance or a third-party certification: it is DPCert’s public commitment on how it uses AI, updated whenever a use changes.