EU AI Act & AI Compliance for Icon Map
Icon Map currently includes two optional AI-related features: AI-assisted catalog search, and Icon Map AI, which lets your own AI assistant author maps through a locally installed MCP server. Tekantis governs both under a formal, risk-based framework aligned with the EU AI Act and the NIST AI Risk Management Framework, designed so that your data stays in your control.
This page explains where Icon Map uses AI, exactly what data is and is not sent to AI services, and how we govern these features. For our wider security architecture, see the Icon Map Pro security whitepaper (PDF).
Our approach to AI
Tekantis treats AI as something to be governed, not bolted on. Every AI feature in our products is assessed before release, recorded in an internal AI System Register, and classified against the EU AI Act's risk categories. Both current AI features are assistive: one helps a user find and rank information, the other lets the user's own AI assistant draft maps for the user to review, and the person always remains in control of the outcome.
In short: AI in Icon Map is optional, limited in scope, and does not make automated decisions about people. Tekantis never uses customer data to train AI models. Icon Map AI supplies no AI model of its own, and sends Tekantis no prompts, tool calls or results - only the catalog searches you choose to run and a start-up license check: your assistant, your model, your tenant.
Where Icon Map uses AI
We believe in being explicit about where AI is involved. Icon Map currently uses AI in two features:
AI-assisted catalog search (Icon Map Catalog)
When a user types a natural-language request to find a dataset in the Icon Map catalog, an AI model helps interpret the request and rank the most relevant datasets. Technically, the search prompt is converted into an embedding, a vector search is run against catalog metadata, and a large language model ranks the candidate datasets by relevance. The models are hosted within Microsoft Azure AI Foundry.
The feature is limited to discovering and ranking catalog datasets. It does not read, analyze or transmit the data inside your reports. It is optional and can be disabled.
Icon Map AI: your own AI assistant, through the MCP server
In private preview. Installed as part of Icon Map Desktop.
Icon Map AI lets an organization's own AI assistant author maps: describe the map you want, and the assistant discovers your Microsoft Fabric data and catalogs, assembles and previews the map, and saves it as an ordinary Icon Map item in your own Fabric workspace. It is delivered as a Model Context Protocol (MCP) server that runs locally on the user's machine and works with any MCP-capable AI client that supports local servers, such as Claude Desktop, Visual Studio Code with GitHub Copilot, or Cursor.
The design keeps Tekantis out of the loop entirely:
- No AI model is included. The server exposes authoring tools and a published map schema; the reasoning is done by whichever model your AI client uses, under your own agreement with that vendor. Tekantis does not receive prompts, tool calls or results.
- It acts as you. Every read and write uses the signed-in user's own Microsoft Entra identity, so the assistant can only reach data and maps that user is already permitted to, and Fabric permissions and row-level security apply unchanged.
- Nothing is hosted by Tekantis. There is no Tekantis AI service in the path; the only calls to Tekantis are the same catalog search and license activation the desktop app already makes.
- You stay in control. The assistant drafts; you review. Every AI-built map is an editable Icon Map item, and the assistant cannot publish or share maps on your behalf.
Because tool results are returned to your assistant, a bounded sample of your data (query results, column statistics and a preview image) is visible to the model your organization has connected, in the same way as pasting a table into that assistant would be. That exposure is governed by your agreement with your AI vendor, not by Tekantis, and we recommend applying the same policy to Icon Map AI as to that assistant generally. The full data-flow description is in the Icon Map for Fabric security whitepaper, section 10.
Other Icon Map capabilities (rendering maps, layers, slicing, catalog hosting) are not AI features and are covered by the security whitepapers.
What data is sent to AI, and what is not
This is the question customers most want answered, so we answer it plainly.
AI-assisted catalog search: sent to the AI service
- The text the user types into the catalog search box
- Selected catalog metadata (dataset titles and descriptions) for ranking
AI-assisted catalog search: never sent to the AI service
- Your datasets or report data
- Power BI model or visual data
- Personal, health or other regulated business data
- Anything used to identify or profile individuals
Icon Map AI
- Sent to Tekantis: nothing beyond catalog search terms and a license activation record (license key or Microsoft Entra token, product version, random installation and session identifiers). No prompts, no tool results, no data, no telemetry.
- Sent to your own AI assistant and its model: metadata about your workspaces and tables, bounded data samples and statistics (10,000 rows by default, 50,000 at most), validation results and preview images, all read under your own identity.
- Stays on your machine: geocoding and travel-time analysis run locally, so addresses, coordinates and origins never leave the device.
No training on your data. Tekantis does not use customer data, datasets or prompts to train AI models, and in Icon Map AI it does not receive them at all. Catalog search processing runs in Microsoft Azure AI Foundry, and Microsoft states that business customer prompts, completions and embeddings are not used to train its foundation models without the customer's permission or instruction.
Our EU AI Act position
The EU AI Act (Regulation (EU) 2024/1689) is risk-based. It places the heaviest obligations on "prohibited" and "high-risk" AI, with lighter transparency duties for AI that interacts with people. Tekantis has carried out a formal internal assessment of each AI feature against these categories.
- AI-assisted catalog search is assessed as a minimal-risk feature with a transparency touchpoint. It is not a prohibited practice and not a high-risk system under the Act.
- Icon Map AI is likewise assessed as a minimal-risk feature with a transparency touchpoint. Tekantis's role is that of a provider of a software component: it supplies no AI model, so the obligations attaching to the model and the assistant rest with the AI vendor you choose and with your organization as deployer.
- Neither feature operates critical infrastructure, or makes decisions about employment, credit, insurance, essential services, law enforcement, migration or justice.
- Icon Map already tells users when AI is being used to assist catalog search, the transparency measure the EU AI Act formally requires from August 2026. We continue to monitor the EU AI Act timeline and update our controls as each obligation takes effect.
- AI-assisted catalog search can be disabled for a customer account on request. Icon Map AI is only present where Icon Map Desktop is installed and registered with an AI client, needs the Icon Map Desktop application to be consented for your tenant before it can reach Fabric data (where your tenant allows user consent the user can consent at sign-in, but the Fabric permissions are admin-restricted in most tenants, so an administrator grants this once for the organization), and can be removed at any time.
We describe our features as assessed against the EU AI Act rather than "certified", because the Act does not provide a product certification scheme for low-risk AI.
United States and the NIST AI Risk Management Framework
There is currently no single, comprehensive federal AI law in the United States equivalent to the EU AI Act. The recognized benchmark that US enterprise customers ask about is the NIST AI Risk Management Framework (AI RMF 1.0).
- Tekantis aligns its AI governance with the NIST AI RMF and operates in conformance with its four functions: Govern, Map, Measure and Manage.
- The same controls that satisfy the EU AI Act, such as risk classification, data-flow mapping, transparency, human oversight and review, also support US due-diligence and procurement reviews.
- We monitor evolving US federal and state AI requirements and adjust our governance where needed.
The NIST AI RMF is voluntary guidance, not a certification scheme; "conformance" means we follow its functions and practices.
Transparency and human oversight
- Users are informed that AI is used to assist catalog search and ranking.
- AI results are presented as suggestions, so the user reviews them and decides what, if anything, to use.
- Maps built with Icon Map AI are ordinary, editable Icon Map items and can carry an "About this map" panel recording the sources, derived fields and caveats behind them, so the origin of AI-generated content is visible to anyone who opens the map.
- No automated decisions are made about individuals.
- Where supported, AI processing can be routed to a customer's own approved AI environment.
Governance and accountability
Behind these features sits a defined governance process, so our position is repeatable and evidenced rather than ad-hoc:
- An AI System Register recording each AI feature, its data flow, risk classification and controls, with a separate EU AI Act assessment for AI-assisted catalog search and for Icon Map AI.
- An AI System Governance & EU AI Act Compliance Procedure that every new or changed AI feature passes through before release.
- An LLM & Generative AI Usage Policy covering both staff use of AI tools and AI in our products.
- A named owner (CTO) and a regular review cycle, with reassessment whenever a feature's purpose, data, model or hosting changes.
Supporting your compliance reviews
Icon Map is designed to slot into your existing governance. We can support:
- Vendor security and AI due-diligence questionnaires
- EU AI Act and NIST AI RMF supplier assessments
- Data Protection Impact Assessments (DPIAs) under UK/EU GDPR
- Internal security and procurement reviews
More information
More detailed governance documents are available to customers and prospective customers on request, including our:
- AI System Register
- EU AI Act feature assessments (AI-assisted catalog search; Icon Map AI)
- AI Governance & EU AI Act Compliance Procedure
- LLM & Generative AI Usage Policy
For our wider security architecture, external resources, coding standards and assurance options, read the Icon Map Pro security whitepaper (PDF) and the Icon Map for Fabric security whitepaper, which covers Icon Map Desktop and Icon Map AI. You may also be interested in our Healthcare Compliance (HIPAA & NHS) page.
To request documentation or discuss an AI or security review, please get in touch.