1. How is AI used?

AI models at Yokoy are used in order to simplify and improve processes in the spend management context. Currently, this primarily includes the submission process, where AI is used to automat  ically extract information from the receipt & invoice and to “auto-fill” the submission form, but it may be expanded to other processes as well in the near future.

2. What data will be extracted by the AI?

In the context of the “auto-fill” of the expense form (the following principles remain true for other areas as well), the AI models are solely used to extract objective information from documents (e.g. for expenses this includes country, currency, total amount, tax items and more) and not to extract or collect personal information about the app user.

3. No decisions or judgements about the user made by Yokoy’s AI

The AI models do not make any sensitive decisions or judgements on app users. Should Yokoy at any point in the future decide to add AI models that will in any way shape or form judge the user behavior or use personal data in the development of the AI models, the activation of those models would only happen with the explicit and recorded consent of our customers.

4. No AI training with personal data

The terminology “training of an AI model” refers to the process of providing a set of historical input and output to an AI model such that the model can deduce its own logic and set of rules for associatingthemostlikelyoutputtoagivenfutureinput.
At Yokoy, the AI models never obtain any personal data of the app user as input and they are also not trained on personal data. This is achieved by using a preprocessing step prior to the application of AI models which transfers the digitized images (which may contain personal data in certain situations) into purely technical features which are completely anonymous. The AI models are trained and make predictions only based on those anonymous data / technical features. The information about the submitter of expense is provided only as a user id (a randomized text) to the AI models where it used to improve the extraction accuracy of certain fields based on previously uploaded and submitted documents. 

5. Information about the logic involved in the AI

There are two types of models: “pure” AI models and heuristic models.
While the heuristic models are based on human / business logic (e.g. for recognizing the date or the time) and “easy” to understand by humans, the “pure” AI models internal logic is not easily comprehensible by humans which is why they are often referred to “black boxes”. In order to provide trustworthiness in the pure AI models every model undergoes an extensive backtesting, e.g. it is tested against historic data, and in manual tests before going live. Regular recalibrations and monitoring of the AI models ensure that the AI models are up-to-date and fully functional. Root-cause analysis of erroneous model predictions as part of regular model reviews are used to create awareness of the model limitations and to improve the model’s performance.

6. Conclusion

Given the purpose (extraction of objective document information) and the design (no access to personal data) of the AI models in use, the measures described above are deemed as sufficient in order to comply with data protection requirements and regulations. The legal developments in this field will be closely watched and if required adaptations will be made.

Last updated 19.1.2024