Is Scopus AI GDPR compliant? What universities should check
Many university libraries now switch on Scopus AI as part of their Scopus subscription. This page sets out what Elsevier publicly documents about how Scopus AI handles prompts and conversation history, which AI providers sit behind it, where data is hosted and how transfers are covered, and what that means for a university.
Short answer
Scopus AI is Elsevier's generative AI search layer on top of the Scopus abstract and citation database, available only through an institutional subscription. Elsevier says it uses OpenAI, Anthropic and other models hosted on AWS or Microsoft Azure under zero-retention contracts, that prompts are never used for model development, and that its services may be hosted in Europe or the US. Its privacy policy states that Elsevier Inc. has certified certain services to the EU-U.S. Data Privacy Framework. Because Scopus AI works on Scopus metadata and abstracts rather than files that users upload, the main personal data is the researcher's own account and queries. The detailed answer depends on your subscription agreement and on what researchers type into it.
Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers AI research assistance with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data
What Elsevier documents publicly
Everything in this table comes from Elsevier's own pages, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and access model | Scopus AI is part of Scopus, published by Elsevier (a RELX company). Elsevier's support centre says it is "only available to users if it's part of their institutional subscription". The privacy policy names "the Elsevier company that owns or administers the Service" as the primary controller. Elsevier's Data Protection Officer can be reached through its Privacy Support Hub or at Elsevier Limited in London. | [1] [2] |
| What the AI reads | Elsevier's product page says answers draw on Scopus metadata, abstracts and author profiles, not full-text documents. Answers come with references to the underlying records. | [3] |
| AI models and providers | Documented Elsevier says its AI services use models from "OpenAI, Anthropic and others", hosted on Microsoft Azure or AWS. The support centre describes Elsevier's own language technology, OpenAI's GPT used privately, and smaller fine-tuned models for vector search, and says Scopus AI is hosted on Microsoft Azure. | [2] [4] |
| Training on prompts | Documented Elsevier states it has "zero-retention contracts" with foundation model providers, so prompts and documents "are never used for large language model development", and that its architecture and contracts prevent providers from logging or training on prompts. The product page adds that user queries will not be stored or used to train ChatGPT. | [3] [4] |
| Where data is hosted | Varies by service Elsevier's security page says services "may be hosted in Europe or the US based on application and regulatory requirements". The privacy policy lists storage locations including Ireland, Germany, France, the Netherlands, the United Kingdom, the United States, India, the Philippines, Singapore and Australia. The Scopus AI support article says it is hosted on Microsoft Azure. Not found publicly The hosting region specific to Scopus AI. | [1] [2] [4] |
| International transfers | The privacy policy says Elsevier Inc. "has certified certain of its services" to the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF, and that contracts are used to protect transferred data. The security page says cross-border transfers are subject to GDPR safeguards, including the EU Standard Contractual Clauses. On 7 October 2026 the official DPF list showed an active RELX entry under all three frameworks, with Elsevier Inc. among its covered entities; the list does not say which Elsevier services are covered. | [1] [4] [5] |
| Conversation history and retention | Two descriptions The product page says standard conversations are kept until the contract ends and temporary conversations for up to 30 days. The support article says chat history is not retained "unless compliantly done to enhance the product". Conversation history is encrypted with AES-256. | [2] [3] [4] |
| Data processing agreement | Not found publicly A public data processing agreement for Scopus subscribers was not found in public documentation (checked 7 October 2026). Terms are normally set in the institutional or consortium licence. | [1] |
| Security certifications | Elsevier's security page lists ISO 27001 and describes TLS 1.2 or higher in transit and AES-256 at rest. It also states that customer personal data is not transferred to China. | [4] |
Elsevier deserves credit for several things a DPO looks for: a clear written statement that model providers neither retain nor train on prompts, encryption details for conversation history, a temporary conversation mode, and a design that answers from curated metadata rather than from documents users upload. Elsevier's January 2025 announcement of new agreements with Dutch research institutions described them as a step forward in transparency on privacy and AI [6].
What this means for research and teaching
Validemic's analysisA lower-risk profile than many AI tools. Scopus AI does not ask researchers to upload interview transcripts, datasets or manuscripts. The personal data involved is mostly the user's account, log-in details, search history and the text of their questions. That is still personal data under Article 4(1) GDPR [7], but it is usually not special category data, and the likelihood that a full data protection impact assessment is needed is lower than for a transcription or document analysis tool.
Prompts can still reveal more than intended. A researcher might paste in a draft abstract, an unpublished hypothesis or details about a study population. Library guidance should tell users not to enter participant data or confidential material, even though Elsevier says providers do not retain prompts.
Controller roles. The privacy policy describes Elsevier as controller for its services [1]. For account and usage data, that is common for licensed databases: Elsevier decides how the service works and the university arranges access. The university remains responsible for its own processing, such as passing identity attributes through single sign-on. Check whether your licence or consortium agreement contains data protection terms, and whether it addresses AI features added after signature.
Retention needs a clear answer. The two Elsevier descriptions of conversation history are not obviously the same. Keeping conversations for the life of the contract may suit researchers who want to revisit searches, but students and staff should know it happens and how to use temporary mode.
Transfers. Elsevier mentions both European and US hosting and a DPF certification for "certain" services. The European Commission's adequacy decision for the DPF covers transfers to certified US organisations [8]. Ask Elsevier which entity and region serve Scopus AI for your institution, and whether Scopus is among the certified services.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Elsevier before switching Scopus AI on
- Which Elsevier entity is the controller for Scopus AI usage data, and does our licence or consortium agreement include data protection terms covering AI features?
- In which region are prompts, answers and conversation history stored and processed for our institution?
- Which model providers process our users' prompts, in which regions, and can we see the zero-retention commitment in writing?
- Is Scopus among the Elsevier services certified under the EU-U.S. Data Privacy Framework, and which other transfer mechanism applies?
- How long is standard conversation history kept, can our administrators shorten it, and how does that fit with the support centre's statement on retention?
- Is any Scopus AI usage data used to improve Elsevier's own models or products, and can we opt out?
- What personal data passes from our identity provider to Scopus when single sign-on is used?
- Can we obtain the ISO 27001 certificate and its scope?
The EU AI Act angle
The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [9]. Literature search and summarisation for research is not one of the education uses listed as high-risk in Annex III (such as admission decisions, evaluating learning outcomes or monitoring students during tests), and the Annex III obligations now apply from 2 December 2027 under the AI Omnibus, Regulation (EU) 2026/1744 [10]. The obligation that matters today is AI literacy: Article 4, as amended, requires deployers to take measures to support the AI literacy of staff and others using AI systems on their behalf [11]. For Scopus AI, that means teaching users that answers summarise abstracts, can miss relevant work and must be checked against the cited records.
Sources
- Elsevier Privacy Principles and Policy, last updated 1 September 2026, retrieved 7 October 2026
- Scopus AI-Enabled Features, Elsevier Support Center, retrieved 7 October 2026
- Scopus AI product page, Elsevier, retrieved 7 October 2026
- Elsevier security and compliance page, retrieved 7 October 2026
- Data Privacy Framework List, RELX entry (covered entity Elsevier Inc.), retrieved 7 October 2026
- Dutch research institutions and Elsevier announce new agreements, 20 January 2025, retrieved 7 October 2026
- Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4, retrieved 7 October 2026
- EU-US data transfers, European Commission, retrieved 7 October 2026
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Annex III, retrieved 7 October 2026
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026
About this page
We read Elsevier's privacy policy, security page, Scopus AI product page and support article on 7 October 2026, and searched the official Data Privacy Framework list on the same day. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it. Institutional licences often contain terms that are not public, so confirm the current position with Elsevier and your library before relying on it.
This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Elsevier and see an error, please contact us and we will correct it.
Frequently asked questions
Is Scopus AI GDPR compliant?
No tool is GDPR compliant on its own. Elsevier states that Scopus AI adheres to the GDPR, that its model providers work under zero-retention contracts and that prompts are not used for model development. Whether a university's use complies depends on its subscription agreement, the data researchers enter and how the institution informs users.
Does Elsevier use Scopus AI prompts to train AI models?
Elsevier says its contracts with foundation model providers are zero-retention, so prompts and documents are never used for large language model development, and that it has an agreement that user queries will not be stored or used to train ChatGPT.
Where is Scopus AI data hosted?
Elsevier's security page says its AI services run on AWS or Microsoft Azure and may be hosted in Europe or the US depending on the application and regulatory requirements, and the Scopus AI support article says Scopus AI is hosted on Microsoft Azure. Which region serves Scopus AI was not found in public documentation (checked 7 October 2026).
How long does Scopus AI keep conversation history?
Elsevier's product page says standard conversations are kept until the contract ends, while temporary conversations are kept for up to 30 days and then deleted. Elsevier's support article separately says chat history is not retained unless this is done compliantly to enhance the product, so ask Elsevier which statement applies to your subscription.
Can individual researchers buy Scopus AI?
Elsevier's support centre says Scopus AI is only available if it is part of the user's institutional subscription. That means the university, not the individual, sets the contract terms.