Two stories from 29 October. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is taking a critical look at how debt collection agencies use AI, and Mistral has released the weights of its largest model. The first story shows what regulators are watching for, the second gives you another way to keep data within your own organisation.
DPA examined 29 debt collection agencies
The Dutch Data Protection Authority published a research report on algorithms and AI at debt collection agencies. It questioned 29 agencies. According to Security.NL, they use AI for four kinds of work: estimating the likelihood of collection, enriching debtor files, detecting vulnerability and analysing telephone conversations. In file enrichment, AI searches for additional information about debtors in registers or online, including on social media.
The AP sees several problems. Debt collection agencies have too little grip on the risks and do not understand the legal framework well. Some agencies apply too narrow a definition of personal data. For data enrichment and vulnerability detection, the AP doubts whether this is permitted. And the regulator considers it realistic that fully automated decisions with major consequences are being taken, which the GDPR prohibits, without the agency realising it. The core of the advice: never leave decisions about debtors entirely to the computer. "AI can also make mistakes", says AP board member Katja Mur.
What does this mean for you? If you work in debt collection or debtor management, check for each application whether a human employee genuinely takes part in any decision with consequences for the debtor, and not merely clicks through an outcome. Record which personal data each system uses, including data it retrieves itself. Tell debtors clearly that you use AI and what rights they have. On our page AI for debt collection you will find tools that offer exactly these functions. NeurOp Credit Management AI calculates the chance of collection when a case comes in, Ophelos lists LLM detection of vulnerable customers as a feature, and Payt predicts payment behaviour. That says nothing about whether those tools break the rules, but these are precisely the applications the AP is now looking at. If you use a general language model for letters or call notes, also check the GDPR check for ChatGPT in debt collection or the GDPR check for Claude in debt collection.
Mistral Large 4: weights on Hugging Face
Mistral has released the weights of Mistral Large 4 on Hugging Face. The model has roughly 1 trillion parameters, a context window of 1 million tokens and processes text and images. There are official FP8 and NVFP4 versions, and it runs with, among others, vLLM and llama.cpp. The licence is called the Mistral Ecosystem Open-Weight License: a derivative of MIT, with restrictions for anyone offering the model as a service to others.
What does this mean for you? If you want to use a large language model without data going to an external provider, you can now run Mistral Large 4 on your own servers or with a European hosting partner. This does require serious hardware, so it is mainly something for larger organisations or IT service providers. If you supply the model as a service to customers, read the licence first. You can see how Mistral scores on privacy on the Mistral page and, for example, in the GDPR check for Mistral in government. You can compare at Claude vs Mistral and ChatGPT vs Mistral.
In brief
- The AP wants debt collection agencies never to decide about debtors fully automatically, and it takes a critical view of data enrichment and vulnerability detection.
- You can now self-host Mistral Large 4. Read the licence if you offer it to others.
- All models and their privacy scores are at models and safety.
