Frequently Asked Questions

For a list of Pega GenAI supported products, see Pega GenAI in Pega Cloud documentation.

Yes, you can use customized Pega GenAI Rules. To learn how to customize Pega GenAI Rules, see Creating GenAI Connect Rules in the Pega Platform documentation.

Yes, Artificial Intelligence (AI) at Pega is multifaceted, encompassing various categories designed to optimize workflows, enhance productivity, and transform legacy systems. Many years before generative AI transformed the way we think about what is possible with AI, Pega established a reputation as a market leader in analytical AI technologies like real-time decisioning and process AI. For more information on the different categories of AI at Pega, along with the specific Pega capabilities that use each type of AI, see Overview of Pega AI in Pega Cloud.

Generative AI is used to provide suggested templates throughout the Blueprint experience to give you a starting point for your design and to unlock new ideas for how to approach workflow problems. For example, generative AI can suggest the following items:

• Case types based on application description
• Case lifecycles based on case type and application descriptions
• Case data models based on case type and application descriptions
• Data objects based on application descriptions
• Personas based on application descriptions

When objects, for example, case types, lifecycles, data, and personas are edited, they are not resent to generative AI models. For more information on building an application with Blueprint, see Creating a new application from a Blueprint.

For other frequently asked questions on Blueprint, see Pega Blueprint: FAQs.

Blueprints are stored in Pega Cloud in a US deployment region.

To ensure clients can build, maintain, and leverage their Blueprint library effectively, Blueprints are retained indefinitely by default. However, if clients wish to delete their Blueprints, they can do so at any time from their My Blueprint Dashboard.

For other frequently asked questions on Blueprint, see Pega Blueprint: FAQs.

Through a few different strategies, including:

1. Enabling clients to mask sensitive data elements provided by clients to mitigate the possibility that they are sent to a public large language model (LLM).
2. By using public LLMs that are stateless and that do not use client data to train their models.
3. Through the use of industry standard, security best practices for encryption of data in transit and data at rest.

For more information about data safety practices, see Using Pega GenAI securely in Pega Cloud.

When using GenAI Connect, Pega applies prompt masking through the Text Analyzer rule, which automatically detects and masks sensitive entities such as names, email addresses, account numbers, and phone numbers. The context needed for AI processing is preserved, while the actual sensitive data never leaves the secure Pega environment. For more information about data safety practices, see Using Pega GenAI securely in Pega Cloud.

Yes. Organizations can customize masking rules to include additional entities based on their own compliance requirements.

Masking is applied at the prompt-creation stage, before any data is sent to an external LLM. It is used as a mitigation step when prompts are built through GenAI Connect rules, and is especially important in scenarios such as summarization, where controlling the content of a prompt is difficult.

The large language models (LLM) do not understand Pega meta-application language, so the actual application is never shared. Depending on the design-time use case, Pega can, at the client’s discretion, send prompts in support of use cases like “suggest case types,” “suggest data objects,” or “suggest pick list.” These prompts include context derived from your applications, and the responses returned from the LLM are interpreted by Pega and turned into associated Pega application artifacts. Existing application workflows or segments of these business processes are never sent to the LLM in support of these design time features. As covered in Pega GenAI data security in Pega Cloud, the LLM is stateless, and Pega has taken additional steps to ensure any review of prompts submitted by Pega are not stored for any review by our LLM provider.

Pega GenAI runs with strict single-tenant isolation. Each client has its own GenAI Gateway, vector store, and agent service, so interactions and data remain exclusive to that tenant and are never mixed with other clients. All GenAI conversations are stateless with zero-retention policies, and no prompts or completions are stored by third-party LLMs or used for model training.

No, client data is never used by Pega or large language model (LLM) providers to train models.

Pega does not log prompts and completion data that is generated by client applications and sent to Pega GenAI for operational purposes.

To provide clients with auditability and ongoing maintenance, prompts and completions are stored in client environment(s). This best practice safeguards your interactions and maintains privacy. For more information, see Pega GenAI data security in Pega Cloud.

1. Microsoft AI Red Team Methodology
2. OpenAI Safety Best Practices
3. Microsoft required mitigations
4. OWASP Top 10 for Large Language Model Applications
5. OWASP Cloud-Native Application Security Top 10.

Yes, exported Blueprints are encrypted before they are exported by using a key known to Pega Platform, and can only be decrypted by Pega at import time. For more information about data security with Pega GenAI, see Pega GenAI data security in Pega Cloud.

For other frequently asked questions on Blueprint, see Pega Blueprint: FAQs.

Yes. Clients can connect Pega GenAI to a dedicated, client-managed agent deployed in their own network and powered by their own LLMs, allowing them to delegate highly sensitive actions to agents they control. 

Yes. While different managed model providers offer their own native guardrail and content-safety capabilities, Pega enforces a consistent baseline set of content filtering standards across all supported providers. This means the same protections apply whether a request is served by an AWS Bedrock model, Azure OpenAI, or a Google Cloud managed model, so behavior remains predictable as models change.

The enforced standards screen both prompts and responses for the following:

• Hate speech
• Harassment
• Dangerous content
• Sexually explicit content
• Child sexual abuse material (CSAM)
• Prompt injection and malicious URIs

Where a provider’s terminology or filter categories differ, Pega maps its standards onto each provider’s available controls to maintain equivalent coverage. Specific confidence thresholds and enforcement behavior may vary by provider based on the controls each one exposes. For more information about data safety practices, see Using Pega GenAI securely in Pega Cloud.

Pega enforces the baseline content filtering standards automatically across all supported providers, so those protections apply out of the box. PII masking is configurable so clients can extend the masked entity set to fit their compliance needs and clients remain responsible for proper configuration of masking and for adherence to their applicable regulatory standards.

There are a number of concepts and practices employed by Pega to mitigate the impacts of bias and hallucination, some of which are described below. It should be noted that Pega cannot eliminate all possibilities of bias and hallucination and clients should be aware of this when applying the usage of Pega GenAI to different client use cases.

Most Pega use cases of generative AI by its clients will have a Human in the Loop component. Human in the Loop is one effective safeguard that can mitigate possible impact from bias or hallucination of large language models (LLM).

Pega uses “Temperature,” which is a hyperparameter used in some natural language processing models to control the level of randomness or “creativity” in the generated text. Pega sets these values based on use case to deliver optimal results for our clients, while minimizing the randomness and creativity of the answer. We leverage this model parameter to make the response more predictable.

Pega also uses Retrieval Augmented Generation (RAG), which utilizes a client-provided knowledge base that provides relevant information (non-parametric knowledge) from the knowledge base in the input prompt. This governs and aligns the generative nature of large language models with a fact-based search, which can help mitigate hallucination problems. For more background on how RAG is implemented in Pega Knowledge Buddy, see How Knowledge Buddy works.

For more information about data safety practices, see Using Pega GenAI securely in Pega Cloud.

Pega reduces the risk of model drift by managing LLM versions through a controlled lifecycle. Specific model versions are selected from approved providers and are updated on a planned schedule, typically in alignment with Pega Infinity releases.

Since deployed models are not actively retrained while in use, their behavior remains stable and predictable, helping to minimize the likelihood of drift over time

Human-in-the-loop is designed in rather than added at the end, with configurable thresholds for human intervention. This aligns with Pega’s ISO/IEC 42001 governance, which mandates human review points, clear escalation paths, and the ability to intervene in, correct, or halt AI-driven processes.

Pega logs agent activity across three layers:

• The conversation layer (interactions, responses, token usage, and moderation outcomes)
• The workflow layer (case transitions, rule sets evaluated, policy checks, and any circuit-breakers triggered)
• The tooling/system layer (tool invocations and their inputs and outputs, with sensitive data redacted)

Every proposal, gate decision, and action is correlated to case, stage, step, and rule-set version through tools such as the Agent Tracer, enabling full replay, root-cause analysis, and compliance audits.

Pega’s GenAI governance is certified by the ISO/IEC 42001:2023 standard for AI Management Systems, integrated with its ISO/IEC 27001:2022 Information Security Management System.

A cross-functional AI Steering Committee governs all Pega AI features including those using third-party models, overseeing policy approvals, risk classification, supplier onboarding, and lifecycle controls.

Pega also maintains an AI risk register, conducts AI system impact assessments, and mandates annual internal and external audits

Pega provides a framework that combines two complementary evaluation modes:

• An LLM-Judge (probabilistic) track covering role adherence, knowledge retention, conversation completeness, and hallucinations;
• A rules-based (deterministic) track covering tool correctness, latency and performance, business-case lifecycle, and step-agent accuracy.

Toxicity, bias, and safety are evaluated as cross-cutting metrics across both.

Deterministic (rules-based) evaluation checks things that have a single correct answer. For example: correct tool and API invocation, workflow and step fidelity, task completion, latency and throughput SLAs, and enforcement of guardrails and access controls.

Probabilistic evaluation (model judges) assesses nuanced behavior that binary assertions cannot capture. For example: hallucination and factuality risk, role and instruction adherence, task quality, and bias, toxicity, and safety.

Pega GenAI Connect includes an AI Designer playground where teams can evaluate a selected model’s responses before changing the rules in an application and compare new versus old behavior after a change for example, after adjusting a rule’s temperature.

Modern frameworks such as the NIST AI Risk Management Framework and the EU AI Act call for ongoing, objective evaluation rather than one-time sign-offs. Pega’s model judges provide repeatable assessments of accuracy, performance over time, and safety and compliance, supported by the Plan-Do-Check-Act lifecycle of its ISO/IEC 42001 governance.

In all Pega GenAI deployments, Pega endeavors where possible to use a Region from the available Pega GenAI Service Deployment Regions which is a comparable region to the client-selected deployment region.

Pega will pair a client-selected deployment region within the US or EU with a comparable Pega GenAI deployment region(s) also in the US or EU. For more information on Pega Cloud deployment regions, see Deployment regions for Pega Cloud.

Yes, with effect from the Pega Infinity 25 and 26 releases, clients may elect to bring their own models.  This maybe to support specific regulatory or locality needs not available from the models provided through the Pega Cloud service.

Pegasystems does not own results from the client’s use of Pega GenAI. The client understands and acknowledges that Generative AI systems, including Pega GenAI, may produce similar responses to similar prompts or queries from multiple individuals and that clients’ rights in results might not be enforceable against third parties.

To learn more, work with your Pega representative to sign the Pega GenAI Addendum and enable Pega GenAI. For more information, see Enabling Pega GenAI on Pega Cloud.