AI Usage & Data Processing

What AI is allowed to do

AI assists with language and structure, always on content you provided or on approved structured rule data.

• Summarize and explain findings that the rules engine produced.
• Draft narrative sections of policies and reports for your review.
• Transform free text you write into structured register fields, which you confirm before saving.
• Suggest actions and literacy activities derived from your recorded AI usage.

What AI must never do

These limits are enforced by product design, not left to model behaviour.

• Invent legal citations or regulatory requirements.
• Claim that your organization is legally compliant, or that a system is definitively high-risk.
• Change facts you provided without showing you the change.
• Invent evidence or approve documents. Approval is always a human action.
• Classify regulated status without support from the rules engine.

Deterministic scoring

Your AI Governance Readiness Score, dimension scores, risk statuses and rule matches are computed by deterministic logic. The same inputs always produce the same outputs, and each finding records which rules triggered it.

Where processing happens

All AI requests are made from server-side functions. No AI credentials or API secrets exist in the browser. Requests carry only the content needed for the task at hand.

Training

Your governance content is not used to train models. It is processed to produce your outputs and then stored within your organization's records.

Human review

Where confidence is low, the product asks you to review rather than asserting an answer. Every generated document moves through draft, review and approved states, with an approver and approval date recorded.