AI transparency and responsible use

1. What AI-assisted features do

Northstone’s product design includes sourced briefings, document extraction, inferred facts, qualification signals, deal-health scoring, investor matching, draft communications, and voice/scheduling workflows. Availability varies by deployment and workspace. An unavailable provider is not represented as successful live AI processing.

The current generative Copilot implementation has no approved live provider transport. It does not send tenant records to an AI provider when that transport is unavailable. Deterministic scoring and other inference features still need transparency and review even when they do not use a generative model.

2. Evidence, confidence, and limitations

Observed information records what a source says; inferred information is an interpretation; verified status must be supported by the relevant evidence and authority. Review provenance, date, contradictions, and missing context. A score prioritizes attention within the configured workflow; it is not a credit rating, independent valuation, probability guarantee, or verification of a person’s finances.

Models and rules can reproduce bias, misread documents, miss deadlines, or fabricate details. Source material can also be wrong. Review critical facts against original records. Do not infer protected or sensitive characteristics from names, location, accents, or behavior.

3. Human oversight and prohibited uses

A qualified person must be able to understand, challenge, correct, and override consequential outputs. The proposed scope excludes autonomous housing, credit, employment, insurance, and other eligibility decisions with legal or similarly significant effects. Expanding that scope requires a documented legal and risk assessment before activation.

Do not use Northstone for unlawful discrimination, manipulative targeting, prohibited social scoring, unauthorized biometric identification, deceptive impersonation, or prohibited emotion inference. Automation permissions do not replace legal authority, professional judgment, or consent. Escalate uncertain or conflicting evidence rather than treating an inference as fact.

4. Disclosure, communications, and training

Where a live AI assistant interacts with a person, provide a clear AI disclosure at the start of the interaction when required. Synthetic voice, generated media, and public-interest content require their own labeling assessment. Assess and implement applicable marking and provenance duties before activation, and preserve required supplier markings. Do not activate a feature where required duties cannot be met. A policy page alone cannot satisfy interaction-level or content-marking obligations.

Calls, recordings, SMS, email, and bookings need appropriate recipient authority, notices, consent, suppression, and human escalation. Review dialing, recording, marketing, and anti-spam rules for the recipient’s region before enabling a provider. A customer’s uploaded contact list is not proof of permission to contact everyone on it.

This draft grants no permission to train shared foundation models on customer content. Before enabling a model provider, confirm contractual training restrictions, retention, processing locations, security, and deletion. Do not claim zero retention or no provider training without evidence for the actual account and endpoint.

5. European Union AI Act

Applicability depends on where the system is placed on the market, used, and where its outputs are used, as well as Northstone’s role and the intended use. Integrating another company’s model does not automatically make Northstone a general-purpose model provider, and does not remove system-provider or deployer responsibilities. Classify each real use rather than declaring the whole platform low risk.

The AI Act’s prohibited-practice and AI-literacy provisions apply from February 2, 2025; general-purpose model obligations began August 2, 2025; most transparency obligations apply from August 2, 2026. The 2026 AI Omnibus moves Annex III high-risk requirements to December 2, 2027 and Annex I product-related requirements to August 2, 2028. For systems placed on the market before August 2, 2026, the Article 50(2) marking/detection transition runs to December 2, 2026. The amended literacy provision requires appropriate support measures, not a guarantee of an individual’s proficiency. A future high-risk deadline does not postpone current transparency or privacy duties.

Before an EU deployment, document role, classification, intended purpose, literacy, interaction notices, model/provider information, oversight, incident escalation, and any required impact assessment. GDPR applies independently to personal information, including restrictions on qualifying solely automated decisions.

6. California AI and privacy laws

California has several AI laws with different scopes, rather than one universal AI Act. The California AI Transparency Act (SB 942, amended by AB 853) applies to defined covered providers from August 2, 2026, with other actor-specific provisions phased later. SB 53 focuses on defined frontier-model developers. Assess roles, thresholds, and duties for the actual offering rather than claiming every SaaS is covered or exempt.

AB 2013 has applied since January 1, 2026 to covered developers making generative AI systems or services available to Californians. Its definitions can include substantial modification and developer testing, validation, or fine-tuning. Assess Northstone’s own development and data use; the law is not limited to foundation-model training companies. Where required, publish accurate high-level training-data documentation before covered releases or modifications.

Customers and the operator must separately assess the CCPA/CPRA, applicable automated-decision regulations, bot disclosure, anti-discrimination, consumer-protection, and communication rules. Where covered, provide the relevant notices, access/opt-out mechanisms, and risk assessments. Do not describe the vetoed SB 1047 proposal as an enacted law.

California’s approved privacy regulations took effect January 1, 2026; covered ADMT significant-decision requirements have a January 1, 2027 compliance date. Risk-assessment obligations can already apply in 2026. Confirm the relevant trigger and phase-in before activating a consequential feature.

7. Canada and Québec

PIPEDA and Québec’s private-sector privacy law, as modernized by Law 25, can apply to AI processing. Necessity, appropriate purposes, valid consent where required, safeguards, correction, and accountability remain relevant to derived information. Exclusively automated decisions in Québec require particular notice, explanation and correction rights, and an opportunity for a person to present observations to someone able to review the decision.

Perform required Québec privacy impact assessments for qualifying information-system projects and out-of-Québec disclosures. Review CASL for commercial electronic messages, telemarketing rules, recording consent, human-rights law, and applicable brokerage obligations. Proposed legislation is not a substitute for current law; the former Bill C-27/AIDA proposal must not be represented as an enacted Canadian AI Act.

8. Challenge an output or report a concern

Email support@loomlogic.io with the workspace, feature, approximate date, and a description of the concern. Avoid sending unnecessary personal information. A request for human review should identify the consequential action and the information believed to be incorrect. Customer-controlled decisions must be routed to the responsible organization.

AI incidents require investigation, preservation of relevant evidence, correction or suspension where appropriate, and legal assessment of notification duties. The operator must establish an approved owner, escalation procedure, and response targets before production activation of a consequential AI workflow.