AI Policy

People interacting with an AI system we have built are told they are interacting with AI – not left to assume otherwise. Where our systems generate content that could be mistaken for human-created work, that content is marked as AI-generated in a way a user can actually detect, in line with the EU AI Act’s Article 50 transparency obligations and equivalent requirements in other jurisdictions our clients operate in.

We disclose, in plain language, what an agentic system is allowed to do, what data it can access, and what it cannot do.

Systems that inform decisions about people – creditworthiness, eligibility, risk scoring, treatment recommendations, hiring – are tested for disparate impact across relevant groups before deployment, and re-tested when the underlying model, data, or use case changes materially.

We do not knowingly build systems designed to circumvent fair-lending, anti-discrimination, or equivalent sector-specific regulation, and we raise concerns with clients when a requested capability appears to create that risk.

Client data is used only for the purpose it was provided for. We do not use one client’s data to train or fine-tune models used for another client without explicit written consent. Agentic systems are scoped to access the minimum data needed to perform their function, not broad standing access by default.

This principle extends to how Nablon manages its own employee and contractor access to systems internally – the same data-minimization standard we ask of our AI systems, we hold ourselves to operationally.

Agentic systems are tested for adversarial inputs, prompt injection, and unsafe tool-use before going into production, not just for functional correctness. Systems with access to sensitive data or consequential actions undergo a security review appropriate to that risk level before deployment.

We maintain incident response procedures for AI systems we operate or manage, including a path to disable or roll back an agentic system quickly if it behaves unexpectedly.

We do not represent an AI system as more capable or more certain than it is. Every system we deliver comes with a documented statement of known limitations, tested operating conditions, and the conditions under which it should not be relied upon without human review.

We track and design against the regulatory frameworks relevant to where our clients operate and the sectors they are in, including:

• EU AI Act – risk-based obligations for AI systems placed on or affecting the EU market, including the Article 50 transparency rules in effect since 2 August 2026. Scope is triggered by whether a system’s output reaches an end user located in the EU, not by where Nablon or the client is headquartered, and is checked per engagement at scoping stage.
• Sector-specific expectations for AI and model risk in banking, including model risk management guidance from banking regulators in the markets we serve.
• Healthcare and MedTech AI/ML guidance, such as the FDA framework for AI/ML-based software as a medical device, where our systems touch health-adjacent decisions.
• Applicable data protection law, including GDPR and equivalents, governing any personal data our systems process.

This list is not exhaustive. We revisit it per active client vertical at each review, and whenever a new client vertical is onboarded.

Responsible AI review is part of how we scope and deliver engagements, not a separate check performed after the fact. It runs across four stages.

Clients, users, or Nablon employees who believe a system we have built is behaving unfairly, unsafely, or contrary to this policy can raise it with us directly.

We aim to acknowledge within two business days. Anything indicating an active safety or data risk is escalated immediately under our incident response procedure.

This policy is reviewed at least every 12 months, or sooner if relevant regulation changes materially – as it currently is under the EU AI Act’s phased rollout – or if a significant incident indicates a gap in our approach. The "Last updated" date at the top reflects the most recent revision.