Responsible AI & AI Governance

1. Why this policy exists

Blankstate builds infrastructure that measures and audits AI. Our product is the deterministic, auditable layer that sits next to generative systems — not the generative system itself. That distinction matters: it changes the risks our system poses, the controls customers should expect of us, and the standards we hold ourselves to.

This policy is the public, board-approved articulation of how we develop, deploy, and operate the AI components of our own product, how we engage with the AI of others, and what we will and will not do.

It is aligned with the NIST AI Risk Management Framework, the requirements of the ISO/IEC 42001 Artificial Intelligence Management System (AIMS) standard (towards which we are working), the EU AI Act, the OECD AI Principles, the UK government AI principles, and the emerging UK AI assurance ecosystem.

2. Scope

All AI / ML components developed, operated, or distributed by Blankstate as part of its products and internal operations, including:

• The Spectral Geometric Model (SGM) measurement engine and its dependent measurement systems.
• Internal supporting components for embedding, classification, and personal-data detection.
• AI-augmented engineering tools used by personnel — see BKS-AUP-001 §12.

3. What Blankstate is, and is not

We do not route customer data through third-party generative model providers in the production data path. Our measurement engine is Blankstate-owned and operated within Blankstate’s controlled environments. Customer-deployed (on-premise) options are available under the same architectural commitments and are scoped contract-by-contract.

4. Principles

Our AI components are designed and operated against these principles. They are non-negotiable.

4.1 Determinism and reproducibility

The same input under the same model state produces the same measurement. Our engine is not a stochastic generative system. This makes audit, replay, and dispute resolution possible in a way they fundamentally are not for generative systems.

4.2 Lawfulness and rights respect

Our AI is developed and deployed in compliance with applicable law, including the EU AI Act, UK GDPR / DPA 2018, EU GDPR, and equivalent regimes. We honour data-subject rights and our customers’ DPAs.

4.3 Privacy by design

• Zero personal-data retention by default in the measurement path (see BKS-DPP-001). Raw interaction content is processed and discarded; the projected measurements (“energy”) that are persisted carry no PII. The only personal data persisted by Blankstate’s own platform is what is structurally necessary to operate it: sign-in identifiers and user-profile records for authenticated platform users. Cloud and on-premise deployments are both available under the same architectural commitments.
• No training of models on customer data without explicit, contracted consent.
• We do not enrich customer interactions with profile data inferred from outside the customer’s tenant.

4.4 Transparency and explainability

• Our measurement is method-transparent. The mathematical projections, dimensions, and scoring functions of the measurement engine are documented and explainable to a competent reviewer, and are made available to customers and regulators under appropriate confidentiality.
• We report uncertainty alongside measurements where the design admits it.
• We do not present our outputs as truth claims about people; we present them as measurements of artefacts (interactions, system outputs) against documented dimensions.

4.5 Fairness and non-discrimination

• We assess our measurement components for adverse impact across protected characteristics where the use-case and data permit, in line with NIST AI RMF guidance and emerging EU AI Act bias-assessment requirements.
• We document known limits and avoid use-cases where the model’s training or design is not fit for the population.

4.6 Human oversight

• Consequential decisions about people are not delegated to our system unsupervised. We expect, document, and contractually require meaningful human oversight for any deployment where our outputs feed decisions affecting individuals.
• Our product interfaces are designed to surface, not hide, the basis for a measurement.

4.7 Robustness and security

• We apply secure-development controls (BKS-SDP-001) to the AI codebase as we do to the rest of the platform.
• We assess model artefacts and pipelines for vulnerabilities (BKS-VM-001).
• Inputs are validated; model and code dependencies are pinned and scanned.

4.8 Accountability

• AI components have a named owner (this policy’s Owner is accountable; engineering leads are delegated for specific components).
• Material changes go through BKS-CHG-001 with additional review (per §7 of that policy).
• We maintain documentation sufficient to support audit by customers, auditors, and regulators.

5. Prohibited and out-of-scope uses

Blankstate’s measurement engine is not designed for, and will not be knowingly licensed for, the following EU AI Act-prohibited or high-risk uses where our product cannot safely meet the use-case:

• Subliminal manipulation, exploitation of vulnerabilities, social scoring as defined by the EU AI Act Art. 5.
• Real-time biometric identification in publicly accessible spaces by law enforcement.
• Standalone determination of an individual’s access to essential public services, employment, credit, insurance, or migration outcomes — without meaningful human oversight and a documented appeal route.
• Use as a generative authoring or impersonation system — that is not what our engine does.

Where a prospective use-case would be a “high-risk AI system” under the EU AI Act, we engage with the customer on the additional governance, documentation, and conformity-assessment obligations before contracting.

6. Use of open-source components

Blankstate’s measurement engine and its supporting code use open-source components where appropriate, in the ordinary course of modern software engineering. These components operate within Blankstate’s controlled environment, are pinned and reviewed, and are scanned and patched under BKS-VM-001. We do not disclose individual third-party dependency names publicly; specific identifications are available to customers, regulators, and auditors under the appropriate confidentiality cover.

7. Use of third-party generative model providers

Third-party generative model providers are not in the production data path. Where personnel use AI-augmented productivity tools, they comply with BKS-AUP-001 §12 — in particular, no Restricted information is shared with general-purpose AI tools.

Introducing a third-party generative model into the production data path is a Major change under BKS-CHG-001 and requires:

1. Executive approval.
2. A documented privacy, security, and environmental impact assessment.
3. Customer notification under BKS-SUB-001 §6.
4. Update to this policy and to the public Trust Center.

8. Data used in development and evaluation

• Models are developed using Blankstate-owned, synthetic, or appropriately licensed data sets.
• Customer data is not used to train, fine-tune, or evaluate models without the customer’s explicit written consent.
• Evaluation data is curated to avoid leakage from production data sets.

9. Customer-facing transparency

• We publish this policy on the Blankstate Trust Center.
• We make method documentation and an audit summary available to customers under NDA.
• Material methodology changes are notified to customers per BKS-CHG-001.

10. Incident handling

AI-related incidents (e.g. discovery of a material measurement defect, a privacy issue in a data pipeline, a security issue in a model artefact) are handled under BKS-ICP-001 with the additional requirement that:

• Where the defect could have materially affected a customer-facing decision, the customer is informed proactively with the relevant time window and impact assessment.
• Where required by the EU AI Act (when in force for our customer base), serious incidents are reported to the competent authority through the appropriate channel.

11. AI Management System and continuous improvement

Blankstate is preparing to operate an AI Management System aligned to ISO/IEC 42001:

• AI governance roles assigned (this policy’s Owner as overall accountable owner; engineering leads delegated for specific components).
• AI risk register maintained alongside the InfoSec risk register.
• AI policy and procedures reviewed annually.
• Internal audits include AI components.

We will pursue ISO/IEC 42001 certification on the appropriate commercial timeline; ISO/IEC 27001 certification leads.

12. Contact

AI-ethics, governance, and Responsible-AI questions: the Owner above, via fair@blankstate.ai.

13. Approval and review

This policy is approved by Blankstate’s executive ownership and reviewed at least annually, or sooner on material change to applicable AI law (notably the EU AI Act) or the product architecture. The current version is published on the Blankstate Trust Center.