AI Usage and Disclosure Policy

Purpose

This policy explains where AssuraFlow uses AI-assisted functionality, what those features do, and the boundaries that apply to generated output.

Scope

AssuraFlow uses AI-assisted functionality only within NI governance and accountability workflows. The product does not use AI to deliver legal advice, clinical advice, staffing decisions, or autonomous compliance determinations.

Core Principles

• AI output is assistive, not authoritative.
• Provider leadership retains responsibility for all governance decisions.
• AI features must remain provider-scoped and tenant-safe.
• AI responses must not expose data across providers.
• AI-generated content must be clearly disclosed where presented to users.

Approved AI Use Cases

• Summarising recorded governance issues.
• Drafting evidence-grounded narrative outputs for NI review.
• Highlighting likely follow-up actions based on already recorded governance data.
• Supporting inspection companion style read-only guidance using existing evidence references.

Prohibited AI Use Cases

• Autonomous compliance scoring or verdicts.
• Legal advice or interpretation.
• Clinical advice or care delivery recommendations.
• Cross-tenant retrieval or synthesis of provider data.
• Background mutation of records without explicit user action.

Disclosure Standard

Where AssuraFlow presents AI-generated content, the user interface or API response must make clear that:

• the content is AI-generated;
• the content is descriptive or assistive only;
• human review is required before external or high-impact use.

Data Handling Standard

AI-assisted features may only process data already available to the authenticated user within their permitted provider scope. AI functionality must follow the same provider boundary enforcement as the rest of the platform.

Before any text is sent to the external AI service, AssuraFlow removes NHS numbers, National Insurance numbers, email addresses, UK phone numbers and postcodes, and replaces names the organisation holds (its staff, the people named in its contact logs and complaints, and its service-user references) and titled names such as "Mrs Jones" with placeholders such as [STAFF_MEMBER], [SERVICE_USER], [CONTACT] and [PERSON]. A name the platform does not hold, written without a title, can still be sent, so users should not type names into AI features. Voice notes are sent as audio for transcription and are not stored.

AI service providers. Text submitted to AI features is processed by Anthropic PBC (Claude models, United States), acting as AssuraFlow's sub-processor to deliver the platform's AI functionality. Under Anthropic's commercial terms and data processing addendum it processes that content only to provide the service, may not train its models on it, and deletes inputs and outputs within 30 days unless a different period is agreed or it must keep content longer to enforce its usage policy or meet a legal obligation (flagged content up to 2 years). Voice dictation, when an organisation has voice features on, is transcribed by OpenAI (United States). Both are listed in the Data Processing Agreement (§7.1) and the privacy policy.

Human Review Requirement

All draft narratives, summaries, and action suggestions require review by the relevant accountable user before use in governance reporting, external communication, or regulatory interaction.

Autopilot exception (2026-08-08): on a provider that has explicitly opted into Autopilot mode (aiAutonomyMode === "AUTOPILOT", Enterprise-tier only), a fixed, narrow whitelist of low-judgment, reversible proposal types (reminders, report drafts, document tagging, scheduled audit starts — apps/api/src/modules/agent-proposals/autopilot-whitelist.ts) executes without a human approval step, reviewedByUserId stays null on the resulting proposal record. The execution is always triggered by an explicit user chat request (never unprompted), always routes through the same guarded service a human would use, and is always audit-logged naming the initiating user and the NI who enabled Autopilot for that provider. High-judgment types — governance issues, remediation actions, standalone actions — are permanently excluded from auto-execution and always require human approval. This is a narrower guarantee than "all draft narratives... require review," and is documented here as the actual current behavior.

Auditability

AI-critical actions should be logged where operationally appropriate, including access to AI orchestration endpoints and draft-generation workflows.

Security and Tenant Isolation

The platform must enforce provider-level filtering before AI retrieval or generation steps are performed. Impersonation workflows must not weaken provider-boundary controls.

Customer Communication

AssuraFlow will describe AI capability in plain language, and will claim only capabilities that are implemented and tested. AI assists users; its recommendations remain subject to human review. AssuraFlow will not say that AI guarantees compliance, fully automates regulation or replaces professional judgement, and will not market AI as an automated compliance decision-maker (owner policy, 11 October 2026).

Review and Ownership

This policy should be reviewed whenever AI-assisted capabilities materially change, and at least annually as part of the platform compliance review cycle.