Artificial intelligence governance
Model terms · Data provenance · EU AI Act
In short
If your business builds AI features or lets staff use AI tools, we help settle what data can go into them, what the licences allow, and who is responsible when an output is wrong. If your AI features are used in the EU, the EU AI Act applies as well.
Where problems usually start
Features are often built on third-party models under terms read no further than the pricing page, using customer data collected for another purpose. Outputs reach users without disclosure, and sometimes act on them without review. There is no record of what data trained or tuned the model, which evaluations ran, or who approved the release. Meanwhile staff adopt AI tools faster than any policy, and the company cannot say what is in use or what has been put into it.
How we approach it
We advise teams shipping model-driven features on what their training data and upstream model licences allow, and what they can then promise customers about outputs and accuracy. We also settle who is liable when a model is wrong, and set up human review, disclosure and record-keeping for decisions that affect people. India has no dedicated AI statute yet, so most of this work is done through contracts, internal policy and the DPDP Act. For AI systems used in the EU, the EU AI Act sets obligations according to risk, and we work out which of them reach a product built in India.
What our work involves
- A map of the models in use, their licences, and their restrictions on training, outputs and downstream promises.
- A lawful basis and contractual permission for customer or employee data that reaches a model.
- AI and data processing addenda covering training rights, retention, confidentiality and liability for outputs.
- Human review, logging and disclosure for decisions that affect people, with evaluation records kept from before release.
- An internal AI-use policy with an approved-tools list and a way to add to it.
- A view of whether the EU AI Act applies to features used in the EU, and which obligations follow.
For startups and in-house teams
Startups building on third-party models and established companies rolling out AI tools both need a licence review of the models in use, clear terms on outputs, training and confidentiality, and an approval route for new tools.