AI Disclosure
AI Transparency and Disclosure
This application uses Google Gemini models served via Google Cloud Platform (GCP) as part of its AI functionality. These services are used to process user inputs and generate AI-assisted outputs within the platform. Because generative AI can produce inaccurate or incomplete content, users are responsible for reviewing and validating outputs before use.
Capabilities and Limitations
What these features do: Mycroft's AI features generate, summarize, classify, or reformat text based on inputs supplied by the customer and on framework and control content maintained by Mycroft. They are designed to reduce the manual effort of producing and maintaining compliance documentation.
What these features do not do: They do not make decisions on the customer's behalf. They do not determine whether a customer is compliant with any framework, standard, or law. They do not independently verify the accuracy of information supplied to them.
No automated decision-making with legal or similarly significant effects: Mycroft's AI features do not carry out automated decision-making, including profiling, that produces legal effects concerning an individual or similarly significantly affects an individual.
Generative AI produces errors: Outputs may be inaccurate, incomplete, or internally inconsistent, and may be expressed with unwarranted confidence. Users are responsible for reviewing and validating all AI-assisted output before relying on it or presenting it to an auditor, regulator, customer, or other third party.
Data Handling
Model providers: A current list of Mycroft's sub-processors is maintained on the Trust Center.
Whether inputs leave the customer tenant: Customer inputs are transmitted to the model provider for the sole purpose of generating the requested output. Inputs are not shared with, or made visible to, other Mycroft customers. Outputs are returned to and stored within the originating customer's tenant.
Training: Customer inputs and AI outputs are not used to train or fine-tune the foundation models operated by Mycroft's model providers. Mycroft does not train or fine-tune models on customer data.
Mycroft may compile aggregated and anonymized statistics relating to platform use, as described in the Master Services Agreement. Those statistics exclude personal information in identifiable form and do not identify any customer. Return, transfer, and deletion of customer data on termination are governed by the Master Services Agreement and the Data Processing Agreement.
Human Oversight and User Responsibilities
AI-assisted output in the Mycroft platform is advisory. Before relying on it, users are responsible for:
- Reviewing output for accuracy, completeness, and fit to their actual environment
- Correcting or rejecting output that does not reflect their organization
- Confirming that any framework or regulatory interpretation reflected in output is appropriate for their circumstances, with qualified advice where needed
- Ensuring that data submitted to AI features is data they are permitted to process and to disclose to a sub-processor
Reporting a Concern
If you believe an AI feature has produced a harmful, inaccurate, discriminatory, or otherwise inappropriate output, or if you have a concern about how Mycroft uses AI, contact: security@mycroft.io
Where an AI-related incident materially affects a customer, Mycroft will notify affected customers in accordance with the Master Services Agreement and any applicable Data Processing Agreement.
Governance
Mycroft maintains an AI management system covering the governance, risk assessment, and impact assessment of AI features in the platform under the ISO/IEC 42001:2023 Framework.
Third-party model providers are assessed through Mycroft's third-party risk management process before use and reviewed on a recurring basis.
This disclosure supplements, and does not replace, the Master Services Agreement, the Privacy Policy, and any executed Data Processing Agreement. Where this disclosure and a signed agreement differ, the signed agreement governs.