AI-use statement
Where we use a model, where we do not, what data goes where, and who signs off. We provide this in writing, adapted to the engagement, before work starts.
Stage by stage
| Stage | Model involved | Data leaving your perimeter | Human gate |
|---|---|---|---|
| Parsing source into syntax trees and call graphs | None | None; runs offline | None needed |
| Graph construction and community detection | None | None; runs offline | None needed |
| Reading documents into semantic nodes | Yes | None when pointed at a self-hosted model; otherwise the document text | Requirement review |
| Dependency inference | Yes, one call per requirement over a bounded candidate set | Requirement text and candidate neighbours, same rule as above | Dependency review |
| Drafting the Gherkin scenarios from extracted rules and interview notes | Yes | Same rule as above | Artifact review; every scenario cites its rule's source |
| Iteration planning and build order | None | None; runs offline | Plan approval |
| Estimating the fixed price | Yes, to propose a size for each scenario, citing its lines; the arithmetic runs with no model | Scenario text, same rule as above | Quote approval by a named person |
| Implementation | Yes, inside the gated lifecycle | Code under change, same residency rule | Sealed tests, design review, hardening |
| Parity and acceptance checking | None | None | Acceptance sign-off |
Rules that hold everywhere
- A model proposes; it never decides. Regulated and contractual outcomes, build order, dependency ordering and parity are computed deterministically or decided by a named person.
- Grounding is mandatory. Every model-proposed fact cites the exact source construct it came from, and the citation is verified mechanically before use. Unsupported values are rejected.
- Fail closed. What cannot be verified is marked unknown and routed to a person.
- Residency is a configuration, validated at start-up. The stages that use a model can run against a self-hosted open-weight model in the jurisdiction you require, Canada, the United States, or your own data centre. Where residency is required, a provider outside the permitted region fails the deployment, never a single request.
- Provenance is recorded. Every requirement, edge and decision carries how it was produced and who confirmed it, so an auditor can replay the chain.
Why it is written down
Public-sector buyers in Ontario now operate under a directive on the responsible use of artificial intelligence that reaches services with AI functionality. In the United States, the NIST AI Risk Management Framework is the reference that regulated companies and their auditors increasingly expect a vendor to map to. A written statement that names every stage, model, data flow and human gate is the practical answer to both. It also keeps us honest: a claim on this page is a claim we have to be able to demonstrate in the tooling.