AI Liability Framework

1. Scope and Application

This AI Liability Framework applies to all AI-assisted products, platforms, and services developed or deployed by ClearGlass Inc., including:

• ARTEMIS — AI-powered risk command and threat intelligence platform
• GUARDIAN — AI-enhanced security operations and anomaly detection
• NEXUS — Live risk command and AI-driven analytics
• Custom AI models, classifiers, and decision-support tools developed for clients
• Large language model (LLM) integrations within security workflows

This framework applies to ClearGlass Inc. as an AI developer and operator. Clients using ClearGlass platforms to deploy AI in their own operations take on responsibility for that downstream deployment, subject to applicable law.

2. AI Governance Principles

ClearGlass Inc. designs and deploys AI systems according to the following foundational principles, aligned with Canada's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems and emerging global AI governance standards:

3. Human Oversight Requirements

ClearGlass maintains that AI supplements, but does not replace, qualified human judgment in cybersecurity and risk management contexts. The following oversight requirements apply:

ClearGlass maintains logs of all AI-generated outputs and corresponding human review decisions for a minimum of 3 years, accessible to clients upon request for outputs relating to their data.

4. Limitation of AI Liability

AI systems are probabilistic and operate under uncertainty. ClearGlass makes no warranty that AI-assisted threat detection, risk scoring, or compliance recommendations will be free from error, omission, or false results (including false positives and false negatives).

Aggregate liability for AI-specific failures is subject to the limitation of liability provisions in our Terms of Service, capped at fees paid in the preceding 12 months.

5. AI Training Data Practices

ClearGlass applies strict governance to data used in AI model training:

• No client data used for model training without written consent. Client operational data is never incorporated into shared model training pipelines without an explicit data sharing agreement.
• Synthetic and open data preferred. Where possible, ClearGlass trains models on synthetic data, public datasets, or ClearGlass-owned red-team data.
• Anonymization prior to any training use. If operational data is used under an authorized data sharing agreement, it is anonymized and aggregated before training use.
• Provenance logging. Training dataset provenance is logged for all production models, identifying data sources, collection dates, and applicable licenses.
• Right to deletion. Clients may request removal of their contributed data from training datasets where technically feasible (right to be forgotten).

6. Ethical AI Commitments

ClearGlass Inc. commits to the following ethical standards in AI development and deployment:

• We will not develop AI systems designed to cause harm to individuals, organizations, or critical infrastructure
• We will conduct bias audits on threat detection and risk scoring models before production deployment
• We will publish AI governance updates annually and maintain this framework as a living document
• We will engage with emerging Canadian AI regulation, including Bill C-27 (AIDA) as it progresses, and adapt practices accordingly
• We will maintain an internal AI ethics review process for all novel AI applications before deployment

7. Prohibited AI Uses

ClearGlass Inc. prohibits the following uses of its AI platforms and services:

• Development or enhancement of offensive cyberweapons or destructive malware
• Mass surveillance of individuals without lawful authority
• Social scoring, political profiling, or discriminatory targeting of protected groups
• Generating disinformation, deepfakes, or synthetic media for deceptive purposes
• Any application that violates Canadian law, international humanitarian law, or human rights standards

Clients who engage ClearGlass for authorized security testing must comply with agreed Rules of Engagement. Use of ClearGlass AI capabilities outside authorized scope is a material breach of the applicable service agreement.

8. Incident Response

If a ClearGlass AI system produces outputs that cause or contribute to a security incident, privacy breach, or significant error affecting a client:

1. Notification: ClearGlass will notify the affected client within 72 hours of confirming the AI system contributed to the incident.
2. Containment: Affected AI model versions will be quarantined or disabled pending investigation.
3. Root Cause Analysis: A technical RCA will be completed within 14 days and shared with the affected client.
4. Remediation: Model corrections, retraining, or replacement will be implemented and validated before redeployment.
5. Regulatory Reporting: Where required by PIPEDA or other applicable law, ClearGlass will report to the appropriate regulatory authority.

9. Continuous Review

This AI Liability Framework is reviewed and updated at minimum annually, or upon:

• Material changes to Canadian AI regulation (including AIDA and Quebec Law 25)
• Deployment of a new AI platform or major model version
• A significant AI-related incident or near-miss
• Changes to industry standards (NIST AI RMF, ISO/IEC 42001)

Version history and change summaries are maintained internally. Material revisions to client-facing commitments are communicated by posting to this page with an updated effective date.

10. Contact

For questions about our AI governance practices or to report an AI-related concern: