AI governance at OutThink

01How OutThink uses AI

Every AI capability in OutThink serves one purpose: helping your organization understand and reduce human cyber risk. Each one belongs to one of four families.

02Your data stays in your tenant

• Processed in the region you choose.Models run in OutThink’s own Microsoft Azure AI Foundry environments, and you choose the region where your processing takes place.
• Never used for training.No customer data is used to train any model.
• Isolated by tenant.AI processing happens inside your tenant and is encrypted in transit and at rest with tenant-specific keys. There is no cross-customer access, sharing or inference.
• Minimized.Each capability processes only the data it needs. Personal data is removed or minimized wherever the function allows.
• Deleted when you say so.Knowledge Base material you delete is removed from the live store immediately. Backup copies age out within 90 days, or sooner on request.
• One clearly bounded exception.Deepfake simulations use two specialist services, ElevenLabs for voice and Fal.ai for video, which process data in the United States. They are engaged only for customers who enable the capability. Portrait images and voice samples are discarded once the asset is produced.

03People stay in control

• Nothing reaches employees unreviewed.Generated and AI-adapted training goes to an administrator for review. The administrator confirms that review before publication.
• Content from real reported emails waits for approval.A simulation or nudge built from a real reported email is not used until an administrator approves it.
• You decide what is switched on.Autonomous simulation, Real Time Threats, training module generation and deepfake simulations are all enabled only if you choose them.
• Decisions stay human.AI output supports decisions but does not make them. Responsibility stays with your people.

04What our AI is never used for

• ✕Training models on your data.
• ✕Automated decisions with legal or similarly significant effects on an individual.
• ✕Evaluating people for hiring, performance, promotion or discipline, or sharing AI output with HR for those purposes.
• ✕Surveillance, or anything outside your human risk management program.

The platform has an adaptive capability. Autonomous simulation, and the per-user risk score that informs it, decide which simulated exercise a person receives and when. Your administrators can see the risk score as part of program reporting. OutThink never uses it to evaluate, rate or rank anyone beyond the program.

05Our EU AI Act position

OutThink is the provider of its AI systems, and you, as the customer, are the deployer. Our capabilities are classified as limited risk, the transparency tier. That assessment was made against the AI Act as amended in 2026.

Why OutThink is not high risk

• Not an education system (Annex III, point 3).The platform does not decide admission, assess education levels or monitor tests. Nor does it evaluate learning outcomes that affect access to qualifications or careers.
• Not an employment system (Annex III, point 4).It does not recruit, evaluate performance, inform promotion or termination, or allocate work. It allocates training exercises.
• No prohibited practices (Article 5).The platform performs no manipulation, social scoring, biometric identification or categorization using AI, and no emotion recognition. Controls on deepfake simulations address the new prohibitions that apply from December 2, 2026.
• No CE marking required.Under the AI Act, CE marking applies only to high-risk systems.

06Transparency and AI labeling

Article 50 of the AI Act asks providers to make AI-generated content recognizable. Here is how we meet it.

• Every phishing simulation ends with a learning debrief that discloses it was simulated.
• Administrators are told when content is AI-generated and confirm their review before publishing.
• Deepfake content is clearly disclosed and machine-marked. Video is shown with an on-page disclosure that it was artificially generated. Audio carries a SynthID watermark. Video carries a signed C2PA manifest and a pixel-level watermark. We have verified that these markings persist into the output you receive.
• Machine-readable marking for AI-generated training content is in delivery, scheduled for completion by December 2, 2026, the date set by the AI Act.
• Faithful machine translation is an assistive function and falls outside the marking requirement, as the European Commission’s Article 50 guidelines set out.

07Beyond the EU

The same controls apply to every customer, wherever they operate. None of them is a regional setting.

• United States.We state our position against federal law and against state laws on AI transparency, AI governance, automated employment decisions, and likeness and voice. The consent and disclosure requirements for deepfake simulations apply to every customer.
• United Kingdom.Our AI use is governed by the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Autonomous simulation does not make significant decisions about individuals, so the safeguards for automated decision-making are not engaged.

08How we govern it

• ISO 27001 certified, operating under the UK GDPR and the EU GDPR.
• A CTO-approved Use of Artificial Intelligence Policy, with risk-based assessment of every AI use case and defined accountability.
• Every new AI capability is reassessed before release. Our AI Transparency Policy is updated with each new capability and with any material change to the AI Act.
• AI literacy measures for the staff who operate these systems, and administrator guidance for customers.
• AI sub-processors bound by contractual data-protection obligations, with security due diligence and ongoing review.

09At a glance