AI Use and Human Oversight Terms

AI Use and Human Oversight Terms

These AI Use and Human Oversight Terms (the "AI Terms") govern Customer's use of AI Features in the Virtik platform. They are incorporated into the Terms of Service and Online SaaS Subscription Agreement (LEG-001) and into any Master Services Agreement or Order Form that references them. Capitalized terms not defined here have the meanings given in the Terms.

These AI Terms allocate responsibility for how AI output is used. They are not a description of model accuracy and they are not a warranty.

1. What Virtik AI Features do

1.1 AI Features apply machine learning, statistical and generative models to data available in Customer's Organization in order to produce decision support. Depending on Customer's Plan and configuration, this may include:

(a) classification or flagging of events, objects or conditions observed by Customer Systems;

(b) summarization of incidents, activity, communications or operational history;

(c) natural-language question answering over Customer's own operational records;

(d) narrative guidance, checklists or suggested next steps during an incident;

(e) prioritization or ranking of alerts, sites, or conditions;

(f) analytical summaries and trend descriptions.

1.2 AI Features assist a human operator. They do not replace one.

1.3 The specific AI Features available to Customer depend on Customer's Plan entitlements and on the capabilities Virtik makes generally available at the relevant time. Section 14.6 of the Terms applies: Virtik does not represent that any capability that depends on live camera media or an AI provider is available to Customer unless Customer's Order or the Service confirms that it has been enabled.

2. Probabilistic operation — what this means in practice

2.1 AI Features are probabilistic. They compute likelihoods; they do not determine facts. The same input may produce different Output at different times, and a change of model or model version may change Output characteristics.

2.2 Customer acknowledges that AI Features will produce:

(a) false positives — flagging something that is not what it appears to be, or is not present at all; and

(b) false negatives — failing to flag something that is present.

2.3 Both failure modes will occur in normal operation. The occurrence of a false positive or a false negative is not by itself a defect in the Service or a breach of these AI Terms or the Terms. This does not limit Section 20.7 of the Terms where the Service does not conform to the Documentation. Customer must design its operational procedures on the assumption that both will occur.

2.4 Output may be incomplete, out of date, internally inconsistent, or confidently expressed while incorrect. Generative Output in particular may state something that is not supported by the underlying data.

2.5 Virtik does not represent any accuracy rate, detection rate, false-positive rate, precision, recall or confidence calibration for any AI Feature, and no such figure stated by any Virtik representative, marketing material or documentation is binding unless it appears in an Order Form executed by Virtik.

3. Human verification is mandatory

3.1 Customer must ensure that a competent human being reviews Output before any consequential action is taken in reliance on it. For the purposes of these AI Terms, an action is consequential if it could reasonably affect a person's safety, liberty, employment, access rights, reputation, or legal position, or could result in contact with law enforcement or emergency services. This does not require delay of an emergency call.

3.2 Customer must:

(a) assign responsibility for reviewing Output to identified, trained roles;

(b) ensure those persons have the authority to disregard Output;

(c) ensure they have access to the underlying data on which Output is based, so that Output can be checked rather than assumed; and

(d) train them on the limitations described in Section 2.

3.3 Prohibited: exclusively automated critical decisions. Customer must not configure or use the Service so that Output alone, without human review, causes:

(a) any decision about an individual's employment, discipline, compensation, scheduling or continued engagement;

(b) revocation, suspension or granting of an individual's physical access rights;

(c) detention, restraint, pursuit, ejection or search of any individual;

(d) a report, referral or complaint to law enforcement or any other authority;

(e) the assertion that a specific identified individual committed a specific act; or

(f) any decision that applicable law requires to be made or reviewed by a human.

3.4 Where applicable law confers a right not to be subject to a decision based solely on automated processing, Customer is the party responsible for honouring it, because Customer determines how Output is used within its Organization.

3.5 Customer must retain a record of human review sufficient to demonstrate compliance with this Section where its own regulatory obligations require it.

4. Emergency limitations

4.1 The Operational Safety clause of the Terms (Section 14) applies in full to AI Features. In particular, AI Features are not an emergency detection, notification or dispatch service.

4.2 Customer must not rely on an AI Feature as its sole or primary means of becoming aware of an emergency, and must maintain independent procedures that function when the Service, an AI Feature, Customer Systems, connectivity or a model provider is unavailable or degraded.

4.3 AI Features may be unavailable, delayed or degraded without notice, including because a third-party model provider is unavailable, rate limited, or has changed its service. Degradation of an AI Feature is not a service outage of the Service as a whole unless an executed Service Level Agreement provides otherwise.

4.4 Virtik does not contact emergency services and does not guarantee the generation or delivery of any AI-originated alert.

5. Training and simulation limitations

5.1 Where AI Features are used in training, exercise, simulation or Virtual Site contexts, Output describes a modelled scenario and does not describe real conditions at any Site.

5.2 Customer must ensure that training and simulation content, including scenario data and synthetic incidents, is clearly distinguishable from live operational data within Customer's procedures, and must not present simulated Output as an actual event.

5.3 Completion of any training or simulation activity in the Service does not constitute certification, qualification, accreditation or licensing of any individual for any purpose, and Virtik makes no such representation.

6. Customer configuration responsibility

6.1 Customer configures which AI Features are enabled, which data they may access, which roles may see Output, and how alerts derived from Output are routed and escalated. Those are Customer's decisions and Customer is responsible for them.

6.2 Customer is responsible for the appropriateness of any threshold, sensitivity, zone, schedule or rule it configures, and for reviewing those settings when its sites, operations or obligations change.

6.3 Customer must not enable an AI Feature for a use case that is unlawful in the jurisdiction where the affected individuals are located.

6.4 Where Customer permits a third party to configure AI Features on its behalf, Customer remains responsible under these AI Terms.

7. Input data rights

7.1 Customer must have all rights, consents and lawful bases necessary for the data Customer submits to, or permits an AI Feature to access, to be processed for that purpose.

7.2 Customer must not submit to an AI Feature:

(a) data Customer is not permitted to disclose to a processor;

(b) special category or sensitive personal data, unless Customer has confirmed a lawful basis and any additional condition applicable to it;

(c) data subject to a contractual or statutory restriction incompatible with processing by a third-party model provider, where the relevant AI Feature uses one; or

(d) credentials, payment card data, or government identification numbers.

7.3 Customer acknowledges that where an AI Feature transmits inputs to a third-party model provider through a credential that Virtik manages, that transmission is a disclosure to a subprocessor, governed by the DPA (LEG-010) and disclosed in the Subprocessor List (LEG-009), and that where Customer connects its own provider account the provider acts for Customer under Customer's own agreement and is a Third-Party Service.

8. Output usage and rights

8.1 As between the parties, Output generated for Customer's Organization is treated as Customer Data.

8.2 Virtik makes no representation that Output is original, that it is free of similarity to output generated for another customer, or that it is protectable by intellectual property rights.

8.3 Output is not a legal fact. Output does not establish, and must not be represented as establishing:

(a) the identity of any person;

(b) that any person committed any act;

(c) the cause of any incident;

(d) compliance or non-compliance with any law, standard or policy; or

(e) the existence, absence or severity of any hazard or threat.

8.4 Customer must not present Output as an expert determination, a forensic conclusion, or evidence of a fact, and must not include Output in a submission to a court, regulator, insurer or authority without independent verification and clear identification of its automated origin.

8.5 Where Customer discloses Output externally, Customer must disclose that it was produced with automated assistance where required by applicable law or by the recipient's rules.

9. Model and provider dependencies

9.1 AI Features may depend on third-party model providers. Virtik may add, remove, substitute or upgrade model providers and model versions at any time, including where necessary for security, availability, cost or legal reasons.

9.2 Such a change may alter Output characteristics, latency, formatting or availability. A change made in accordance with this Section is not by itself a breach of the Terms or these AI Terms, and Customer is responsible for reviewing its configuration after a material change of which it is notified. This does not limit Section 20.7 or Section 21 of the Terms.

9.3 Model providers that process Personal Data are identified in the Subprocessor List (LEG-009), as Section 13.6 of the Terms provides, and changes that affect that processing follow the notice procedure in the DPA. Where Customer connects its own provider account, that provider acts for Customer under Customer's own agreement and is a Third-Party Service, as the Subprocessor List states.

9.4 Virtik does not warrant that any model provider will continue to be available, or that a given model version will remain accessible.

10. Security and privacy of AI processing

10.1 AI Feature processing is subject to the same tenant isolation controls as the rest of the Service. An AI Feature must not be configured or used to obtain data from another customer's Organization, and Customer must report any suspected cross-tenant exposure immediately to security@virtik.ai.

10.2 Virtik will not use Customer Data to train generalized or shared AI models offered to other customers without an express contractual authorization permitting that use, as stated in the Terms (Section 10.6). Virtik does not control or represent the data retention or training practices of a third-party model provider whose account Customer's Organization connects itself, and Customer Data sent to that provider is handled by it under Customer's own agreement with it. Where an AI Feature sends inputs to a model provider through a credential that Virtik manages, that provider is a Virtik Supplier, Section 19.1 of the Terms applies to its acts and omissions in relation to Customer Data, and Virtik makes no representation about the provider's practices beyond the commitments in the Agreement and the Subprocessor List.

10.3 Processing of personal data by AI Features is governed by the DPA. Retention of inputs and Output is governed by the Data Retention and Deletion Schedule (LEG-022).

10.4 Customer must configure role-based access so that Output containing personal data is visible only to those with a need to see it.

11. Prohibited biometric and inference uses

11.1 Customer must not use any AI Feature to perform, attempt or approximate:

(a) biometric identification or verification of an individual, including facial recognition, gait, voice or iris recognition;

(b) inference of emotion, intent, deception, aggression, mental state or propensity to commit an act;

(c) inference of a protected characteristic, including race, ethnicity, religion, national origin, disability, health status, pregnancy, sexual orientation, gender identity, immigration status, union membership or political affiliation;

(d) predictive assessment of whether a specific individual is likely to commit an offence; or

(e) persistent tracking of an identified individual across sites or over time for a purpose unrelated to a specific operational security incident.

11.2 Sub-section 11.1(a) does not apply where the capability is expressly enabled for Customer in writing by Virtik and Customer satisfies every condition in Section 8.3 of the Terms. Virtik does not enable biometric identification, verification or facial recognition by default or by purchase of a Plan, and does not represent that the Service performs biometric identification. A capability, setting or configuration option that the Service makes technically available, including a policy that an Administrator can record in the Service, is not enablement by Virtik in writing (Section 8.3 of the Terms).

11.3 The prohibitions in 11.1(b)–(e) are absolute and are not subject to enablement, because Virtik does not consider those uses appropriate for this platform regardless of local legality.

11.4 A breach of this Section is a material breach permitting immediate suspension under Section 17 of the Terms.

12. Reporting unsafe or incorrect Output

12.1 Customer must report to Virtik Output that is unsafe, discriminatory, harmful, or materially incorrect in a way that could affect an operational decision. Reports may be made to security@virtik.ai.

12.2 Reports should include the Organization, the AI Feature, the approximate time, and a description sufficient to investigate — and should not include personal data beyond what is necessary.

12.3 Virtik may investigate reports and may adjust configuration, models, prompts or availability in response. Virtik does not commit to a response time or to a particular outcome under these AI Terms.

12.4 Customer must not use a reported defect as a basis for continuing an operational practice that relies on the defective Output.

13. Relationship to other documents

13.1 These AI Terms supplement and do not replace the Terms, the Acceptable Use Policy (LEG-006), the DPA (LEG-010) or the Privacy Policy (LEG-002).

13.2 Where these AI Terms conflict with the Terms as to AI Features, these AI Terms govern, subject to the order of precedence in Section 26.11 of the Terms.

13.3 Language. These AI Terms are drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

Version history

END OF DOCUMENT