Responsible AI

Our principles

Human-centred. Our AI systems support and augment human decision-making. They do not replace professional judgement. Every Bullet AI product is an information and signposting tool — not a decision-making system. Decisions about care, support, or resources always rest with qualified human professionals.

Transparent. Users are always told when they are interacting with an AI system. Our products include clear disclosure of AI involvement, and our privacy notices describe how AI processes data. We publish an Algorithmic Transparency Statement explaining how Brava, our AI platform, generates responses.

Grounded in approved content. Brava uses a Retrieval-Augmented Generation (RAG) architecture. This means responses are anchored to curated, client-approved content — not generated freely from a general-purpose AI model. Every response is traceable to specific source material, significantly reducing the risk of AI hallucination.

Safe. All AI interactions pass through Bullet Armour, our proprietary safety middleware, which validates inputs and outputs in real time. This includes prompt injection detection, inappropriate content filtering, and content boundary enforcement. Safeguarding-aware escalation paths are configured for every deployment.

Fair. We test our AI systems for bias and fairness through a structured adversarial testing programme. Where evidence of discriminatory outputs is identified, it is treated as a critical incident requiring immediate remediation.

Accountable. There is clear, documented responsibility for AI decisions and outcomes at every level of our organisation. Audit trails are maintained for all AI-assisted processing activities. All interaction transcripts are available for human review.

Privacy-preserving. Our AI systems are built on the principles of data minimisation and strong security controls. Our enterprise API agreements with AI model providers prohibit the use of customer data for model training. Data is hosted on UK infrastructure, and we maintain full compliance with UK GDPR.

How we govern AI

Bullet AI holds ISO/IEC 42001:2023 certification — the international standard for AI Management Systems. This means our AI governance is independently audited against a recognised framework covering AI risk management, ethics, transparency, and accountability.

We also hold ISO/IEC 27001:2022 (Information Security Management) and Cyber Essentials Plus certification, and align with ISO 9001:2015 (Quality Management).

Our AI governance is led by a dedicated Chief AI Officer and Data Protection Officer, supported by documented policies, risk assessments, and regular internal audits. Key governance documents include our AI Management System Policy, AI Ethics and Responsible Use Policy, AI Risk Assessment, and Algorithmic Transparency Statement.

Human oversight

Human oversight is a design principle, not an add-on. In every Bullet AI deployment, all AI interaction transcripts are available for human review. Conversations meeting defined criteria are automatically flagged for review. Escalation to a human agent is always available. No automated decisions affecting individual rights are made without human involvement.

Continuous improvement

We monitor, test, and improve our AI systems on an ongoing basis. This includes structured adversarial testing, content quality reviews, incident tracking, and regular management reviews. When we identify issues, we document them, fix them, and learn from them.

We are committed to evolving our approach as AI technology, regulation, and best practice develop. If you have questions about our approach to responsible AI, please contact us.