Legal

AI governance addendum

AI Team is operated by Akii Technologies, Ltd in DIFC. This addendum summarizes how AI Team governs managed Agents that use AI, automation, tools, and human oversight.

Version and owner

Effective 2026-06-25. Owner: legal-compliance. DIFC autonomous-system governance is treated as a first-class control for the operator.

Each live client Agent needs an AI system register.
The register must be linked to compliance profile, data class, model route, tool permissions, retention rule, and human-review decision.
Public claims about AI governance must match actual controls and evidence.

System register

The AI system register records the purpose, scope, data classes, tools, model route, autonomy tier, testing evidence, incidents, and stop rules for each client Agent.

Purpose and intended use must be narrow enough for operators and clients to audit.
Excluded regulated data is blocked from model routes.
Manual-review categories require documented rationale before go-live.

Human oversight

AI Team uses approval modes and escalation paths so humans remain accountable for consequential decisions and risky external actions.

High-impact HR, customer-facing claims, sensitive data, external messages, refunds, account changes, payroll-impacting summaries, and unclear policy require review unless specifically approved.
Humans remain responsible for decisions where required by law, contract, client policy, or AI Team approval rules.
Agents must pause or escalate when confidence, safety, cost, provider, or policy thresholds are crossed.

Model and tool controls

Model routes and tool permissions are approved by data class and Agent purpose.

LiteLLM aliases, provider routes, fallbacks, budgets, and evals are governed before production use.
Tool permissions must be least-privilege and tied to client-owned accounts or approved pass-through controls.
Provider moderation must not replace AI Team data classification, approval, safety, and QA controls.

Testing and incidents

Agent templates need evidence for tool use, structured output, outbound communication, hallucination/claim handling, prompt-injection resistance, and approval behavior.

Evals and QA evidence must exist before templates process personal data.
Incidents must record affected Agent, data class, provider/tool, mitigation, owner, next update, and corrective action where practical.
Model changes require quality, latency, cost, privacy, fallback, and safety review.

Next step

Need help applying this policy?

Start with setup so AI Team can confirm the work, required access, approval rules, pass-through costs, and go-live requirements.

Start setup Contact AI Team

Version and owner

Effective 2026-06-25. Owner: legal-compliance. DIFC autonomous-system governance is treated as a first-class control for the operator.

Each live client Agent needs an AI system register.

The register must be linked to compliance profile, data class, model route, tool permissions, retention rule, and human-review decision.

Public claims about AI governance must match actual controls and evidence.

System register

The AI system register records the purpose, scope, data classes, tools, model route, autonomy tier, testing evidence, incidents, and stop rules for each client Agent.

Purpose and intended use must be narrow enough for operators and clients to audit.

Excluded regulated data is blocked from model routes.

Manual-review categories require documented rationale before go-live.

Human oversight

AI Team uses approval modes and escalation paths so humans remain accountable for consequential decisions and risky external actions.

High-impact HR, customer-facing claims, sensitive data, external messages, refunds, account changes, payroll-impacting summaries, and unclear policy require review unless specifically approved.

Humans remain responsible for decisions where required by law, contract, client policy, or AI Team approval rules.

Agents must pause or escalate when confidence, safety, cost, provider, or policy thresholds are crossed.

Model and tool controls

Model routes and tool permissions are approved by data class and Agent purpose.

LiteLLM aliases, provider routes, fallbacks, budgets, and evals are governed before production use.

Tool permissions must be least-privilege and tied to client-owned accounts or approved pass-through controls.

Provider moderation must not replace AI Team data classification, approval, safety, and QA controls.

Testing and incidents

Agent templates need evidence for tool use, structured output, outbound communication, hallucination/claim handling, prompt-injection resistance, and approval behavior.

Evals and QA evidence must exist before templates process personal data.

Incidents must record affected Agent, data class, provider/tool, mitigation, owner, next update, and corrective action where practical.

Model changes require quality, latency, cost, privacy, fallback, and safety review.