Deciding what I won't do

Most of the documents you write to set up a business are about what it will do. This one is mostly about what it won't. Before taking on a client — before there was a contract to attach it to — I wrote down how I'd handle their data, their intellectual property, and the risk that comes with putting AI into a working business. I wrote it early on purpose. I'd rather decide the boundaries when nothing is riding on them than improvise them mid-deal.

The interesting thing about the document is how much of it is subtraction.

On whose behalf

The first thing to be clear about is who is accountable for what. The client owns their data and owns every business decision. I act as the builder and advisor they engage — and when AI is part of what I deliver, it sits underneath a named human who stays responsible for the call. The model drafts, extracts, summarises, flags. It does not get to be the thing that decided. Keeping a person at the decision point isn't a limitation I begrudge; it's the design.

The parts I won't do

This is where the restraint lives, and it's deliberate:

• No AI that makes decisions about people — hiring, credit, eligibility, anything that affects someone's access to a service. That's the high-risk end of the spectrum, and I stay out of it.
• No training or fine-tuning on a client's data. Their data is used to do their work, and then it isn't used for anything else. The commercial AI tools I use don't train on submitted content under the terms I use them on.
• No client data in anything public — no demos, no portfolio, no examples. Sensitive material stays on controlled storage. A knowledge base I built for a personal project lives entirely on local disk and has never touched a repository; client work gets the same discipline.
• No selling AI for its own sake. If the honest answer to a problem is better process and no model, that's the recommendation.

None of these are reactions to something going wrong. They're decided in advance, which is the only time you can decide them cleanly.

Who owns what

The IP line is simple and worth saying out loud. The client owns what's built for them — the report, the workflow, the configuration, the deliverable — to use as their own. What I keep is the method: the frameworks, the templates, the underlying way of working that I bring to the next engagement too. A client buys the outcome and the right to use it, not exclusivity over how I think. Anything an AI tool generates as part of the work is assigned to the client with everything else; I don't treat "a model wrote it" as a reason to hold onto a client's work.

What this is, and what it isn't

It's a position, not legal cover. I wrote it; a lawyer hasn't reviewed it, and I haven't read every line of the EU AI Act it gestures at. When there's a real engagement, the specifics — data scope, IP terms, who processes what — get pinned down properly in that engagement, and this hardens into the kind of agreement that has teeth.

I'm saying that plainly because the more impressive version — "I have a compliance framework" — is the less true one. What I actually have is a clear, early, honest statement of where the lines are before anyone's asked me to draw them under pressure. For the kind of business I'd work with, I'd expect that to be the more reassuring thing anyway: not a policy bolted on after the fact, but evidence that the boundaries were thought about first.