Bounded purpose
Document the task, intended users and situations where model output must not be used without an additional check.
Responsible AI practice
AI should help people act —
and remain governable
We define data, authority and autonomy boundaries before launch. In operation, we measure quality, track change and preserve the ability to stop, replace or safely bypass a model.
Controls are tailored to the use case, risk and jurisdictionOperating position
Not a promise of perfection,
but a verifiable control system
AI models are probabilistic. Reliability therefore comes from data, architecture, evaluation, human accountability and operations working together.
Evaluation in real context
Assess quality on the scenarios, documents, languages and failure modes that occur in the customer environment.
People retain authority
Material, irreversible or sensitive actions require explicit human approval unless a narrower rule has been agreed.
Change creates new risk
A model, prompt, knowledge base or tool change is assessed and regression-tested before release.
Data and models
Classify data first.
Then choose the environment
There is no universal ‘cloud first’ or ‘local only’ rule. Each project gets a matrix of data, processing purposes, locations, providers and authorised users.
Open and authorised material
Public documents, owned templates and data with confirmed rights of use.
May be used in an approved service subject to licences, copyright and provider terms.Internal working data
Policies, instructions, correspondence and other material with restricted internal access.
Only in an approved environment with role-based access, minimisation and defined retention.Personal and confidential data
Personal data, trade secrets and information subject to contractual or sector restrictions.
Only with a lawful basis and agreed safeguards such as masking, isolation, logging and export controls.Secrets and specially regulated data
Passwords, keys, payment credentials, state, banking, health and other protected information.
Not sent to general-purpose models. Any use requires a separately designed and approved protected environment.The final decision depends on purpose, source, contract, threat model and applicable law—not the category label alone.
Deployment options
Architecture follows
the constraints of the task
We choose the option whose data path, responsibilities, availability and lifecycle cost can be demonstrated—not simply the most fashionable option.
On-premises or isolated
The model, RAG, logs and integrations run on customer premises or in a dedicated environment without uncontrolled external exchange.
Private managed environment
A dedicated environment with agreed data regions, network routes, resilience and operating model.
Controlled cloud API
Used after reviewing prompt retention, training use, region, subprocessors, deletion mechanisms and other provider terms.
Human and AI authority
Automate speed,
not accountability
Autonomy follows the consequence of error. Authorisation is enforced by the target system, never delegated to a model’s text output.
Advice and drafting
AI searches, summarises, classifies or drafts. A user evaluates the result before using it.
Action after confirmation
AI proposes an operation and its parameters, while sending, publishing or changing data requires human approval.
Bounded automation
Suitable for reversible, low-risk operations inside explicit limits, with logs, monitoring and a stop mechanism.
Lifecycle
Control does not end
after the demo
Each stage leaves evidence: purpose statement, data matrix, evaluation report, release decision and monitoring plan.
Map the use case
Purpose, users, cost of failure, affected processes and accountable owner.
Set boundaries
Data, roles, tools, providers, prohibited actions and escalation conditions.
Measure
Test sets, accuracy, grounding, refusal, robustness, leakage and instruction attacks.
Authorise release
A responsible person accepts residual risk; limits appear in the interface and documentation.
Observe and change
Feedback, quality drift, incidents, versions and re-evaluation before changes.
The page language changes the regional reference set shown below, but does not determine applicable law. Project requirements are selected by countries of deployment and use, sector, data types and party roles. These are design references, not a claim that Virtek or the customer is certified.
Operational controls
What can be
seen, tested and changed
Controls vary with risk, while the baseline covers quality, access, telemetry, providers and safe failure.
Quality and regression
Maintain representative cases and criteria for correctness, grounding, completeness, safe refusal, security and latency. A change that degrades a critical measure needs an explicit release decision.
Logging and observability
Record model and workflow versions, tools, RAG sources, errors, latency and material actions. Mask or omit prompt content where full-text logs create unnecessary risk.
Data and tool access
Separate permission to call a model, read a source and perform an action. Tools receive minimum functions, limits and short-lived credentials; downstream systems re-check authorisation.
Model choice and replacement
Maintain a model and provider register, decouple application logic from one API and compare candidates on a common evaluation set. A version replacement is managed change.
Errors and hallucinations
Where possible, answers use verifiable sources and expose them to users. With insufficient evidence, the system should stop, show uncertainty or escalate to a specialist.
AI system security
Test prompt injection, leakage, unsafe output handling, excessive agency and dependencies. A model is not a security boundary and does not decide access by itself.
Errors and incidents
An undesirable output is
a process signal
A quality error, policy breach, leakage, unsafe action and provider outage need different response targets and corrective actions.
Capture
Record the use case, time, version, available telemetry and impact without further spreading sensitive data.
Contain
Disable the risky tool, route or version and move to a safe mode or human handling where needed.
Investigate
Identify whether the source is data, retrieval, prompt, model, integration, permissions, provider change or user action.
Correct and verify
Add a test, change the control, rerun regression and only then restore the capability.
Severity criteria, contacts, notification windows and accountability are defined in project documentation and the agreed support model.
Connected system
Responsible AI is
part of the engineering system
This page covers AI governance. General security, solution architecture and hypothesis testing are explained separately.
V / A
Trust and Security Center
Data protection, shared responsibilities, deployment, documents and reporting channels.
Open the Trust Center↗V / BEnterprise AI and private models
Architecture, RAG, integrations and AI delivery for a defined business use case.
Explore the service↗V / CVirtek Laboratory
Test benches, PoC, option comparison and reproducible evaluation before production.
Visit the laboratory↗Engineering reads
More depth without
repeating this page
Three practical guides expand on data boundaries, production RAG readiness and private-model infrastructure.
AI / READRead the guide↗AI / READRead the guide↗AI / READRead the guide↗
Private AI and corporate data
Where the security boundary lies and why on-premises hosting does not replace access control.
What to test before production RAG
Sources, permissions, indexing, retrieval quality, observability and knowledge-base updates.
How to size a server for a private language model
Workload, GPU, memory, storage, topology and performance testing in the real use case.
Feedback channel
Report an error, risk
or undesired action
Include the service or project, time, expected and observed behaviour. Do not place passwords, keys or other secrets in a general ticket. Active projects should use the agreed secure channel and incident priority.
This is a public description of our engineering approach. Specific guarantees, log content, retention, metrics, SLA, roles and applicable requirements are defined per project in contracts and project documentation.
Responsible launch
Start with the use case,
data and cost of error
We can help choose the environment, define AI authority, build the evaluation programme and prepare the system for managed operations.
Discuss the use case↗