Responsible AI

Last updated: 21 August 2026

We build AI systems for other organisations and we run them ourselves. This page says how, in enough detail to be checkable.

Principles

Vendor neutrality is the point. No platform pays us to reach a conclusion. Our recommendations are shaped by what fits the problem, and the MACH Alliance Tech Office contract is what makes that claim testable rather than aspirational.

A human owns every decision. We do not build systems that make consequential decisions about people without a person accountable for the outcome. If a design requires that, we say no.

You own what we build. Code, models, prompts, evaluation sets and documentation are yours at the end of an engagement. No part of a delivery is held back to create dependency.

The definition of good is written down. Most stalled AI projects are not failing on the model. They are failing because nobody wrote down what a correct output looks like, so nobody can prove one version is better than the last. We insist on that artefact before we build.

The models we use

We are model-agnostic and we choose per problem. In practice that includes Anthropic's Claude, OpenAI's models, Google's Gemini, and open-weight models including Llama, Mistral, Qwen and DeepSeek where self-hosting is the right answer for data residency or cost.

We do not use Grok, and we do not build with image or video generators for Fidget Labs' own materials.

No AI-generated imagery or video appears on this site. The illustrations in our articles are hand-drawn SVG. The photographs are ours.

Your data in an AI system we build

• Client data is not used to train third-party models. We use enterprise API tiers with training disabled, and we check that setting rather than assuming it.
• Data residency is a design input, not an afterthought. If your data has to stay in the EU, that constrains the model and the hosting, and we scope accordingly.
• We prefer the smallest system that works. Retrieval over fine-tuning, fine-tuning over a bespoke model, and no AI at all where deterministic logic is more reliable and cheaper.

Hallucination

Language models produce confident text that is sometimes wrong. This is a property of the technology, not a bug we can promise to remove.

Systems we build are designed on that assumption: outputs that matter are grounded in retrieved sources, checked against evaluation sets, and surfaced to a human where the cost of being wrong is high.

Our own tools are held to the same standard. The EU AI Act Risk Check runs a fixed, published rule set rather than a language model, precisely so its output is reproducible and auditable.

Fairness

AI systems reproduce the patterns in their training data, including the unfair ones. Where a system touches hiring, credit, access to services or anything else that materially affects a person, we treat bias testing as part of the build rather than a review at the end.

We will tell a client when we think a use case should not be automated.

Security

• Encryption in transit and at rest.
• Least-privilege access. Our own marketing site holds no credential capable of reading our customer database.
• Secrets in a managed store, never in source control.
• Dependency and vulnerability scanning in the build.
• Row-level security on data stores rather than trusting the application layer.

<a id="disclosure"></a>

Responsible disclosure

If you find a security problem in anything we run, tell us at hello@fidgetlabs.io. Include enough detail to reproduce it.

Safe harbour. If you act in good faith, give us reasonable time to fix the issue before disclosing it publicly, do not access or modify data belonging to anyone else, and do not degrade the service, we will not pursue legal action against you and we will credit you if you would like that.

Out of scope: denial of service, social engineering of our people or customers, physical attacks, and reports produced by an automated scanner with no demonstrated impact.

We aim to acknowledge a report within three working days.

Framework alignment

Our practice is shaped by the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001. We are not certified against ISO/IEC 42001, and we will say so plainly rather than implying otherwise.

Questions

hello@fidgetlabs.io.