Responsible use of AI.

1. Identification, scope and principles

ABBIAMO TECNOLOGÍA, S.A. (Abbitec; Abbiamo.ai brand) designs AIE agents (Autonomous Cognitive Intelligent Entities) to support business processes under defined instructions, permissions and sources. This policy governs the responsible use of the AI systems displayed on or accessible from the corporate website and describes principles applicable to products, without replacing contracts, data processing agreements or configurations agreed with each client.

Agents must be clearly identified as artificial intelligence, operate within a defined mandate and enable supervision, traceability and human escalation or rerouting in accordance with the client's rules. We follow ISO/IEC 42001, NIST AI RMF and, where applicable, the EU AI Act as design references, without thereby claiming certifications or universal legal compliance.

2. Abbie, Caddie and components

Abbie is an AIE agent designed to converse and execute actions within the configured mandate; Caddie supports the human agent and prepares operations so that the human agent can decide and authorize them. Abbi Studio allows instructions, context and controls to be defined; Abbi Actions are the permitted actions, Abbi Tasks the ordered sequences of actions and Abbi Flow the complete defined process.

Abbi PitWall is presented as a verification, diagnosis and improvement solution, not as an automatic certifier or regulatory auditor. Capabilities described as planned design or subject to a particular implementation will not be presumed available in every deployment.

3. Authorized source and no-invention rule

The response architecture approved by Abbiamo prioritizes: (1) the client's live databases; (2) the approved and current knowledge base; (3) connected applications; (4) expressly authorized official websites, only on an exceptional basis and under the rule requiring agreement among at least three sources provided for in the design; and (5) the configured route if no support exists.

Prices, balances, rates or contractual terms will not be taken from the open internet or from the model's memory as if they were authorized facts. When there is no sufficient supporting source, the agent must report the limitation and follow the configured route: a human agent or a rerouting process.

These are design rules that require testing and configuration in each implementation. The absolute elimination of generation or interpretation errors is not promised.

4. Transparency, decisions and supervision

In direct interactions, the agent will state that it is artificial intelligence and will not pose as a person. This criterion is consistent with the OECD transparency principle and takes Article 50 of the EU AI Act as a reference, to the applicable extent and scope.

The agent must not unilaterally approve, reject or condition loans, insurance, employment, benefits or other rights where the law requires the intervention of professionals or of a responsible human. The authorizations, profile-based limits, escalation and review mechanisms of each regulated entity must be respected.

5. Personal data and appropriate channels

The use of AI is subject to the Privacy Notice and to the applicable contractual data agreements. Principles of minimization, access control, information classification and limited retention will be applied; logs and histories must be managed in accordance with the approved policy and the instructions of the controller.

Medical records, credentials, complete identity documents, sensitive financial data or other confidential information must not be entered in open chats or forms. Commercial messaging, including WhatsApp when enabled, is not automatically authorized for sensitive data; such flows require a case assessment and an authorized channel with appropriate safeguards.

The use of identifiable conversations to improve or train third-party models will not be permitted without a legal basis and express authorization where required.

6. Traceability, testing and correction

Deployments must define which events, sources, actions and results are logged, how the logs are protected and who may consult them. Traceability and auditability are designed to provide verifiable evidence and to facilitate the correction of deviations.

Changes affecting rules, connectors or actions must undergo appropriate controls, risk review and human approval where appropriate. A reference to ISO/IEC 42001, NIST or European legislation is not equivalent to certification, a legal opinion or a guarantee of compliance.

7. Prohibited uses and responsibilities

It is prohibited to use AI for impersonation, fraud, unlawful discrimination, improper data collection, unauthorized access to systems, advice reserved for licensed professionals without the required supervision, or decisions incompatible with fundamental rights.

The client defines its purpose, business policies, sources and access; the partner implements and supports in accordance with the contract; Abbiamo provides the technology and technical support within its scope. The specific roles of controller, processor or sub-processor of personal data are determined by processing activity and contract.

Users must report incidents, incorrect responses or possible misuse through the established operational channel or, for the corporate website, through legal@abbiamo.ai when they involve privacy or compliance.

8. Review of this policy

This policy will be reviewed in the event of substantial changes to features, to the applicable regulations or to the processing architecture. Technical matters and specific service commitments will be documented in the contracts and annexes of each implementation.