EN
Idioma · Language · Lingua
Built for whoever is accountable.
When several standards apply, we design to the most demanding one.
When several standards apply, we design to the most demanding one: if the European one asks for more than the US one, or the other way around, we build to the stricter one. In addition, in each country where we operate we apply its local law. When in doubt, we protect the integrity of the system rather than expose people.
Standards change. We monitor them continuously.
A compliance team permanently reviews the standards that apply in each country where we operate, in order of hierarchy:
- 1 · Constitution and international treaties
- The norm at the top of the hierarchy.
- 2 · Laws
- Personal data protection, AI, consumer protection and industry laws (banking, insurance, healthcare).
- 3 · Decrees and regulations
- Those that implement those laws.
- 4 · Regulators' provisions
- Circulars, resolutions and guidelines from financial, health or telecommunications authorities.
- 5 · Technical norms and standards
- ISO/IEC 42001, the NIST framework, PCI DSS and HIPAA.
- 6 · Each client's internal policies
- They add to all of the above.
Standards we follow from the design stage.
At Abbiamo.ai we build AIE agents (Cognitive Autonomous Intelligent Entities): artificial intelligence that converses, decides the next step and acts in each company's systems within a mandate. We build them for organizations that are held accountable: banks, insurers, healthcare systems, telecommunications, energy, mining, government and the BPOs that serve them. We don't adapt to regulation afterwards; we build from it. From day one, we design our products and services following the ISO/IEC 42001 standard and its AI management practices, and we have the evidence and documentation to back it up. We follow the NIST AI Risk Management Framework, take the EU AI Act as a reference standard, follow PCI DSS requirements for payment handling and HIPAA safeguards for health information, and follow the data protection regulations of each country where we operate. Each client's data and knowledge live isolated in their own environment. Every action by Abbie and Caddie is traceable, every conversation declares that it is an AI and every mandate has limits that the client defines and our platform enforces. And every answer is recorded with the source that backed it.
- AI management
- ISO/IEC 42001 and its AI management practices.
- AI risk management
- NIST AI Risk Management Framework (AI RMF), United States.
- AI regulatory reference
- EU AI Act.
- Payments
- PCI DSS requirements for handling payment data.
- Healthcare
- HIPAA safeguards (United States) for health information and, in Mexico, NOM-024-SSA3 for electronic health record information systems.
- Personal data protection
- GDPR (European Union), the Federal Law on the Protection of Personal Data Held by Private Parties (Mexico), LGPD (Brazil), Law 1581 (Colombia), Law 81 (Panama) and the equivalent regulations of each country where we operate.
- Financial sector
- The provisions of each market's supervisory authorities; for example, CONDUSEF collections rules in Mexico and the FDCPA / Regulation F in the United States.
- Ethical principles
- The UNESCO Recommendation on the Ethics of AI, the OECD AI Principles and the encyclical Magnifica humanitas (2026).
We follow these standards in building our products and services. When a client requires it, we make the corresponding documentation available.
Organizations that answer for every piece of data they process.
Voice, latency or languages can be copied in weeks. What can't be copied quickly is a product built from the ground up for organizations that are held accountable, with the evidence and documentation to back it up.
-
Accountable to
The bank, to its supervisor
Collections rules, verified identity and a record of what was agreed.
Banking → -
Accountable to
The hospital, to the health authority
Sensitive data under control and no medical advice.
Healthcare → -
Accountable to
The insurer, to its commission
Coverages and deadlines only from the insurer's system.
Insurance → -
Accountable to
The government, to its citizens
Current official information and the right procedure for every request.
Government → -
Accountable to
The corporation, to its auditor and its board
Every decision recorded and traceable back to its rule or its source.
All industries →
The rules of your industry.
In addition to the general standards, each industry has its own. Before every production deployment, the regulations applicable in the corresponding market are reviewed.
- Banking and financial services
- The provisions of each market's supervisory authorities; for example, CONDUSEF collections rules in Mexico and the FDCPA / Regulation F in the United States.
- Insurance
- Each country's industry regulations, reviewed before every production deployment.
- Healthcare
- HIPAA safeguards (United States) for health information and, in Mexico, NOM-024-SSA3 for electronic health record information systems.
- Telecommunications
- Notices of recording, transcription and AI assistance according to each country's regulations.
- Energy and utilities
- Each country's industry regulations, reviewed before every production deployment.
- Mining
- Each country's safety, environmental and labor regulations, reviewed before every production deployment.
- Government
- Transparency, data protection and citizen service regulations applicable to each institution.
- BPOs and contact centers
- The contractual clauses of each BPO client and the regulations of its industry.
We follow these standards in building our products and services. When a client requires it, we make the corresponding documentation available.
Compliance that can be checked.
-
Proof 1
Bounded mandate
You define what the AIE agent can do: with your partner you build the Abbi Tasks and the Abbi Flow from the «Actions» that Abbiamo.ai publishes. You can restrict them, never expand them. Everything is configured and audited in Abbi Studio.
See the mandate → -
Proof 2
Backed answers
Abbie answers only with what she can back up, in a fixed order: databases, knowledge base, connected applications and microapps and, only by exception, authorized official websites when at least three agree. If there is no backing, she says so and follows the configured route: a human agent or a rerouting process.
Why Abbie does not make things up → -
Proof 3
Full traceability
Every decision and every answer is recorded with its source and is auditable. We follow control A.6.2.8 of ISO/IEC 42001, which calls for logging AI system events throughout its life cycle, and we take as a reference Article 12 of the EU AI Act, which requires automatic logging in high-risk systems.
-
Proof 4
Always introduces herself as AI
Abbie always says she is artificial intelligence and never poses as a human. This is what Article 50 of the EU AI Act (which we take as a reference) and OECD principle 1.3 call for: whoever talks to an AI should know it.
-
Proof 5
Shared, explicit responsibility
It is clear what Abbiamo.ai protects and what the client controls: call recording, telephony and infrastructure.
See the division →
What your institution always decides.
An AIE agent does not approve, deny or set conditions on credit, employment or access to services on its own: it informs, records and escalates. The decision belongs to your company and remains explainable from its source.
-
Limit
Promises
It does not commit to amounts, deadlines or outcomes your company's system cannot deliver.
-
Limit
Ethical collections
Empathy, never pressure, threats or improper hours, according to each market's regulations.
-
Limit
Escalation
It hands over to a person when the user asks, when it detects vulnerability or when the case exceeds its mandate.
The references of our time.
We design following the UNESCO Recommendation on the Ethics of AI, the OECD AI Principles and the encyclical Magnifica humanitas (2026), which asks that all AI be able to account for its decisions and that it free people from repetitive work without taking away their place.
-
Reference
UNESCO
Recommendation on the Ethics of Artificial Intelligence.
-
Reference
OECD
OECD AI Principles.
-
Reference
Magnifica humanitas
A 2026 encyclical on safeguarding the human person in the age of artificial intelligence.
Our principles →
Compliance, security and data.
-
AI strategy
The why comes first
The belief, the six hows with their proof, what we sell and how to start with a first flow.
See the strategy → -
Security
Bounded, traceable mandate
«Actions» with limits no one expands, conversation locks, data isolated per client and change control.
See security → -
Data sovereignty
Your data, where your case requires
Four deployment levels, from the cloud to your premises, and five questions to choose.
See the levels →
Tell us what your regulator requires.
Your request goes to the partner assigned to your company.
Let's talk about your operations →or write to us at hola@abbiamo.ai