Who decides?
Every AI system has a person in charge. AI helps people make decisions, but those decisions are made and signed off by someone with a name.
AI governance
We build custom software, and some of it uses artificial intelligence to optimise, predict or classify. Here we explain, without jargon, what AI governance is and the rules we follow to work safely, fairly and transparently.
What AI governance is
An artificial intelligence system learns from data and helps make decisions or generates content: it recommends, classifies, writes, predicts. It is very useful, but it does not think like a person, it can be wrong and it is not always easy to know how it reached a conclusion.
Governing AI means deciding in advance how it is used, within what limits and with what safeguards. In practice, it comes down to answering three questions well.
With what data?
We know where the data comes from, whether we are allowed to use it and whether it fairly represents the people it affects.
How is it corrected?
We measure the results, listen to anyone who spots a fault and have a procedure to fix it or switch the system off if needed.
A useful comparison: cars are not dangerous just because they exist, but driving without a licence, traffic rules or inspections would be. AI governance is the driving licence, the highway code and the roadworthiness test of intelligent systems.
Why it matters
AI amplifies what it is given. If the data or the design has a problem, the system repeats it thousands of times and at high speed. These are the risks we watch most closely.
Bias
A model trained on unbalanced data can treat certain groups of people worse without anyone intending it.
Convincing mistakes
Generative AI can make up data or references with complete confidence. It looks right, but it isn't.
Privacy and confidentiality
Entering personal or client information into the wrong tool can expose it outside the company.
Opacity
If nobody understands why a system reaches a result, nobody can explain, audit or correct it.
The EU Artificial Intelligence Act
Since 2024, the European Union has had the world’s first comprehensive AI law, known as the AI Act (Regulation (EU) 2024/1689). It does not ban artificial intelligence: it regulates it according to the risk it poses to people.
The more a system can affect someone’s health, safety or rights, the more requirements it must meet. These are the risk levels and how we handle them.
Unacceptable risk
Banned since February 2025
Uses considered a threat to people's rights.
- Examples
- Social scoring of citizens, manipulation that exploits vulnerabilities, emotion recognition at work or in schools.
What we do: We neither develop nor use this kind of system, and our policy says so explicitly.
High risk
Obligations apply from December 2027 (and August 2028 for regulated products)
Systems that can influence important decisions about people's lives. They must manage risks, use quality data, be documented and have human oversight.
- Examples
- Recruitment, credit approval, access to education, management of critical infrastructure.
What we do: If a client project might fall into this level, we analyse it with them before starting, to identify the requirements that apply and design the solution with them in mind from day one.
Limited risk
Transparency obligations since August 2026
Systems that people interact with or that generate content. The key is that users know they are dealing with AI.
- Examples
- Chatbots and virtual assistants, AI-generated text, images or audio, manipulated content that looks real.
What we do: When a solution we build interacts with people or generates content, we design it to clearly identify itself as AI.
Minimal risk
No specific obligations
The vast majority of AI applications. Following voluntary codes of conduct is encouraged.
- Examples
- Spam filters, code autocompletion, content recommendations, automatic ticket classification.
What we do: We still apply our usage policy and good practice in quality, documentation and security.
Timeline
The law applies in stages. In 2026 the EU approved the Digital Omnibus package, which postpones the high-risk obligations but keeps the rest of the timeline.
- Already in forceThe regulation enters into force
- Already in forceBans and the duty to train staff in AI
- Already in forceRules for general-purpose AI models
- Current stageTransparency obligations and general application
- Coming upNew bans (fake intimate images) and transparency for AI-generated content already on the market
- Coming upHigh-risk systems (employment, credit, education…)
- Coming upHigh risk built into regulated products
In Spain, the supervisory authority is the Spanish Agency for the Supervision of Artificial Intelligence (AESIA). This information is for general guidance and is not legal advice.
Our AI usage policy, in short
This is what it means in the daily work of everyone on the team when they use generative AI tools, such as coding or writing assistants.
What we do
- Use only the tools approved by the company.
- Review and understand everything the AI produces before using it, whether code, text or data.
- Check the figures, sources and references it provides.
- Say when content we deliver to a client has been produced with the help of AI.
- Report any strange, biased or unsafe result.
What we don’t do
- Enter personal data, passwords or confidential client information into unauthorised tools, or use one client's data in another client's project.
- Design solutions that replace people's judgement. AI helps make decisions; it does not make them.
- Deliver code or models without human review and testing.
- Pass off AI-generated content as if it came from a real person.
- Develop uses banned by the EU regulation, under any circumstances.
Frequently asked questions
What kind of AI models do you develop?
We don't build general-purpose models. When a client asks us for a model, we develop it specifically for them, combining their data with open data, and the result is for their use.
Do you use my data for other clients or projects?
No. Your data is used only for your project and is handled as agreed with you and in line with the General Data Protection Regulation.
Where does the open data you use come from?
From public sources whose licences allow their use, such as the open data portals of public administrations and research bodies. We check their origin and quality before adding them to a model.
How do I know if I'm talking to an AI?
We will always tell you. At UPintelligence you always deal with a person, and the solutions we build that interact with users are designed to identify themselves as AI.
Does AI replace your professionals?
No. We use it to automate repetitive tasks and save time, but the design, the review and the responsibility for the work remain with our team.
What should I do if I think an AI feature got something wrong about me?
Get in touch. A person from our team will review your case, explain how the result was produced and, if needed, correct it.
How often do you review this policy?
At least once a year, and whenever the regulations change or we adopt a new type of AI. The date of the last review is shown at the end of this page.
This policy was last reviewed in October 2026
Facing a complex challenge? Let’s talk.
Tell us about your context and we will tell you how we can help.