Defined.ai’s Commitment to Ethical AI

At Defined.ai, AI governance operates as the operational backbone of its Responsible AI practice. First, a structured, end to end program embedded within the Integrated Management System (IMS). Second, an AI Management System (AIMS) that translates high level principles into enforceable, day to day controls. Through a system of documented policies, they govern the full lifecycle of data and AI assisted activities, from sourcing to decommissioning. This also includes standard operating procedures, risk registers, training requirements, audit trails, and incident response mechanisms to ensure governance is operationalized in consistent, repeatable workflows.

Within this model, Defined.ai acts primarily as a data partner, with clear accountability distributed across Legal, Privacy, Security, Data Governance and operational teams. This is reinforced through oversight, auditability, and continuous improvement. Critically, this governance framework also extends to contributors through safeguards like ethical sourcing requirements, AI training consent, supplier due diligence, and dataset provenance documentation. Individuals that provide data to us are treated transparently and fairly, with their rights, expectations and protections reflected throughout the lifecycle. Aligned with global regulations and international standards, this system ensures that Responsible AI is delivered as a living, auditable framework. Principles such as transparency, fairness, human oversight and accountability are not standalone commitments but are embedded into both internal operations and the contributor experience.

We use the EU’s General Data Protection Regulation (GDPR) as a gold-standard framework to ensure lawful personal data processing across jurisdictions.

Contributor data processing follows six main rules:

Lawfulness, Fairness, and Transparency
The lawful, fair, and transparent processing of personal data is fundamental to demonstrating accountability to supervisory authorities. To uphold these principles, we provide clear, accessible policies and communication mechanisms. These ensure that data subjects can understand how their data is processed, the scope of such processing, and their data protection rights.
Proactive and Preventive Approach
We adopt a proactive, rather than reactive, approach to data protection. It anticipates and prevents potential privacy risks before they arise by identifying threats to the rights and freedoms of data subjects and implementing measures to mitigate them. Security is embedded from the earliest stages of system and process design.
Full Functionality
We seek solutions that are both effective and efficient, balancing business objectives with privacy requirements. This is achieved through the systematic identification, assessment, and implementation of measures that ensure personal data is managed responsibly and in accordance with data protection obligations.
Embedded in Design
Privacy is treated as a core requirement throughout the entire lifecycle of systems and processes. It is integrated into the design, development and implementation of technologies and organizational practices, ensuring that data protection is not an afterthought but a foundational element.
End-to-End Security
To ensure comprehensive data protection, the organization applies security measures across the entire data lifecycle. Processing activities are carefully analyzed, and appropriate safeguards are implemented, including data minimization, pseudonymization, encryption, access controls, logging, decentralized storage, and both physical and logical data separation. Measures also include preventing unnecessary data correlation, enforcing storage limitations, and ensuring secure deletion once data is no longer required.
Data Protection by Default
As a second layer of protection, the organization applies a default data protection approach. Under this approach, appropriate technical and organizational measures are implemented to minimize the personal data processed—both in terms of the volume of data collected and the extent of its processing, accessibility, and retention period—in line with the defined purposes of processing.

To guide ourselves internally, our Integrated Management System’s dedicated Cybersecurity and Privacy Teams direct our inquiries, honor rights requests and protect the confidentiality, integrity and availability of information assets.
We have also appointed an external Data Protection Officer, who advises on data policies, conducts risk assessments and acts as the primary point of contact for regulators and contributors.

The relationship with our proprietary crowd platform members is managed through a Community Member Agreement, specific Terms of Use and a dedicated Privacy Policy, all of which must be accepted before working with us. Each job has its own Statement of Work and project-specific Transparency Sheet, where applicable.
Learn more about how our contributor first approach supports ethical data sourcing.