Empirical AI

AI Ethics

At Empirical AI, we use large language models and agentic AI workflows as advanced tools for document comprehension, evidence assessment, and compliance reporting. These tools are powerful reasoning engines capable of analysing complex regulatory and policy information at scale. Because they carry no inherent intent, consciousness, or judgement, the ethical obligation falls squarely on how we design, govern, and deploy them.

Our operational framework directly aligns with the voluntary Australian AI Ethics Principles to ensure that technology serves to augment business performance without introducing unseen risks.

1. Human agency and oversight

We firmly reject the notion that AI systems should automate critical corporate governance or executive decision-making. At Empirical AI, AI tools are deployed to surface insights, assess evidence, and expose latent compliance risks; however, final accountability remains distinctly human. Our solutions are purposefully designed with deliberate checkpoints, including confidence thresholds and human review gates, to ensure professional human expertise guides final actions.

2. Transparency and explainability

The Factory uses third-party foundation models as components within a structured, auditable assessment pipeline. While the underlying models are complex, our engineering practices ensure that every assessment output is traceable and explainable. For each finding, clients can see the source documents that were analysed, the control or obligation being assessed, the reasoning the system produced, and the verdict it reached. We present plain-language insights rather than impenetrable technical jargon, and every assessment decision can be traced from input evidence through to final report.

3. Accuracy and quality assurance

AI systems that comprehend and assess documents carry specific risks: they may misinterpret evidence, retrieve irrelevant information, or produce inconsistent results across similar inputs. We actively mitigate these risks through structured assessment workflows that constrain how the AI processes information, regression testing against authoritative reference datasets to measure and improve accuracy, continuous review of input data quality to ensure assessments are grounded in reliable evidence, and separation of assessment and reporting functions so that findings are independently synthesised. Our goal is evidence-based objectivity, and we measure ourselves against it.

4. Contestability and feedback

We ensure that any insight, rating, or assessment generated by our systems can be openly questioned, reviewed, and overridden by qualified human administrators. Our systems are iterative; if an assessment output proves inaccurate or misaligned, we maintain clear paths to correct the underlying assessment logic, prompts, reference data, and retrieval strategies that produced it. Every correction is version-controlled and auditable.

Data Security

Data security is the operational bedrock that makes privacy possible. In strict alignment with our responsibilities under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), Empirical AI implements multi-layered technical and organisational safeguards to ensure your organisational data remains protected, uncompromised, and entirely your own.

1. Encryption

To ensure that sensitive information is protected from unauthorised access, we utilise industry-standard cryptographic methods. All data handled by Empirical AI is encrypted both in transit, as it moves across the internet to our systems, and at rest, while stored securely within our infrastructure.

2. Infrastructure security

Our infrastructure is designed with defence-in-depth principles:

  1. Network isolation: Dedicated virtual private networks and security groups isolate client environments from unauthorised access. Operational environments are segmented so that a compromise in one layer does not expose another.
  2. Active monitoring: Continuous threat detection, secure network routing, and automated protections defend against malware and social engineering threats.

3. Access controls and audit

Access to data within Empirical AI is governed by the principle of least privilege. Employee access is restricted strictly to those who require it to perform specific, authorised technical operations. Authentication requires mandatory multi-factor validation and unique credential sets. We maintain append-only audit logs of system interactions to preserve a transparent and tamper-resistant audit trail.

4. Data minimisation and sovereignty

We only collect and process data that is explicitly necessary to fulfil our contracted functions and services. Furthermore:

  1. No data monetisation: Empirical AI does not sell, rent, licence or share client uploads, or data produced from them, as datasets or standalone assets. Reports and industry analysis may use only aggregated, de-identified insights that cannot identify a client or individual or reveal their original information.
  2. Responsible Factory improvement: Empirical AI does not use client uploads or personal information to train AI models. New data produced by the Factory may be used to train, test and improve the Factory only after it has been de-identified and aggregated so that no client or individual can reasonably be identified and the original information cannot reasonably be reconstructed.
  3. No cross-client access: Each client’s uploads and client-specific outputs are isolated from every other client. The Factory may learn from aggregated, de-identified patterns, but no client can access or identify another client’s documents, assessments, findings or confidential information.
  4. Safe destruction: When data is no longer legally or operationally required, we execute secure data-wiping procedures to permanently delete or irreversibly de-identify the information.

A note on transmission risk: While Empirical AI implements comprehensive defences to safeguard your information, no digital transmission over the internet can be mathematically guaranteed as 100% secure. We work transparently with our clients to establish secure transfer mechanisms, ensuring that data is handled with the appropriate shared security posture. If you ever suspect a vulnerability or unauthorised access, please notify our team immediately at admin@empirical-ai.com.