A trust center that answers the AI questions first
A buyer evaluating an AI product asks about the models behind it before anything else: which providers you use, whether customer data trains them, and who stays in the loop. Notice Labs puts those answers on one page, alongside the rest of your security posture.
From £39 a month. No sales call.
A generic security page skips the AI questions
Most trust centers were built before a buyer needed to ask about model providers. They cover access control and encryption, but say nothing about which AI vendors touch customer data, where those vendors are based, or whether prompts train anyone's model.
A security questionnaire from an AI-aware buyer asks for exactly that, plus whether a person reviews AI output before it affects a customer. Answering by email, case by case, is slower than a page that already has it.
How it works
- 01
List your model providers as subprocessors
Add each AI provider to your subprocessor list with its purpose and location, the same as any other vendor that touches customer data.
- 02
Publish the AI-specific controls
Choose from the controls library: no training on customer data without consent, a written AI use policy, review of AI providers as vendors, human oversight, and evaluation of new AI features before release.
- 03
Show ISO/IEC 42001 status, if you have it
Mark it certified, aligned or in progress in your compliance list, with a note, and publish the certificate as a document.
- 04
Gate the rest behind a request
Put a model card, a DPA addendum or an audit report up as a document. A requester gives their name, company and email, and your team approves or denies it.
Model providers, named and located
The Subprocessors tab lists every vendor that touches customer data, with its purpose and location. An AI provider goes in the same list, so a reviewer sees it without a separate question.
AI controls next to the rest of your security
The Security tab groups published controls by the question a reviewer asks. AI controls sit alongside access, data and foundations, each with a plain-language description of what you do.
What goes into an AI trust center
Four pieces, each doing one job for an AI-aware buyer, and two questions most of them ask.
- SubprocessorsYour model providers, listed with purpose and location like any other vendor.
- Security controlsAI use policy, no training on customer data, vendor review, human oversight and evaluation, alongside your other controls.
- Compliance certificationsISO/IEC 42001 status, shown the same way as SOC 2 or ISO 27001: certified, aligned or in progress.
- Documents on requestA model card, an AI addendum to your DPA, or an audit report, gated behind an access request.
- Is our data used to train AI models?How to answer the question every AI buyer asks first, with wording you can adapt.
- Do you have an AI use policy?What a reviewer wants to see behind a yes, and wording you can adapt.
What it doesn't do
Notice Labs doesn't audit, test or certify your AI systems, and it doesn't run bias testing or model evaluations for you. The AI controls describe what you say you do; you choose them and keep them accurate.
It's a place to publish what's already true about your model providers, your policy and your certifications, so a buyer's questionnaire has less left to ask.
Questions
Straight answers to what people ask before they set this up.
Do we need to list our AI model providers as subprocessors?
If a model provider processes customer data, list it the same way as any other vendor: name, purpose and location. That's usually the first thing an AI-aware buyer checks.
How do we show that customer data isn't used to train models?
Add the "No training on customer data" control from the library to your Security tab. It states the claim in plain language; you're responsible for it being accurate.
Is ISO/IEC 42001 required to have an AI trust center?
No. ISO/IEC 42001 is one line in your compliance list, shown as certified, aligned or in progress if you have a status to report. Most of an AI trust center is the subprocessor list and the AI controls, which don't depend on a certification.
What if a buyer wants more detail than the page gives?
Publish a model card, an AI addendum or an evaluation summary as a document, public or gated behind a request. A requester gives their name, company and email, and your team decides who sees it.
Can we turn off the AI controls if we stop using AI?
Yes. Controls are chosen individually, so removing the AI ones is the same as removing any other control.
Related reading
Answer the model questions before a buyer has to ask them.
From £39 a month. No sales call.