ISPnext manages nextAI within an AI management system aligned with ISO/IEC 42001. This page describes the safeguards that apply and what this means for the use of nextAI.
General guidelines for the responsible use of nextAI, including human oversight and responsibilities, are described in the article nextAI - Responsible use of nextAI.
1. Intended use and boundaries
Each nextAI Capability is developed with a clearly defined purpose, target audience and scope. Before development begins, the following is established:
- who uses the Capability, for what purpose and with what expected outcome;
- which use is not permitted or falls outside the scope;
- which users, customers or processes may be affected by the output;
- what human oversight is required before the output is processed.
This definition forms the basis for all design decisions and acceptance criteria that follow.
2. Data protection during development
The following safeguards apply to data during the development of nextAI Capabilities:
- Prompts and customer data are not logged unnecessarily.
- ISPnext and Microsoft do not use customer data to train the generative AI models of nextAI. They process customer data in accordance with the contractual, privacy and security agreements.
- Per Capability, it is documented which data is used, what its origin is, how quality and integrity are safeguarded and who has access.
- When training data is not applicable, this is explicitly and substantively documented.
NextAI uses Microsoft Azure AI services within the Azure environment managed by ISPnext. Customer data is processed in accordance with the applicable contractual, privacy and security agreements.
3. Models and dependencies
ISPnext actively manages the AI models and technical dependencies on which nextAI is based:
- Model versions, providers and configurations are registered and maintained.
- Known model limitations are taken into account in design and communication.
- Changes to models are monitored and assessed for impact.
- The output of nextAI is validated; the system does not blindly trust model behaviour.
4. Testing before release
Before release, ISPnext tests the functioning, quality, edge cases and human oversight of each nextAI Capability. The Product Owner assesses the test results, open risks and required measures and makes the release decision. ISPnext records the tests performed and the decision.
The testing process covers at least the following categories:
- Functional: does the Capability do what was agreed, assessed against acceptance criteria.
- Quality: is the output sufficiently accurate, relevant and consistent, assessed using a test set and threshold values.
- Error and edge cases: what happens with unclear, incomplete or unusual input.
- Privacy and security: can data leak, be manipulated or be logged unintentionally.
- Human oversight: can the user recognise, verify, correct and if necessary stop the output.
Despite thorough testing, the output of nextAI may be incomplete, inaccurate or incorrect. Always verify AI output when using nextAI Capabilities before processing it or using it as a basis for decision-making.
5. Production acceptance
Before release, ISPnext assesses whether the required monitoring, corrective options and recovery measures are in place. The required measures differ per Capability. ISPnext handles a high or critical residual risk in accordance with the risk process.
6. Changes after production release
When an existing nextAI Capability is materially changed — for example through a new model, a new data source, a new target audience or a substantially different risk profile — the full assessment process is repeated before the change is taken into production. ISPnext publishes material changes in the release notes. If a change affects the use or responsibilities of customers, ISPnext informs the relevant customers through the usual customer communication channels.