4.1. Introduction
This section outlines how we embed our core principles and ethical guidelines throughout the development process, to ensure that our models support accurate, reliable, non-biased decision making. It also sets out our approach to data privacy, security, risk controls, and documentation, as applied throughout model design, testing, deployment and maintenance.

4.2. Assessment Methodology
4.2.1. Interactive Testing
Our policy is to vet all AI systems through a combination of automated and subject matter expert valuation by human experts. Our human experts interact with the scenario as they would in a real-life scenario, allowing for dynamic responses and the decision making pathways to be evaluated and analysed in a similar setting to that which might be experienced by our clients. This process not only provides an essential check on the AI’s outputs but also instils a layer of critical human judgement, ensuring a high degree of accuracy and relevance. This process forms part of our pre-deployment quality assurance and ensures that outputs remain contextually appropriate, accurate and safe.
4.2.2. Large Sample Consensus Analysis
In situations where there isn’t a clear right or wrong answer, multiple automated systems and human experts can be used to see where the consensus lies, thereby determining the most likely correct response. Our policy mandates periodic, comprehensive assessments of our AI systems using statistically robust, representative test datasets, to yield meaningful insights into consistency, stability and fairness.
4.2.3. Close Scrutiny Analysis
We also deploy more intensive scrutiny of individual, randomly selected cases. Firstly, we deploy the AI in a testing environment with real-time oversight from human experts who can intervene and correct the AI in case of errors or unexpected behaviour. These results are then analysed and reviewed after the event, with alterations made to source code as appropriate. Models may only be deployed after passing quality verification, bias testing, robustness checks, and formal change-control approval.
4.2.4 Human Oversight During Deployment

CourtCorrect provides introductory onboarding and usage guidance relating to AI-enabled functionality. CourtCorrect does not supervise or manage Customer personnel, and the Customer remains solely responsible for ensuring that individuals overseeing AI-assisted processes are suitably trained, competent, and follow the Customer’s internal escalation pathways.
4.2.5 Change Control and Model Updates
CourtCorrect operates a proportionate, risk-based change-control process. Material model updates, significant performance changes, or modifications affecting risk classification require formal approval, documentation updates, and regression testing before deployment. Minor adjustments follow a streamlined review and testing protocol.

4.3. Bias-mitigation and Non-Discrimination
4.3.1. Data Quality
We maintain the highest standards for data quality as part of our general commitment to fairness and equity. All departments involved in the collection, processing, storage and use of data for AI model development adhere to our Data Quality Assurance Policy. We gather information from a wide range of diverse sources, ensuring it represents a broad spectrum of demographics. This diversity is crucial in training AI systems that are more equitable and less likely to perpetuate existing biases.
4.3.2. Ethical Model Framework
To support our efforts in ensuring the quality of data used in our AI systems, we account for the possible prejudices or bias in the way variables are measured, labelled or aggregated. We further ensure the integrity of our data evaluation framework by defining appropriate objectives, and considering risks posed by model deployment. We have implemented ICO best practices to develop our approach, which we continually iterate and improve upon according to industry best practice.
4.3.3. Minimising Dataset Biases
We run targeted bias and fairness tests using both qualitative and quantitative techniques, assessing disparate error rates, distributional fairness, and sensitivity analysis. Findings feed directly into model improvement cycles. Ongoing review of our bias-testing methodology ensures that new risks are identified and mitigated as the system evolves.
4.3.4. Upstream Testing
In addition to internal bias testing that is carried out on all core features, we also benefit from upstream testing carried out directly on both closed- and open-source foundational models we deploy. CourtCorrect conducts supplier due diligence, technical evaluation and contractual review of all third-party AI and cloud providers in line with EU AI Act Arts. 26–28, and UK GDPR. This includes assessment of provider safety practices, security controls, data handling, model behaviour, and update processes. Foundation model risks are documented and monitored throughout the lifecycle.
4.3.5. Engagement With Customers
We pursue a proactive approach to AI Safety, where we encourage customers to consider how AI might support minimising bias in their own processes. All AI outputs must be subject to client human review and must not be used as sole decision-making tools.. This approach underlines our commitment to ensuring that our AI solutions are part of a positive transformation towards greater justice and equality in decision-making.
4.3.6. Technical Documentation

CourtCorrect maintains technical documentation appropriate to the nature and risk level of each AI system, including a description of the system’s intended purpose, high-level design, key model components, and summary information about training and evaluation data (at an appropriate level of abstraction). Documentation also includes an overview of testing methods, performance characteristics, known limitations and safeguards. Documentation is kept up to date following any material changes to the system and supports CourtCorrect’s internal governance obligations and transparency requirements applicable to limited-risk AI systems. Where relevant and proportionate, CourtCorrect may provide clients with high-level documentation—such as model summaries or system behaviour descriptions—to support their regulatory or operational needs.

4.4. Data Privacy
4.4.1. Data Protection by Design
Data privacy is at the core of our data protection by design approach. We comply with UK GDPR by adopting and developing technical and organisational measures to implement data protection principles effectively. This includes data masking, access controls, encryption, and privacy-preserving design choices.
4.4.2. Data Minimisation
As part of our commitment to the principles of the UK GDPR, we adhere to data minimisation standards, to prevent the unnecessary processing and retention of PII. We achieve this by ensuring that only the minimum type of data necessary for the operation of the tool's various features is present in the system. This enables us to provide rationales for the processing or storage of PII for each specific features, for example:
● Final Response Letter (FRL) Generation: We require only the complaint details, and PII such as an individual's name to whom the letter is addressed to.
● Vulnerability Flagging: We require information pertaining to customer vulnerability, e.g. life events, capability, resilience.
● Root Cause Analysis: We require complaint details, and vulnerability data where these intersect in contributing to root causes. While the system will operate well with this data, it is generally recommended for clients to provide a holistic view of any complaint to the model, including any evidence associated with the complaint. Providing such information will further enhance model performance and also enables more granular root cause analysis reporting. We work closely with our customers to establish an open line of communication, meaning we can respond to specific concerns and requests regarding data processing. This is part of our commitment to ensuring transparency in respect of the functions and processing of personal data.

4.5. Data Security
4.5.1. Penetration Testing
Penetration Testing: CourtCorrect engages Cyberis, a specialist cybersecurity consultancy, to conduct penetration tests, which serve as a form of cyber attack simulation. These tests are designed to assess and enhance the company's readiness to react to cyber threats an incidents. Penetration testing effectively simulates real-world cyber attacks, allowing CourtCorrect to evaluate its defences and response strategies in a controlled environment. This approach is a proactive measure to identify vulnerabilities and ensure that the company's cybersecurity measures are robust and effective against potential cyber threats. We conduct annual Penetration Tests.
4.5.2. Automatic Security Checks

We use Snyk to conduct ongoing automatic security checks for technical vulnerabilities. The progression of remediation efforts is monitored and documented in writing, facilitating transparency and oversight. Each identified vulnerability is assigned a deadline for resolution, directly correlating to the level of risk it poses.
4.5.3. Data Loss Prevention (DLP) Methodology
Responsibilities are allocated according to our DLP methodology, delineating clear risk ownership and accountability within the organisation. The Data Security Officer (DSO) oversees the DLP strategy, ensuring compliance with relevant legislation and reporting to the executive management. Data Custodians are responsible for implementing DLP measures within their respective domains.
4.5.4. Risk Assessment Protocol
We conduct risk assessments on a regular basis, in alignment with industry best practices and regulatory expectations, to ensure that the risk posture is continuously understood and managed. The assessment takes into account the potential impact on the confidentiality, integrity, and availability of customer data, considering threats, vulnerabilities, and existing control effectiveness. For identified risks, we develop and document action plans, which are then prioritised based on the level of risk and business impact. We subject all third party providers to risk assessment procedures that match our internal standards, and select third parties carefully to ensure compliance with GDPR and other relevant regulations.