Mission Grey – AI Code of Conduct
Version 1.3, September 2026. Owner: CEO. Reviewed annually and whenever the AI setup changes materially.
1. Purpose and scope
Mission Grey uses generative AI (large language models) to analyse geopolitical and geoeconomic risk for our customers. This code sets out how we use AI responsibly. It applies to every Mission Grey employee and contractor, and to every AI feature in the Mission Grey platform.
2. Principles
- AI informs, people decide. Our AI produces analyses and summaries for human users. It does not make decisions about people, and we do not sell it for that purpose.
- Every claim is traceable. Generated analyses cite the sources they are based on, so that users can verify them. Output without sources is not shown as fact.
- Customer data is never training data. Customer content (documents, chats, reports) is used only to answer that customer's own requests. We do not train or fine-tune models on it, and we only use model providers that contractually commit to the same.
- Customer data stays separated. Each customer's content is isolated from other customers, and AI features can only reach the data the requesting user is allowed to see.
- Be honest about limits. AI output can be incomplete, outdated or wrong. We say so in the product and in our terms, and we do not present AI analysis as more certain than it is.
- Fair and lawful. We analyse countries, industries, companies and events, not individuals. We do not build features that profile, score or discriminate against natural persons. We comply with the EU AI Act and GDPR.
- Secure by design. Model output is treated as untrusted input. AI agents get the minimum tools and data they need, cannot modify or delete data on their own, and cannot reach internal systems.
3. How we work
- Model choice. Every candidate model is benchmarked (
bench/) before it is used, and only models from the providers in section 4 are eligible. Within that set, the models behind a feature can change, be routed dynamically by task, or be offered to the customer as a choice. The providers, their hosting locations and their data-use terms are the stable commitment; individual model names are not. - Monitoring. AI calls are logged (volume, latency, errors, fallback use). Automated quality checks enforce source citations on generated reports. Problems are reviewed by the engineering team.
- Risk review. New AI features and material changes go through a short risk check before release: what data the feature can access, what it can do, how it can be misused, and whether the EU AI Act risk classification changes.
- Incidents. Harmful, misleading or leaked AI output is handled as an incident under our Incident Response Process.
- Customer control. Customers can ask us to disable AI features for their organisation and to delete content they have entered.
- People. Everyone at Mission Grey is briefed on this code when they join and when it changes.
4. AI providers
All models are used over an API. No provider trains or fine-tunes on Mission Grey or customer data.
| Provider | Hosting | Data-use terms |
|---|---|---|
| Microsoft Azure OpenAI (Global Standard deployments) | Data at rest in an EU region; requests may be processed in other Microsoft regions under Microsoft's DPA and Standard Contractual Clauses | No training on customer data; abuse monitoring per Microsoft's terms |
| Self-hosted open-weight model | Inside Mission Grey's own AWS environment (eu-north-1, Stockholm) | Nothing leaves our environment |
| AWS Bedrock | eu-north-1 (Stockholm) | No training on customer data; processed in region |
A change of provider is a material change of the AI setup and triggers a review of this document.
5. Regulatory position
Under the EU AI Act, Mission Grey is the provider of an AI system built on general-purpose AI models from third-party providers. Our use case (information and analysis for professional users) is not a high-risk use case under Annex III. We meet the transparency obligations that apply to us: users know they are interacting with AI-generated content, and generated analyses are marked as such — every AI page in the platform carries an "AI-generated · verify sources" badge that links to this document (served at /ai/).
6. Contact
Questions and concerns about AI use: the CEO, via the contact details on missiongrey.com.