Acutro
AI security & responsible use policy

Last updated: 16 September 2026Acutro Ltd (“Acutro”, “we”, “us” or “our”) is committed to developing and deploying artificial intelligence (“AI”) in our smart buildings Platform in a secure, responsible and trustworthy manner. This AI Security and Responsible Use Policy (“Policy”) sets out the principles and controls that govern our use of AI across the Acutro Platform (including predictive analytics, energy optimisation, occupancy insights, anomaly detection and asset performance modelling).This Policy applies to all AI systems and features provided by Acutro. It supplements (and does not replace) our Privacy Notice and Data Processing Addendum (DPA). Where we act as processor of customer data, our customers remain responsible for their own lawful basis, transparency obligations and any high-risk AI use cases they configure.

By using the Acutro Platform, you acknowledge and agree to the terms of this Policy.

1. Our AI principles

We follow the following principles, aligned with leading industry standards and applicable law (including the EU AI Act, UK GDPR and emerging UK AI regulation):

  • Security and robustness – We apply strong technical and organisational measures to protect AI systems from unauthorised access, manipulation or failure.
  • Privacy by design – Privacy and data minimisation are embedded from the outset.
  • Transparency and explainability – Where feasible and appropriate, we provide information about how AI features reach decisions.
  • Fairness and non-discrimination – We take reasonable steps to identify and mitigate unfair bias.
  • Human oversight and accountability – AI outputs are advisory; human review is required for material decisions.
  • Sustainability – AI is developed to support energy efficiency and net-zero goals in buildings.
  • Compliance – We comply with all applicable laws, including the EU AI Act classification of our systems (generally limited or minimal risk for standard smart-building use cases).

2. Security of AI systems

We implement commercially reasonable technical and organisational measures appropriate to the risk, including:

  • Encryption of data in transit and at rest;
  • Strict access controls and role-based permissions;
  • Regular vulnerability assessments, penetration testing and red-teaming of AI models;
  • Secure development lifecycle (including adversarial testing and model monitoring);
  • Logging and audit trails for AI decision-making processes.

However, no AI system, software or electronic storage method is 100% secure. We do not guarantee absolute security or that our AI features will be free from errors, interruptions or breaches. Use of AI outputs is at your own risk. You remain responsible for your own security configuration, credential management and review of AI recommendations before acting on them.

In the event of a security incident affecting AI systems, we will notify affected customers in accordance with our DPA and applicable law.

3. Transparency and explainability

For key AI features, we provide:

  • High-level descriptions of model purpose and data sources (available in the Platform documentation);
  • Where technically feasible, basic explanations or confidence scores for individual outputs.

Detailed model cards or technical documentation are available to enterprise customers upon request (subject to confidentiality obligations). We do not disclose proprietary model weights, training code or algorithms.

4. Human oversight and accountability

All AI-driven insights and recommendations in the Acutro Platform are advisory only. Customers and their authorised users must apply human judgment and professional expertise before taking any action (e.g., adjusting HVAC settings, maintenance scheduling or access controls). Acutro is not liable for decisions made solely on the basis of AI outputs.

We maintain internal governance (including an AI Review Committee) to oversee development, deployment and ongoing monitoring of our AI systems.

5. Data protection and use of customer data

AI features are trained and operate only on data processed in accordance with our DPA and Privacy Notice. Where possible, we use aggregated, pseudonymised or anonymised data. Once anonymised, such data is no longer personal data and may be used freely for product improvement, benchmarking and research (see DPA Section 11).

We do not use customer data to train foundational models without explicit written agreement.

Special category data is not processed in our AI systems unless expressly authorised in writing.

6. EU AI Act and regulatory compliance

Acutro’s standard AI features are designed to fall within the limited-risk or minimal-risk categories under the EU AI Act. Where any high-risk use case arises (rare in standard smart-building applications), we will implement additional controls and transparency measures. We monitor regulatory developments across EMEA and update our systems and documentation accordingly.

7. Third-party AI components

We may use vetted third-party AI models or sub-processors (listed in our DPA). All such components are subject to equivalent security and responsible-use obligations via contract.

8. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date will be revised. Material changes will be notified via the Platform or email where appropriate. Continued use of the Services after changes constitutes acceptance.

9. Contact us

Questions about this Policy or our AI practices should be directed to:

Acutro Ltd
5 White Oak Square
London Road
Swanley
Kent
BR8 7AG
United Kingdom

Email: hello@acutro.co.uk

For data subject requests or processor queries, please refer to our Privacy Notice and DPA.

This Policy is governed by the laws of England and Wales.