Disclaimers

1. NOT A REPLACEMENT FOR AUDIT PROFESSIONALS

AssurAI assists internal audit teams but does not replace qualified audit professionals. The platform is a tool to augment — not substitute — the professional judgment, expertise, and accountability of licensed auditors, CPAs, CIAs, CISAs, and other qualified professionals.

AssurAI's AI-generated test procedures, findings, and recommendations are starting points for professional review, not final audit conclusions. All substantive audit decisions, conclusions, sign-offs, and opinions must be made by qualified human professionals.

Nothing in this platform constitutes professional audit, accounting, legal, regulatory, or compliance advice.

2. AI LIMITATIONS

AssurAI uses artificial intelligence — including Anthropic Claude, Google Gemini, and OpenAI GPT-4o — to analyse audit data and generate findings, recommendations, and summaries. AI systems have inherent limitations:

• AI-generated findings may contain errors, hallucinations, or incorrect conclusions.
• AI models may not have current knowledge of recent regulatory changes.
• AI responses can vary between sessions even for identical inputs.
• AI cannot exercise professional judgment, assess context beyond what is presented, or bear legal accountability.

All critical decisions should be independently verified by qualified professionals before reliance. Do not rely solely on AI-generated content for opinions issued to management, boards, audit committees, or regulators.

3. COMPLIANCE NOT GUARANTEED

Use of AssurAI does not guarantee compliance with SOX, PCAOB, SOC 2, ISO 27001, NIST CSF, COBIT, IIA Standards, GDPR, CCPA, BSA/AML regulations, FDICIA, or any other framework or regulation.

Users are solely responsible for:

• Ensuring their audit approach meets applicable professional and regulatory standards.
• Obtaining necessary approvals from their external auditors before using AI-assisted tools.
• Maintaining required documentation and work paper standards.
• Assessing whether AI-assisted procedures satisfy their specific audit requirements.

4. DATA SECURITY

AssurAI uses industry-standard encryption: AES-256 at rest and TLS 1.3 in transit, hosted on Supabase (PostgreSQL) and Netlify infrastructure.

However, no system is 100% secure. Users are responsible for:

• Assessing the sensitivity of data they upload to the platform.
• Complying with their organization's data classification and handling policies.
• Not uploading data that is prohibited by law, regulation, or internal policy from being processed by third-party AI services.
• Ensuring appropriate consent and legal basis for any personal data processed through the platform.

Evidence and audit files uploaded to AssurAI are processed by third-party AI APIs (Anthropic, Google, OpenAI). Review each provider's data processing terms before uploading sensitive data.

5. BSA/AML DISCLAIMER

The BSA/AML module in AssurAI provides informational guidance to assist bank internal audit teams in designing and executing BSA/AML audit procedures. This module:

• Is not legal or compliance advice.
• Does not constitute a SAR filing recommendation or regulatory opinion.
• Does not replace the BSA Officer's judgment or the institution's AML compliance program.
• Has not been approved or endorsed by FinCEN, the OCC, FDIC, Federal Reserve, or any other regulatory body.

Consult qualified legal and compliance professionals for all BSA/AML obligations. All SAR decisions must be made by the BSA Officer and qualified compliance staff.

6. LIMITATION OF LIABILITY

To the maximum extent permitted by applicable law, AssurAI Inc. shall not be liable for:

• Loss of data or audit evidence, however caused.
• Compliance failures, regulatory violations, or adverse audit outcomes.
• Errors, omissions, or inaccuracies in AI-generated findings, recommendations, or summaries.
• Third-party service outages (Supabase, Netlify, Anthropic, Google, OpenAI).
• Decisions made by users in reliance on AI-generated content.
• Indirect, incidental, consequential, special, or punitive damages of any kind.

AssurAI's total liability in any matter shall not exceed the fees paid by the customer in the 12 months preceding the claim.

7. THIRD-PARTY SERVICES

AssurAI integrates with and relies on the following third-party services. Data handling by these services is governed by their respective terms and privacy policies:

• Supabase — Database and file storage (supabase.io)
• Netlify — Application hosting and serverless functions (netlify.com)
• Anthropic — Claude AI API (anthropic.com)
• Google — Gemini AI API (ai.google.dev)
• OpenAI — GPT-4o API (openai.com)

AssurAI is not responsible for the availability, accuracy, or data practices of these third-party providers.

8. AUDIT COMMITTEE NOTIFICATION

Users are responsible for notifying their audit committees, boards of directors, and external auditors of their use of AI-assisted audit tools, including AssurAI. This includes disclosing:

• The nature of AI assistance used in audit procedures.
• How AI-generated content was reviewed and validated.
• Any limitations imposed on the use of AI tools by external auditors or regulators.

External auditors may have specific requirements regarding the use of AI-assisted tools in internal audit functions that support the external audit. Consult your external auditors before using AssurAI in work that may be relied upon by external auditors.