AI Use Policy

This policy outlines the principles governing the responsible use, development, and deployment of Artificial Intelligence (AI) within Axxemble and its products and services, including BaseFortify.eu.

We recognize the potential of AI to improve cybersecurity, vulnerability management, and information analysis. At the same time, we acknowledge the importance of transparency, human oversight, data protection, and responsible AI governance.

1. Responsible AI Use

Axxemble is committed to using AI responsibly, ethically, and securely. Our guiding principles include:

• Fairness and inclusiveness: Avoiding AI applications that could cause harm, introduce discrimination, or reinforce unfair biases.
• Transparency: Communicating clearly about the use of AI and its role in generating information or supporting decisions.
• Human oversight: Recognizing that AI-generated results can be inaccurate, incomplete, or misleading and should not replace appropriate human judgment.
• Privacy and security: Protecting personal, confidential, and sensitive information throughout the AI lifecycle.
• Responsible development: Evaluating AI systems for reliability, security, and potential misuse before deployment.
• Continuous improvement: Regularly reviewing AI applications, emerging risks, and relevant technological developments.

2. Accountability and Compliance

We aim to ensure that our AI applications operate within applicable legal, regulatory, and ethical frameworks.

Our approach includes:

• Complying with applicable legislation, including the EU AI Act and the General Data Protection Regulation (GDPR).
• Assessing security, privacy, and operational risks associated with AI systems and third-party providers.
• Applying appropriate technical and organizational measures to protect information against unauthorized access, disclosure, and misuse.
• Maintaining appropriate human oversight and accountability for AI-assisted processes.
• Monitoring AI-related security risks and investigating suspected incidents.
• Reviewing AI applications and their supporting services when significant changes or new risks arise.

AI-generated recommendations and assessments are treated as supporting information rather than independently verified facts.

3. Transparency, Privacy, and Human Oversight

We believe users should understand how AI contributes to the services they use and should be able to evaluate the reliability of AI-generated information.

Our commitments include:

• Clear communication: Providing appropriate information about AI-assisted functionality and its intended purpose.
• Data minimization: Limiting the information submitted to AI services to what is necessary for the intended task.
• Responsible data handling: Applying appropriate safeguards and retention practices to information processed through AI services.
• Human verification: Encouraging verification of AI-generated findings against authoritative sources, particularly where security or operational decisions are involved.
• User control: Providing alternatives to AI-assisted functionality where technically feasible and appropriate.
• Feedback and correction: Allowing users to report potentially inaccurate, misleading, or inappropriate AI-generated results.

We do not consider AI-generated information a substitute for professional judgment, independent verification, or appropriate security testing.

4. AI in BaseFortify.eu

BaseFortify.eu uses AI-assisted capabilities to support vulnerability intelligence, cybersecurity research, and the interpretation of technical security information.

These capabilities may include:

• Extracting and interpreting Common Platform Enumeration (CPE) information.
• Supporting the analysis and classification of Common Vulnerabilities and Exposures (CVEs).
• Generating explanations and contextual information about security vulnerabilities.
• Supporting natural-language questions and answers relating to vulnerability information.

AI-generated content may contain errors or omissions. Users should verify important findings against authoritative sources, such as the National Vulnerability Database (NVD), relevant security advisories, and vendor documentation.

AI-assisted vulnerability analysis should support, rather than replace, established vulnerability management processes and professional security assessments.

5. Approved AI Providers

Axxemble evaluates AI providers based on their security practices, data protection arrangements, reliability, transparency, and suitability for the intended application.

The following provider is currently used for AI-assisted functionality within BaseFortify.eu:

• Mistral AI: A European AI provider used to support functions such as CPE extraction, vulnerability analysis, and CVE-related questions and answers. Its European presence and AI technology offerings are relevant considerations in our provider selection process. Data processing locations, retention arrangements, and applicable safeguards are assessed according to the services and contractual arrangements in use.

AI providers are subject to periodic review. This list may be updated as services evolve, additional providers are approved, or existing integrations are discontinued.

6. Security Guidelines and External References

Our approach to AI security and governance is informed by guidance from recognized cybersecurity and data protection authorities, including the Dutch National Cyber Security Centre (NCSC) and the Autoriteit Persoonsgegevens (AP).

• NCSC Netherlands – AI veilig gebruiken in jouw organisatie: Practical guidance on responsible AI adoption, risk management, organizational accountability, and security controls.
• NCSC Netherlands – Beleids- en beheersingsrichtlijnen voor de ontwikkeling van veilige software: Guidance on secure software development, management, and governance.
• Autoriteit Persoonsgegevens – AVG-randvoorwaarden voor generatieve AI: Guidance on data protection requirements and the responsible development and use of generative AI.

These resources inform our security practices and are considered alongside applicable legal requirements and internal policies.

7. Policy Review

This policy is reviewed periodically and may be updated to reflect changes in AI technology, regulatory requirements, security guidance, and the AI functionality offered through Axxemble products and services.

Our objective is to use AI in ways that provide meaningful benefits while maintaining appropriate standards of security, transparency, accountability, and user trust.