AI use statement

Version 1.0 · July 2026. This statement codifies how Norma uses AI models. It is written as policy, not marketing: each commitment here describes how the product is built, and the Security page and subprocessor list carry the supporting detail.

1. What models are used, and for what

Norma calls two model providers through standard commercial API integrations, each for defined task classes:

• Anthropic (Claude models): answering questions in Ask Norma, narrating analyses and reports, classifying client email replies a person then confirms, and drafting document language.
• OpenAI (GPT models): extracting structure from uploaded contracts, evaluating contract risk against firm doctrine, and other structured extraction and classification tasks.

Calls are task-scoped. A request carries the inputs that task requires: a question and the audited figures that answer it, a contract's text or clause excerpts, a reply to classify. Norma does not send full database exports or the contents of unrelated files with a request.

2. No training on your data

Customer inputs and outputs are not used to train models. Norma uses Anthropic and OpenAI under their commercial API terms, under which customer content sent through the API is not used to train their models, and Norma has not opted into any arrangement that would change that. Norma itself does not train models on Customer Data.

3. Engines compute; models narrate

Every figure Norma computes is produced by a deterministic engine with a fixed, inspectable method, from the firm's own records. The models do not compute numbers. That split is architectural, not aspirational.

On the core answer surfaces (Ask Norma answers, report reviews, and fee memos), a model-written narrative is additionally validated against the underlying data before it reaches you: a stated figure that does not exist in the engine's decomposition causes the narrative to be rejected and rewritten, and an answer that cannot cite its source says so rather than guessing. Narrative text on other surfaces is generated from engine-computed inputs but does not yet run behind that validator; treat the prose as commentary and the engine figures as the record.

4. The human gate

No client-facing action happens without a person's approval. Collections follow-ups, statements, and other client-facing email exist only as drafts a person reviews and sends from the firm's own mailbox. The one write into an external system of record, the QuickBooks invoice push, requires a person's confirmation on each invoice. Nothing sends itself, and nothing files itself.

5. Provider retention, stated honestly

The model providers may briefly retain API inputs and outputs for abuse monitoring and operational integrity under their published terms. That retention sits with the provider, not with Norma, and firms with strict requirements should review each provider's current API terms directly. We name this rather than rounding it down to zero.

6. Changes

If the providers, the task classes, or the commitments above change materially, this statement's version and date change with them. The current subprocessor list, including the model providers, is always at norma-adi.com/subprocessors. Questions: hello@norma-adi.com.