[ Legal · Nomisma LLC ]

AI Transparency

Version v1 · Effective 26 October 2026 · Last updated 26 October 2026

This statement explains, in plain language, how Smartsteps uses artificial intelligence, what data the AI sees, how its results are checked, and where it can go wrong. It is provided by Nomisma LLC ("Nomisma"). Capitalised terms have the meanings given in the Terms of Service.

1. What AI Does in Smartsteps

Smartsteps uses large language models ("AI") for five tasks:

Evaluating obligations. For each legal obligation that applies to you, the AI reads the relevant parts of your policy documents and the evidence our crawler collected from your website, and decides whether the obligation appears to be met, partly met or not met, or whether it cannot tell. It explains its reasoning, quotes the clause or evidence it relied on, and, where something is missing, suggests a fix.
Second-opinion review. A separate AI review challenges verdicts from the first evaluation, looking for a credible reading under which the verdict would be wrong. Where it finds one, a final evaluation weighs both views against the evidence.
Labelling clauses. The AI labels the clauses of your documents by topic (for example, "data retention" or "cookies") so that each obligation is matched against the right text.
Writing summaries. The AI writes the plain-language summaries that appear in your Reports.
Wording practice checks. In the practice check (free at /check, or the Practices inventory in a Workspace) the verdict on each tool is decided by fixed rules from our vendor library and law database; the AI only explains that result in plain language and is not allowed to change it, and on the free check nothing you enter is stored.

2. What AI Does Not Do

Some parts of Smartsteps do not use AI at all:

Deciding which laws apply. Whether a law applies to you is decided by fixed applicability rules, based on your business profile and the markets you choose (for example, your revenue band, visitor counts, the data you collect, and whether you serve minors). The same inputs always produce the same result.
Observing your website. The crawler records what your website actually does: the cookies it sets, the third-party requests it makes, how its consent banner behaves, how it handles the Global Privacy Control signal, its forms (field names and types only), legal links, imprint details and accessibility checks, with screenshots. These records are collected by an automated browser, not generated by AI.
Making decisions about people. The AI assesses documents and websites. It does not make decisions about individuals.
Changing anything. The AI does not change your website or documents, submit forms, or contact anyone on your behalf.

3. Which Models We Use

3.1 Smartsteps uses Anthropic's Claude models through Amazon Bedrock, a managed AI service of Amazon Web Services, invoked from our AWS environment in the us-east-1 region (Virginia, United States). Amazon Bedrock may serve a request from another AWS region within the United States to balance capacity; requests are not routed outside the United States.

3.2 Nomisma may alternatively use Anthropic's own API as a fallback provider, for example if Amazon Bedrock is unavailable. Anthropic, PBC is listed as a conditional Sub-processor on the Sub-processors page for that reason.

3.3 We may change the specific model versions we use as models improve. A change of model may change results for the same inputs.

4. What Data the AI Sees

The AI receives the text of the policy documents you submit (including text extracted from scanned files), the crawl evidence collected from your website, the legal obligation being evaluated, and the parts of your business profile needed to evaluate it. The AI does not receive your password or payment details.

If your documents or website contain personal data, such as a contact name in a privacy policy or an imprint, that data may be included in what the AI receives. Please do not upload documents that contain more personal data than you need checked.

5. No Training on Your Data

Amazon Bedrock does not use customer inputs or outputs to train the underlying models. Nomisma does not use your documents, crawl evidence, Reports or any other Customer Content to train, retrain or fine-tune any AI model.

6. How Verdicts Are Checked

We use several safeguards to make results more reliable:

Fixed applicability rules decide which obligations apply, so the AI is not asked to guess whether a law covers you.
The obligation text is supplied to the AI. The AI is instructed to judge against the obligation text taken from Smartsteps' library of legal obligations, and not to add requirements from memory.
Evidence must be quoted. The AI is instructed to quote, word for word, the clause or crawl evidence its verdict relies on, so that you can check it against the source.
"Cannot determine" over guessing. Where the evidence is insufficient or the obligation is ambiguous, the AI is instructed to say it cannot determine the answer rather than guess.
Second-model review. A second AI review tries to overturn verdicts, and a final evaluation decides on the evidence where the two disagree.
Contested readings are shown. Where a law is open to more than one reasonable reading, or the reviews disagree, the Report says so rather than presenting a single answer as certain.

These safeguards reduce errors but do not eliminate them.

7. Known Limitations

Hallucination. AI can produce statements that sound confident but are wrong, including misquoting a clause, misdescribing evidence or misstating a law.
Outdated law. Results reflect the version of each law in Smartsteps' library when the evaluation ran. Laws change, and our library may lag behind new laws, amendments, guidance or court decisions.
Coverage. Smartsteps assesses only the obligations it covers. Anything outside that coverage is not assessed.
What the crawler could see. If a page was unavailable, blocked, behind a login, or behaved differently at the time of the crawl, the evidence may be incomplete.
Your inputs. If your business profile or market selection is inaccurate, the wrong obligations may be applied.
Variation. Running the same evaluation again can produce a slightly different result, particularly for borderline questions.

8. Human Review

Reports are produced by software. A person does not review your Report unless your Order expressly includes human review. Even where it does, Smartsteps is not a law firm and the review is not legal advice. Please review your Report with qualified counsel before relying on it. See the Legal Disclaimer.

9. Reporting an Error

If you think a finding is wrong, please tell us. Open Help in the Service (smartsteps.ai/app, then Help), create a ticket, and include the finding, the jurisdiction and why you think it is wrong. You can also write to info@nomisma.ai. We review error reports and use them to correct our library of legal obligations and improve our checks. Where an analysis failed because of a fault on our side, we will re-run it or credit you, as described in the Billing, Credits and Refund Policy.

10. Credits

AI evaluations consume your Workspace's monthly Credit allowance. When Credits run out, new analyses stop until the allowance renews. See the Billing, Credits and Refund Policy.