BnR360 AI Services and Responsible AI Addendum

1. Purpose, scope and precedence

1.1 This AI Addendum sets out how AI Features work, who is responsible for what, and the controls that BnR360 and Customer must apply. It supplements clause 13 (AI Features) and clause 14 (Third-Party Providers) of the Master Subscription Agreement.

1.2 For AI matters, this AI Addendum prevails over the Master Subscription Agreement except clauses 14, 30, 33 and 34, which this AI Addendum implements and does not reduce. A Product Addendum may impose a stricter rule for that Product, and then the stricter rule applies.

2. Additional definitions

2.1 “AI Act” means Regulation (EU) 2024/1689. “High-Risk Use” means a use of an AI Feature that Applicable Law classifies as high-risk or regulates as an automated employment, recruitment, evaluation or similar decision tool, including the uses listed in Annex III of the AI Act relating to employment and workers' management, and equivalents elsewhere.

2.2 “Human Reviewer” means a natural person with the competence, authority, time and information to review AI Output and the underlying material, and to disagree with the AI Output.

2.3 “AI Incident” means an event in which an AI Feature produced output that caused or is reasonably likely to have caused discrimination, serious harm, a breach of law or a serious malfunction.

3. Nature of the AI Services

3.1 The AI Features of every Product are decision support tools. They assist Customer's own staff, and do not make decisions for Customer.

3.2 BnR360 is not an employer, recruiter acting for Customer, hiring authority, procuring authority, evaluator, bidder, psychologist, lawyer, auditor, credential verifier or regulator, and none of the AI Output is advice of any such person.

3.3 Customer decides whether to use a feature, how to configure it, what to submit, which output to accept, and what decision to make.

4. How AI Features are delivered

4.1 BnR360 builds AI Features by combining its own software with models and services of AI Providers. The AI Providers BnR360 uses or may use are OpenAI, Google (Gemini) and DeepSeek. Some models may be run on infrastructure operated by Microsoft Azure or DigitalOcean.

4.2 AI Input is sent to an AI Provider, or to a model running in BnR360's cloud tenancy, processed, and the output returned. Different features, Products, languages and customers may use different providers, and BnR360 may route requests among them for cost, quality, availability, security or legal reasons.

4.3 BnR360 may add, replace or remove an AI Provider or model at any time, subject to clause 6.3 of the DPA for Subprocessor notice. A model change may change output, including scores and rankings, without any change by Customer.

5. Customer responsibilities

5.1 For each AI Feature that Customer uses, Customer shall:

• (a) decide whether the use is lawful in its jurisdiction, and not enable a feature where it is not;
• (b) ensure that a Human Reviewer reviews AI Output before it is relied on for a decision about an individual or an organisation;
• (c) give every notice and obtain every consent required before an individual is subject to an AI Feature;
• (d) check facts, citations, calculations, names, dates, qualifications, certifications and references in AI Output against authoritative sources;
• (e) set criteria, thresholds, weights, formulas, prompts and configurations that are lawful, job-related or procurement-related, and non-discriminatory;
• (f) train its staff on AI limitations, bias and review duties;
• (g) keep its own records of decisions and the reasons for them;
• (h) deal with requests, complaints, appeals and challenges from individuals and bidders affected by its decisions; and
• (i) stop relying on an AI Feature that it knows or suspects to be defective, biased or unlawful, and tell BnR360.

5.2 Customer is responsible for AI Input, including prompts, and for the effect of its configuration on AI Output.

5.3 Customer shall not use AI Output as the sole basis for a decision where Applicable Law requires meaningful human involvement, explanation, review or an alternative process.

6. Prohibited and restricted uses

6.1 Prohibited. Except for the NeuroHire Analysis Module on the conditions in NeuroHire Product Addendum, Customer shall not use an AI Feature to: infer emotions, personality traits or other protected characteristics; identify individuals by biometric data; engage in social scoring; exploit vulnerabilities of persons; manipulate persons through subliminal or deceptive techniques; or carry out any other practice prohibited by Applicable Law, including Article 5 of the AI Act. In particular, emotion recognition in recruitment, selection and employment is prohibited in the European Union under Article 5(1)(f) of the AI Act, and BnR360 does not make it available there. The NeuroHire Analysis Module is the only Product feature of this kind: it is disabled in the Restricted Territories defined in the NeuroHire Product Addendum and is otherwise subject to the conditions in that Addendum.

6.2 Restricted. The following uses are permitted only where Customer has lawful authority and has satisfied the legal conditions: automated screening or ranking of candidates; scoring of audio or video responses; evaluation of bids; monitoring of workers; use with persons under 18; use with special category data.

6.3 BnR360 may disable, geofence or limit a feature in any jurisdiction to prevent a prohibited or restricted use, or where it considers the legal risk unacceptable.

6.4 Technical availability of a feature does not mean that its use is lawful for Customer.

7. AI Input

7.1 Customer is responsible for having the right to submit AI Input and to have it sent to AI Providers, as clause 9.3 of the Master Subscription Agreement states.

7.2 Customer shall not include in AI Input data that a Product does not support, as clause 9.4 of the Master Subscription Agreement lists, or credentials and secrets.

7.3 Free text fields and prompts may be sent to AI Providers in full. Customer should not enter information into them that is not needed.

8. AI Output

8.1 AI Output is generated automatically and probabilistically. The same input may generate different output at different times.

8.2 AI Output may be wrong, incomplete, outdated, biased, offensive, infringing or misleading, may include invented facts, sources, quotations, legal rules, names or numbers, and may misread documents, speech, accents, scripts and formatting.

8.3 Scores, rankings and percentages are indicators of the output of a method based on the information available to it and the criteria configured. They are not a determination of suitability, eligibility, compliance, truthfulness, merit or performance, and are labelled in Products as requirement match, suggested score or similar to reflect that.

8.4 Customer owns AI Output generated from Customer Data as the Master Subscription Agreement provides, and is responsible for its use, publication and submission.

9. Accuracy, hallucination and prompt injection

9.1 BnR360 does not warrant the accuracy, completeness, fairness or originality of AI Output.

9.2 Documents may contain text that tries to manipulate an AI Feature, such as instructions hidden in a resume, RFP or bid. BnR360 may implement safeguards, but cannot guarantee that they will detect or stop every attempt. Human review is the principal control.

9.3 Optical character recognition, translation and transcription are error-prone. Original documents govern.

10. Bias and fairness

10.1 AI Features may reflect biases in their training data, in the documents analysed or in Customer's criteria, and output must not be presumed neutral.

10.2 Customer shall review its use of AI Features for adverse impact on any group, shall consider proxies for protected characteristics, and shall obtain any independent bias audit or impact assessment that Applicable Law requires, as set out in clause 25.

10.3 BnR360 will give Customer reasonable information that it holds about the intended purpose, limitations and design of an AI Feature to help Customer perform that review, as clause 20 describes.

11. Transparency and labelling

11.1 BnR360 will label AI-generated or AI-assisted content in Products in a way that indicates it was generated or assisted by AI, and will display the in-product notices described in Schedule A.

11.2 Customer shall not remove or obscure those labels and shall ensure that individuals and bidders are told when AI has been used, in the form that Applicable Law requires. Where Article 50 of the AI Act, or an equivalent law, imposes a duty to inform a person that they are interacting with an AI system, the duty rests on the Party that is the provider or deployer of that system under that law, as clause 19 allocates.

12. Training and use of data

12.1 BnR360 does not itself use Customer Data to train or fine-tune a general-purpose model that is made available to other customers.

12.2 BnR360 may use Customer Data to provide Customer-specific features such as retrieval, indexing, embeddings, search and knowledge libraries. Those features are not model training for other customers.

12.3 BnR360 may use Usage Data and de-identified, aggregated data to evaluate, test and improve the performance, safety and fairness of its Products.

12.4 AI Providers operate under their own terms. Some provide settings under which API inputs are not used for training by default. Unless the Order Form expressly provides, BnR360 does not warrant what any AI Provider does with data it receives, how long it retains it, or where it processes it.

13. Confidentiality and AI

Customer acknowledges that AI Input is disclosed to AI Providers under clause 27.3 of the Master Subscription Agreement, that this disclosure is necessary to provide the AI Features, and that BnR360 is not responsible for a Third-Party Provider's compliance with confidentiality duties, subject to clause 14.

14. Responsibility for AI Providers

14.1 Clause 14 of the Master Subscription Agreement applies to every AI Provider. In summary, and subject to the limits in clause 14.3 of that Agreement, BnR360 is not responsible or liable for the acts, omissions, errors, outputs, hallucinations, bias, outages, security incidents, data practices, unlawful acts, changes, suspension or discontinuance of an AI Provider or its model, or for any Third-Party Provider Event.

14.2 Customer acknowledges that this allocation reflects the fact that BnR360 does not develop, train or control the general-purpose models of AI Providers, and that BnR360 cannot predict or control their behaviour.

14.3 Nothing in this AI Addendum excludes responsibility that Applicable Law imposes on BnR360 directly, including any obligation of a provider or a processor under the AI Act, the GDPR or other law that cannot be excluded by contract, and BnR360 will perform those obligations. Where any such law makes BnR360 responsible for an AI Provider's conduct, clause 14.3 of the Master Subscription Agreement applies and Customer's remedies are as clause 14.4 provides.

15. DeepSeek and other providers with higher jurisdictional risk

15.1 Customer acknowledges that DeepSeek is a provider whose hosted services may be operated from, and subject to the laws of, the People's Republic of China, and that those laws may require disclosure of data to authorities.

15.2 BnR360 uses DeepSeek’s own hosted service for certain AI Features of GenRapide and NexGen RFP, and AI Input sent to it may be processed in the People’s Republic of China. BnR360 does not use DeepSeek for NeuroHire, and does not route personal data of candidates, employees or bidder representatives, or confidential bid information, to DeepSeek unless the Customer has enabled that routing in writing, in the Order Form, or in the Product configuration. A Customer may exclude DeepSeek in the Order Form.

15.3 Customer may require in the Order Form that no AI Input of Customer be sent to DeepSeek, or to any other named AI Provider, and BnR360 will use reasonable efforts to comply from the date it confirms in writing.

15.4 BnR360 will not store credentials for a Customer's own model keys except as a Customer supplies them for its configured use.

16. Provider terms, usage policies and safety systems

16.1 AI Providers may filter, refuse, rate-limit, log, review for abuse, or suspend access to AI Input, AI Output or BnR360's account. Those actions may cause a feature to fail or to produce no output.

16.2 Customer shall comply with the AI Providers' usage policies as they apply to Customer's AI Input. BnR360 may give Customer a summary of them on request.

17. Model and feature changes

17.1 BnR360 may change models, versions, prompts, scoring methods, retrieval methods and AI Providers. Customer has no right to a specific model unless the Order Form says so.

17.2 Where reasonably practicable, BnR360 will keep records identifying the Product version, scoring version and provider used for significant results in Products used for hiring or procurement, as a control. Not every provider exposes a precise model version, and BnR360 does not promise that it can identify one in every case.

18. Availability

AI Features depend on AI Providers' availability and capacity. BnR360 does not promise availability of any AI Feature or provider, and may substitute an alternative model whose output may differ. Clause 17 of the Master Subscription Agreement and clause 14 apply.

19. European Union: roles under the AI Act

19.1 Where the AI Act applies, the Parties intend that: BnR360 is the provider of each AI system that it places on the market or puts into service under its own name, other than a general-purpose AI model supplied by an AI Provider, whose provider is that AI Provider; and Customer is the deployer of the AI system in its use of a Product.

19.2 AI systems used for recruitment, selection, evaluation, promotion or termination of workers, and for the evaluation of candidates and tasks, may be classified as high-risk under Annex III of the AI Act. Whether a particular Product, feature and use is high-risk depends on its intended purpose and configuration. Where it is, the obligations that the AI Act places on providers and deployers of high-risk systems apply, as and when in force, on the dates that the AI Act and any amendment to it provide.

19.3 Obligations that the AI Act places on BnR360 as provider cannot be excluded or limited by this Agreement, and BnR360 will perform them. Obligations that it places on Customer as deployer cannot be excluded or limited either, and Customer shall perform them. Nothing in clauses 14 or 34 of the Master Subscription Agreement excuses a Party from a duty that the law imposes on it directly.

19.4 Article 50 duties are allocated as follows: BnR360 will design Products so that a person who interacts directly with an AI feature of a Product is informed of that fact, and so that synthetic content that the Product generates is marked in a machine-readable format, where Article 50 requires it of a provider. Customer shall ensure that individuals whom it directs to an AI-enabled interaction or whose emotions or biometric categories are processed (which is permitted only for the NeuroHire Analysis Module on the conditions in NeuroHire Product Addendum) are informed, and shall disclose deep fakes or AI-generated text published to inform the public on matters of public interest, where Article 50 requires it of a deployer.

20. BnR360 commitments as provider

20.1 To the extent that it is the provider of a high-risk AI system, BnR360 will, as the AI Act requires of it and in the manner and on the dates required: establish and maintain a risk management system; apply appropriate data governance; keep technical documentation; design the system to enable automatic recording of events; give instructions for use that include the system's intended purpose, performance, known limitations, human oversight measures and expected lifetime; design the system to enable effective human oversight; achieve an appropriate level of accuracy, robustness and cybersecurity; operate a quality management system; carry out the applicable conformity assessment and affix required marking; register the system where required; keep logs under its control; take corrective action; cooperate with competent authorities; and monitor the system after it has been placed on the market.

20.2 BnR360 will give Customer, on written request to support@bnr360.com, the information that Customer reasonably needs to meet its own obligations under Applicable Law, such as the intended purpose, the instructions for use, known limitations, the categories of data used, and the technical documentation summary that the law requires BnR360 to share. BnR360 may give it under confidentiality and is not required to disclose trade secrets, source code, model weights or proprietary information of AI Providers beyond what the law requires.

20.3 BnR360 does not warrant that any Product or feature has been classified, certified, assessed or registered in any way unless it states so in writing.

21. Customer's duties as deployer

21.1 Where Customer is a deployer of a high-risk AI system, it shall, as Article 26 of the AI Act and similar laws require: use the system in accordance with the instructions for use; assign human oversight to persons with the necessary competence, training and authority and the support they need; ensure that input data under its control is relevant and sufficiently representative for the intended purpose; monitor the operation of the system; inform BnR360 and the relevant authority where it has identified a risk or serious incident; keep the logs under its control for at least six months or any longer period the law requires; and cooperate with competent authorities.

21.2 Customer shall ensure that its staff and other persons dealing with the operation of AI Features have a sufficient level of AI literacy, as Article 4 of the AI Act requires.

21.3 Customer shall inform individuals subject to a decision taken or supported by a high-risk system, where the law requires, and shall comply with any right of explanation they have.

22. Workers and their representatives

Before putting a high-risk AI system into service at a workplace, Customer shall inform workers' representatives and the affected workers as Article 26(7) of the AI Act and national labour law require, and shall carry out any consultation or co-determination that national law demands. BnR360 does not do so on Customer's behalf.

23. Fundamental rights and data protection impact assessments

Where Customer is required to carry out a fundamental rights impact assessment under Article 27 of the AI Act, or a data protection impact assessment, it shall do so. BnR360 will give the help described in clause 10 of the DPA and clause 20 of this AI Addendum.

24. Logs and audit trail

24.1 Products used for hiring or procurement decisions will, where technically supported and depending on plan and configuration, record: the user, time and nature of significant actions; the version of the assessment or evaluation framework; the AI Feature and provider used; the AI Output; any manual change to a score or ranking with prior value, new value, user, time and reason; and the identity of the Human Reviewer and final disposition recorded by Customer.

24.2 A log is a record of what the system recorded. It is not a certification that a process was lawful.

24.3 Customer shall retain the records that Applicable Law requires of it, and shall not rely on BnR360 as its records custodian, as clause 9.5 of the Master Subscription Agreement states.

25. Bias audits and impact assessments

25.1 Where Applicable Law requires an independent bias audit, algorithmic audit, impact assessment or notice before an automated employment decision tool is used (for example New York City Local Law 144, the Colorado Artificial Intelligence Act as and when effective, California regulations on automated decision-making technology, and similar laws), Customer is responsible for commissioning and publishing it, and for the notices. BnR360 will give reasonable information about the tool that it holds and is permitted to disclose.

25.2 BnR360 does not warrant that any Product has passed or would pass any bias audit.

26. Rights of individuals

26.1 Individuals may have rights not to be subject to certain solely automated decisions, to obtain human intervention, to contest a decision, and to obtain an explanation, for example under Article 22 of the GDPR, Article 86 of the AI Act, Quebec's private sector privacy law, the Australian Privacy Act from 10 December 2026 and state laws in the United States. Customer, as the decision-maker, is responsible for those rights.

26.2 Where technically available, a Product will display the main factors and evidence that contributed to an AI recommendation. BnR360 does not promise a full explanation of the internal behaviour of a third-party model.

26.3 BnR360 will pass to Customer, and will help Customer respond to, a request that an individual makes to BnR360 about a decision in which a Product was used, as clause 9 of the DPA provides.

27. Human oversight standard

27.1 Human review must be meaningful. The Human Reviewer shall consider the underlying material, not only the AI Output; shall be able to depart from the AI Output; shall not merely confirm the score; and shall record the decision and the reason where Applicable Law or good practice requires.

27.2 Customer shall not configure a Product to issue a final rejection, disqualification, award or submission automatically on AI Output alone, unless the Product expressly supports that configuration, Applicable Law permits it, and the Parties have agreed in the Order Form.

28. AI Incidents

28.1 Each Party shall tell the other promptly if it becomes aware of an AI Incident that involves a Product. Customer shall report to support@bnr360.com with a description of the facts. BnR360 will review reports as clause 16 of the Master Subscription Agreement allows.

28.2 Where Applicable Law requires a Party to report a serious incident to an authority, such as under Article 73 of the AI Act, that Party shall do so, and the Parties shall cooperate to supply the information needed, subject to confidentiality and legal privilege.

28.3 Corrective action may include disabling a feature, changing a model, notifying other customers, or withdrawing a Product.

29. Other regions

Customer is responsible for AI-related law of each place where it deploys a Product, which may include, in Canada, the Ontario Employment Standards Act, 2000 job posting disclosure from 1 January 2026 and Quebec Law 25; in the United States, the laws referred to in clause 25; in the Middle East, the national AI strategies, ethics guidelines and data laws of the United Arab Emirates, Saudi Arabia and others; in South East Asia, the Singapore Model AI Governance Framework and national laws of Malaysia, Indonesia, Thailand, the Philippines and Vietnam; in Australia, the Privacy Act and Australian Consumer Law and voluntary AI safety guidance; and, in Pakistan, the National Artificial Intelligence Policy and the Prevention of Electronic Crimes Act, 2016. Schedule A to the Master Subscription Agreement, section A.2 to A.7, applies.

30. Suspension and corrective measures

BnR360 may suspend or modify an AI Feature, or require Customer to change its configuration, where it reasonably believes that continued use creates a material legal, safety, discrimination, privacy or security risk, or that Customer is in breach of this AI Addendum, without liability and with notice where practicable.

31. Responsible AI principles

BnR360 aims to design and operate its AI Features in line with the following principles. They are statements of intent, not warranties, and they do not create obligations beyond those in the Agreement and the law.

• Human accountability. People make decisions. AI assists.
• Fairness. Reasonable effort to detect and reduce unfair bias in features that affect people.
• Transparency. Clear labelling, honest descriptions of what each score measures, and no claim that a score proves suitability or compliance.
• Privacy. Collect and share only what a feature needs.
• Safety and security. Controls proportionate to the risk, and prompt fixes.
• Truthfulness. Tools that improve how real experience is expressed, not tools that invent qualifications or evidence.
• Accountability to law. Perform the obligations that the law places directly on us.

32. Regulatory change

AI law is changing quickly. BnR360 may update this AI Addendum under clause 43 of the Master Subscription Agreement and may restrict, redesign, or withdraw a feature, in whole or in a jurisdiction, to meet a change in law or regulatory guidance.

33. Liability

Liability under this AI Addendum is subject to clauses 14, 30, 33 and 34 of the Master Subscription Agreement to the extent permitted by Applicable Law. This AI Addendum does not make BnR360 the guarantor of any AI Provider or the AI Output, and creates no separate or unlimited liability.

Schedule A. In-product notices and controls

BnR360 will implement, in the relevant Product, notices and controls in substance as follows. The exact wording may change, and the controls depend on the Product and configuration.