Terms of Use.

These Terms of Use (“Terms”) are a contract between you and [Dutira legal entity name — to confirm] (“Dutira”, “we”, “us”), a company registered in England and Wales (company number [company number — to confirm], registered office [registered office address — to confirm]).

By using this website, running the FCA AI Governance Checker, signing in to the demonstration workspace, or accessing the Dutira AI Workspace under a subscription, you accept these Terms. If you are acting for a firm or other organisation (“Customer”), you confirm that you have authority to bind it, and “you” includes the Customer.

The website and the services are for business use by organisations and the people who work for them. They are not offered to consumers, and you must be at least 18 to use them.

Some parts of the service have additional terms that form part of these Terms: the Privacy Notice, the Cookie Notice, the Data Processing Agreement (for subscriptions), and the notices shown on the checker page. If a Customer has signed an Enterprise Agreement with Dutira, that agreement governs the Customer’s subscription and prevails over these Terms where they conflict.

Dutira provides software that lets regulated firms give their employees and AI agents access to approved AI models within a governed workspace, with policy controls, human oversight, monitoring and evidence. These Terms cover:

The website

The public pages at this domain, including resources, product descriptions and the enquiry form.

Free services

The FCA AI Governance Checker, which runs in your browser; and the demonstration workspace, a sandbox populated with a fictional firm and synthetic data.

Subscription services

The Dutira AI Workspace deployed for a Customer’s employees (the “Service”), with the governance functions described on the website, under an order form.

Product descriptions on the website distinguish what the Service does today from what is planned. Planned features are not promised and do not form part of any contract unless an order form says so. Screenshots and demonstrations use fictional data.

The website describes FCA publications and rules so that firms can see how the Service relates to them. It is not a legal information service, and nothing on it is legal or regulatory advice.

Subscription accounts are provisioned by the Customer’s administrators and, where configured, through the Customer’s identity provider using OpenID Connect. The Customer decides who may access its workspace and with which role; Dutira does not create end-user accounts for a Customer.

You must keep your credentials confidential, use the identity provider and multi-factor authentication your organisation requires, and tell your administrator and Dutira promptly if you believe an account has been compromised. You are responsible for activity under your account until you do.

Demonstration sign-in uses fictional personas and requires no credentials. Each visitor’s sandbox is separate from other visitors’ sandboxes and is deleted automatically after seven days.

Dutira may suspend an account that appears to be compromised or used in breach of these Terms, and will tell the Customer’s administrator when it does.

The free services are provided without charge so that you can evaluate Dutira. They are provided “as is”: we do not promise that they will be available, uninterrupted or error-free, and we may change, limit or withdraw them at any time. The checker allows one assessment per browser per day; registering lifts the limit and unlocks a more detailed report.

The demonstration workspace uses live AI models. Anything you type into it is treated exactly as a real request would be — checked by the gateway and, if allowed, sent to a model provider. Do not enter real personal data, client information or confidential material into the demonstration. It exists to show how the controls behave, and its data is deleted after seven days.

Paid subscriptions are provided under an order form that states the services, term, fees, user numbers, hosting region and any agreed service levels. Indicative pricing on the website is not an offer.

The Service routes requests to third-party language models. Model output is generated by statistical methods and can be inaccurate, incomplete, out of date, biased or entirely invented, including citations that do not exist. Dutira’s gateway checks requests and responses against the Customer’s policies; it does not verify facts.

You are responsible for reviewing output before relying on it or passing it on, particularly where it concerns a customer of the firm, a regulatory obligation, a financial decision or anyone in a vulnerable circumstance. The Service is designed on the basis that a qualified person remains responsible for every outcome.

Dutira does not warrant the accuracy of any model output and, subject to section 22, is not liable for decisions taken in reliance on it. Model providers’ own terms also apply to model output.

The checker is a rule-based tool. It compares your answers, and optionally keywords in a document you paste or upload, with ten governance areas drawn from the FCA’s October 2026 publication *AI in financial services: good practice and areas for improvement* and the Handbook rules and guidance behind it. It labels every reference as a rule, guidance, legislation or good practice; the FCA has said its good-practice examples create no new requirements.

The checker runs entirely in your browser. Your answers and any document you provide are not transmitted to Dutira or to any third party; the report you download is generated locally. Registering for detailed reports sends only the contact details you enter.

Findings are described as potential gaps with an indicative priority. They are not findings that a rule has been breached, they are not an audit, and they do not take account of your firm’s permissions, business model or existing arrangements beyond what you tell the tool. A compliance officer or adviser should review them before any action is taken.

By using the document feature you confirm that you are entitled to use the document for this purpose and that doing so does not breach any confidentiality obligation. Because the document never leaves your device, Dutira receives nothing and makes no confidentiality commitment in respect of it; your own device and browser security apply.

Dutira is not authorised, approved, endorsed or certified by the Financial Conduct Authority or any other regulator, and the Service has not been reviewed by the FCA. References to FCA rules and publications are provided to help firms map the Service to their obligations.

Dutira does not guarantee that use of the Service will make a firm compliant with any rule, guidance or law. Responsibility for compliance with the FCA Handbook, the Senior Managers and Certification Regime, the Consumer Duty, data protection law and every other obligation remains with the Customer and its senior managers. The Service provides controls, records and evidence that support those obligations; whether and how they are used is the Customer’s decision.

Statements on the website that a feature “supports”, “maps to” or “helps with” an obligation describe product design, not a legal conclusion.

The Customer is responsible for:

• configuring the Service for its own risk appetite — the policies, detectors, approved models, approval routes, thresholds and retention periods — and keeping that configuration under review;
• loading its own AI policies, courses and guidance; the demonstration content supplied with the Service is starting material and must be reviewed before it is relied on;
• deciding, as controller, the lawful basis, purposes and retention for workspace data and governance records, and carrying out any data protection impact assessment the law requires;
• provisioning, deprovisioning and authorising its users and administrators, and the roles and permissions they hold;
• the content its users submit to the Service and the actions its AI agents are permitted to take;
• its own regulatory applicability decisions, control mappings and sign-offs, including the review of any mapping the Service proposes;
• telling Dutira promptly of any security incident, unauthorised access or misuse it becomes aware of.

The Service records employee use of AI so that the Customer can evidence oversight. Before deploying it the Customer must satisfy itself that the monitoring is lawful, necessary and proportionate, inform its employees in a way that meets its obligations under UK GDPR and the ICO’s guidance on monitoring workers, consult staff representatives where appropriate, and complete a data protection impact assessment where the monitoring is likely to be high risk.

Dutira designs the Service to support proportionate monitoring — pseudonymised metadata by default, recorded reasons for content access, confidential incident routes, restricted line-manager views and a tamper-evident audit log — and describes what it records in the Privacy Notice. The Customer must not configure or use the Service for covert monitoring, for monitoring unrelated to AI governance, or in any way that breaches employment or data protection law.

As between the parties, the Customer owns all data its users submit to the Service and all records the Service generates about the Customer’s use (“Customer Data”), including prompts, responses, uploaded content, governance records, configuration and audit logs. Dutira claims no rights in Customer Data other than the licence below.

The Customer grants Dutira a non-exclusive licence to host, process, transmit, store and display Customer Data solely to provide, secure, support and improve the Service for the Customer in accordance with these Terms and the DPA. Dutira does not use Customer Data to train machine-learning models, does not sell it and does not disclose it except to subprocessors as the DPA allows or where the law requires.

Dutira may generate and use aggregated, de-identified statistics about use of the Service (for example the proportion of requests held for approval) that do not identify the Customer, its users or its clients, for capacity planning and product improvement.

The Customer can export its data through the Service’s export and evidence functions during the term, and may request return or deletion at the end of the term as the DPA provides.

The Service integrates with third-party model providers (currently OpenAI, Anthropic and Google). Requests are made from Dutira’s servers with credentials held on the server; users never receive provider credentials.

Use of each provider’s models is subject to that provider’s terms, usage policies and data-handling practices, which Dutira does not control. The Customer may use its own provider agreements and endpoints where the order form says so, in which case the Customer is responsible for those agreements.

Dutira may add, replace or remove models and providers as they become available or are withdrawn, and will give reasonable notice of a removal that affects the Customer. Provider outages, rate limits, policy changes and model behaviour changes are outside Dutira’s control; section 19 describes what Dutira commits to in those circumstances.

The Service lets the Customer register AI agents with the tools, connected systems, access levels, financial limits and approval thresholds each may use, and evaluates each attempted action against those controls, allowing it, holding it for a person, or blocking it.

The Customer is solely responsible for: the permissions and limits it grants; the accuracy of the agent register; the people it names as owners and approvers; the connection of any agent platform to the Service; and every action an agent takes in the Customer’s other systems. The Service records decisions; it does not execute actions in third-party systems, and in the current release actions are submitted to the Service for evaluation rather than intercepted automatically.

An agent that acts without first obtaining the Service’s decision, or that is given permissions wider than its approved use case, is a misconfiguration for which Dutira is not responsible. Dutira does not warrant that any agent will behave as intended.

You must not, and must not allow anyone to:

• use the Service or the website unlawfully, or to infringe anyone’s rights;
• submit content you have no right to submit, or that is defamatory, obscene, discriminatory or harassing;
• attempt to bypass the governance gateway, the Customer’s policies, rate limits or access controls, or to obtain provider credentials;
• probe, scan or test the vulnerability of the Service without written permission — responsible disclosure to [security contact email — to confirm] is welcome;
• reverse engineer, decompile or copy the Service except as the law permits;
• use the Service to build a competing product, or scrape the website at scale;
• use model providers in breach of their usage policies, including to generate malicious code, to deceive, or to make automated decisions about individuals without the safeguards the law requires;
• enter real personal data, client data or confidential information into the demonstration workspace.

Dutira may remove content, suspend access or terminate for a material breach of this section, acting proportionately and, except where urgency or the law prevents it, after notice.

Dutira and its licensors own all intellectual property rights in the Service, the website, the documentation, the demonstration content, the checker, and any improvements, including the rule sets, question sets and regulatory mappings Dutira has written. Nothing in these Terms transfers those rights. The Customer receives only the right to use the Service during the term in accordance with these Terms and its order form.

Content on the website may be read and shared for the purpose of evaluating Dutira. Articles and white papers may be quoted with attribution. Dutira’s name and logo may not be used without permission.

If you give Dutira feedback or suggestions, Dutira may use them without obligation; feedback does not include Customer Data.

FCA publications and Handbook text referred to on the website are subject to the FCA’s own terms and Crown copyright or FCA copyright as applicable. Dutira’s summaries are its own.

Each party will keep the other’s confidential information — information marked confidential or which a reasonable person would treat as such, including Customer Data, security information, pricing and non-public product details — confidential, use it only for the purposes of these Terms, and disclose it only to employees, advisers and subprocessors who need it and are bound by equivalent obligations.

These obligations do not apply to information that is public through no fault of the recipient, already lawfully held, independently developed, or required to be disclosed by law or a regulator (in which case the recipient gives notice where lawful). The Customer may disclose these Terms and Dutira’s security information to its regulators and auditors.

The obligations survive for five years after the Terms end, and indefinitely for Customer Data and trade secrets.

Each party will comply with UK data protection law, meaning the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025).

For data Dutira controls, the Privacy Notice applies. For Customer Data in the Service, the Customer is controller and Dutira is processor, and the Data Processing Agreement applies and is incorporated into these Terms for every subscription. The DPA’s subprocessor schedule lists the suppliers involved and the safeguards for transfers outside the UK.

The Customer warrants that it has a lawful basis for the personal data it submits and for the monitoring the Service performs, that it has given the notices the law requires, and that it will not submit special category or criminal offence data without an appropriate condition for processing.

Dutira will maintain the technical and organisational measures set out in Schedule 3 of the DPA and described on the Security & Trust page, and will not reduce their overall level during a subscription. Dutira will tell the Customer about material changes to the measures.

Dutira does not claim any security certification it does not hold. The Security & Trust page states which controls are in place, which are planned and which depend on the deployment, and Dutira will answer reasonable security questionnaires on that basis.

The Customer is responsible for the security of its own systems, identity provider, networks and devices, and for the actions of its users.

Fees, billing frequency, the initial term and renewal terms are set in the order form. Unless it says otherwise: fees are in pounds sterling, exclusive of VAT, invoiced annually in advance, and payable within 30 days of invoice; subscriptions renew for successive twelve-month terms unless either party gives at least 60 days’ notice before the end of the current term; and Dutira may increase fees on renewal with at least 90 days’ notice.

Dutira may charge interest on overdue amounts at 4% a year above the Bank of England base rate from the due date until payment, and may suspend the Service after 30 days’ written notice of non-payment while the amount remains unpaid. Fees are not refundable except as these Terms or the order form provide.

Model usage is billed as the order form describes — either included in the subscription, passed through at the provider’s rates, or paid directly by the Customer under its own provider agreement.

Dutira will use reasonable skill and care to keep the Service available and will give notice of planned maintenance where it is likely to affect use. Any availability commitment, response times and service credits apply only if set out in the order form or Enterprise Agreement.

Support is provided to the Customer’s named administrators by email during [support hours and channels — to confirm]. Support does not extend to the Customer’s configuration decisions, its regulatory questions or the content of model output.

Dutira is not responsible for unavailability caused by the Customer’s systems or identity provider, by a model provider or hosting provider, by the Customer’s breach of these Terms, or by events outside Dutira’s reasonable control (section 27). Where a model provider is unavailable, the Service will show the condition and, where another approved model is configured, allow it to be used.

Either party may terminate a subscription on written notice if the other commits a material breach that is not remedied within 30 days of notice requiring it, or becomes insolvent. Dutira may also terminate or suspend immediately where required by law or a regulator, or where continued provision would create a serious security risk.

Dutira may suspend access, in whole or part, where it reasonably believes the Service is being used in breach of section 13, where credentials are compromised, or where suspension is necessary to protect the Service or other customers, restoring access as soon as the cause is addressed and keeping the Customer informed.

On termination the Customer’s right to use the Service ends; Dutira will make Customer Data available for export for 30 days and then delete it in accordance with the DPA, unless the law requires retention; and each party will return or destroy the other’s confidential information. Sections that by their nature should survive (including confidentiality, intellectual property, liability and governing law) survive termination.

You may stop using the website and free services at any time. Dutira may withdraw them at any time.

Dutira warrants that it will provide the Service with reasonable skill and care, that the Service will perform materially as described in the documentation provided with the order form, and that it has the right to grant the licences in these Terms. If the Service does not conform, the Customer’s remedy is for Dutira to correct the non-conformity within a reasonable time or, if it cannot, to refund the fees for the affected period.

Except as expressly stated, all other warranties, conditions and terms implied by law are excluded to the extent the law allows. In particular, Dutira does not warrant that the Service meets the Customer’s regulatory obligations, that model output is accurate, that the Service is error-free, or that the free services will be available.

The Customer warrants that it has the authority and the lawful basis to use the Service for the purposes it uses it, including the monitoring of its employees and the processing of personal data.

Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, under section 2 of the Unfair Contract Terms Act 1977, or for any other liability that cannot lawfully be limited or excluded.

Subject to that, and to the extent permitted by law:

1. neither party is liable for loss of profit, loss of business or revenue, loss of anticipated savings, loss of goodwill, or any indirect or consequential loss, however arising;
2. Dutira is not liable for losses arising from the Customer’s reliance on model output or on checker results without the review these Terms require; from the Customer’s configuration of the Service; from permissions granted to AI agents or actions taken by them; from the Customer’s failure to comply with its own regulatory obligations; from the unavailability or conduct of a model provider; or from content the Customer or its users submit;
3. Dutira’s total aggregate liability to a Customer arising out of a subscription in any twelve-month period is limited to the greater of the fees paid by the Customer under the relevant order form in the twelve months before the event giving rise to the claim and £500;
4. Dutira’s total aggregate liability to any person in respect of the website and the free services is limited to £1,000.

A separate, higher limit for breaches of the data protection or confidentiality obligations may be agreed in an Enterprise Agreement. Each party must take reasonable steps to mitigate its loss. [professional indemnity and cyber insurance — to confirm].

By Dutira. Dutira will defend the Customer against any claim that the Service, used in accordance with these Terms, infringes a third party’s UK intellectual property rights, and will pay damages and costs finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, from model output, from the Customer’s configuration or combination of the Service with other systems, or from use after Dutira has provided a non-infringing alternative. Dutira may procure a licence, modify the Service, or terminate the affected part with a pro-rata refund.

By the Customer. The Customer will defend Dutira against third-party claims arising from Customer Data, from the Customer’s unlawful monitoring of its employees, from unauthorised upload of data the Customer had no right to process, from actions taken by the Customer’s AI agents, or from the Customer’s breach of section 13, and will pay damages and costs finally awarded or agreed in settlement.

The indemnified party must notify the other promptly, allow it to control the defence and settlement (not admitting liability on the indemnified party’s behalf without consent), and give reasonable assistance at the indemnifying party’s cost. These indemnities are subject to section 22, except for the Customer’s indemnity in respect of unlawful monitoring and unauthorised data, which is uncapped to the extent the law allows.

Dutira may update these Terms for the website and free services by publishing a new version with a new effective date. Material changes will be highlighted on this page. Continued use after the effective date is acceptance of the new version.

Changes to terms governing a paid subscription take effect at the next renewal, unless they are required by law or a regulator, or improve the Customer’s position, or the Customer agrees sooner. Dutira will give at least 30 days’ notice of changes affecting a subscription.

These Terms, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them, are governed by the law of England and Wales.

The parties will try to resolve any dispute first by discussion between appropriate managers, escalating to senior executives on request, within 30 days of written notice of the dispute. If that fails, either party may propose mediation under the Centre for Effective Dispute Resolution (CEDR) Model Mediation Procedure; neither party is obliged to mediate before issuing proceedings for an injunction or to protect intellectual property or confidential information.

Subject to that, the courts of England and Wales have exclusive jurisdiction to settle any dispute arising out of or in connection with these Terms.

Notices

Contractual notices must be in writing to [legal notices email — to confirm] (for Dutira) and to the Customer’s administrator email on the order form (for the Customer), and are deemed received the next business day.

Assignment

Neither party may assign these Terms without the other’s consent (not to be unreasonably withheld), except to a successor to its business on notice.

Force majeure

Neither party is liable for failure caused by events beyond its reasonable control, including failures of model providers, hosting providers or telecommunications; the affected party must use reasonable efforts to mitigate and resume.

Third parties

Except for Dutira’s licensors, no one other than the parties has rights under the Contracts (Rights of Third Parties) Act 1999.

Entire agreement

These Terms, the documents they incorporate and any order form are the entire agreement on their subject matter and supersede prior discussions. Neither party relies on any statement not set out in them, without excluding liability for fraud.

Severance

If a provision is unenforceable, it is modified to the minimum extent necessary and the rest remains in force.

Waiver

A delay in exercising a right is not a waiver of it.

[Dutira legal entity name — to confirm], [registered office address — to confirm]. Legal notices: [legal notices email — to confirm]. Privacy: [privacy contact email — to confirm]. Security: [security contact email — to confirm].