What we are entitled to display, and how we govern the rest.

Most published governance language about artificial intelligence is written to be unobjectionable, which makes it useless for deciding anything. Two commitments are specific enough to be held to, so those are the two stated here.

The first is human oversight proportionate to consequence. Where a system's output affects a person's access to employment, credit, care or a public service, a human decision-maker must be able to see why the system produced that output, must hold the authority to override it, and must be expected to use that authority. Oversight that exists only to satisfy a policy is worse than none, because it distributes accountability without transferring it — the person named as the reviewer carries the responsibility for a decision they were never equipped to inspect.

The second is that we will say when a model is the wrong instrument. A significant proportion of what arrives scoped as an AI problem is a data quality problem, a process problem, or a decision nobody has yet been willing to make explicit. Naming that reduces the work we are engaged to do, which is precisely the point at which this commitment either operates or does not.

Where an engagement falls under a specific regime — the EU AI Act, sectoral regulation, or a client's own model-governance standard — the obligations are identified during scoping and written into the engagement, rather than treated as covered by a general assurance.

The evidence gate itself — define the claim, collect the evidence, validate the facts and dates, secure written permission, then publish — is set out in full on the clients and proof page.

• No certification, partner status or regulatory approval is stated without a current, verifiable credential behind it, published with its scope and date.
• No prior-employer name is used in a way that implies an individual's institutional experience is MENTARA's track record.
• Client, candidate and employee information is handled for defined and lawful purposes, and retained only as long as those purposes require.
• Third-party services and subcontractors are assessed according to the risk they introduce, before adoption rather than after.
• Incidents, complaints and control failures have documented response and escalation routes — including the ones that reflect badly on us.
• Policies and controls are reviewed as the company, the services and the legal obligations change, on review dates that are real rather than nominal.