Version: 1.1
Last updated: 13 October 2026
1. Introduction
Nostrion develops and delivers solutions based on artificial intelligence (AI) that help organisations process, find and use information efficiently. We believe that artificial intelligence should support people. This document describes how Nostrion approaches the development, deployment and management of AI systems and which principles guide this.
2. Our vision of AI
We use AI to help employees and organisations work more productively, make knowledge more accessible and reduce administrative burdens.
The following principles are central to this:
- AI supports human decision-making;
- The user always remains in control;
- Privacy and information security come first;
- Transparency and explainability are mandatory;
- AI is used responsibly and in accordance with European laws and regulations.
Nostrion designs its AI solutions on the basis of a European and transparent AI chain, so that organisations retain control over their data, AI models and infrastructure.
The user retains control over the output generated by AI and assesses it before it is used for decision-making or other important purposes.
3. Human oversight
Nostrion’s starting point is that AI supports human decision-making and does not replace it. Ultimate responsibility for decisions remains with authorised persons. Therefore:
- AI supports the user, but does not take autonomous decisions on the user’s behalf;
- The user remains responsible for the use of AI outcomes;
- AI answers can be checked, adjusted or ignored;
- AI solutions are designed with room for human assessment and correction;
- Where possible, we make visible which parts of a result have been generated by AI.
Human review and decision-making remain essential for legal interpretation, regulatory compliance, clinical or financial decisions and every other form of professional judgement.
4. Privacy and data protection
Protecting personal data and confidential information is an important part of our services. Nostrion commits to:
- Processing personal data only for agreed purposes;
- Not processing more data than necessary;
- Restricting access to data to authorised persons;
- Applying appropriate technical and organisational security measures;
- Complying with the General Data Protection Regulation (GDPR), the European AI Act and other applicable laws and regulations;
- Not using client data to train AI models, unless model training is explicitly part of the agreed services.
5. European data sovereignty
Nostrion is committed to maximum control over client data, AI models and infrastructure. That is why, in every layer that processes client data, we use exclusively services, infrastructure and technology partners that operate under European law for the processing of client data. This means, among other things:
- Hosting within the European Union, under European jurisdiction;
- Technology partners that operate under European law;
- Open-weight and transparent AI technologies, which we build on by choice;
- Solutions in which client data is not used for model training as part of the standard services. Where model training is part of a specific client assignment, the data used for it is used solely for that assignment.
Nostrion delivers AI solutions that enable organisations to retain control over their data and the way in which AI is applied.
6. Models
Our AI solutions combine several types of AI technology, including large language models, domain-specific models, workflow automation and retrieval-based knowledge systems.
We build on open-weight models by choice. Every model we use runs within European infrastructure, and client data is never sent to a model’s developer. Because the model landscape changes quickly, we continuously assess which models best fit each function.
Clients receive insight into how AI capabilities are integrated into their workflows. On request, we share which models are currently in use within our services.
7. Information security
Nostrion applies security measures to protect the confidentiality, integrity and availability of information. These measures include, among other things:
- Separate environments for each client;
- Access management and authentication;
- Encryption of data where appropriate;
- Logging, monitoring and auditing of AI systems where appropriate;
- Management of suppliers and sub-processors;
- Incident management processes;
- Workflow validation checks;
- Regular evaluation of security measures.
Nostrion maintains both an Information Security Management System (ISMS) and an Artificial Intelligence Management System (AIMS). The ISMS is certified to ISO/IEC 27001 and NEN 7510, and the AIMS is certified to ISO/IEC 42001.
8. Transparency
Nostrion is committed to transparency about the AI systems and AI functionality it develops and delivers. Therefore:
- We communicate clearly when AI functionality is used;
- We make clear which information or parts of a result have been generated wholly or partly by AI;
- We enable users to consciously assess, adjust or reject AI outcomes;
- We support users in the responsible use of AI;
- We are transparent about the role of AI within our solutions;
- We are transparent about the limitations of our AI solutions, including the possibility of inaccurate, incomplete or outdated output;
- We offer users and other stakeholders the opportunity to report inaccurate, unfair or undesirable AI output to us (see the contact details in section 11).
9. Responsible AI principles
The following principles form the basis for the development and deployment of AI systems and AI functionality within Nostrion.
- Human-centred
Our systems must support and empower people and help them achieve better results. - Transparency
Users must know when AI is used and what role AI plays in generating results. - Accountability
Nostrion is responsible for the design, management and governance of its AI solutions. Users remain responsible for decisions they take on the basis of AI outcomes. - Privacy by design
Privacy and data protection are built into our AI solutions from the design stage. - Security by design
Security is integrated into the development, implementation and management of AI systems. - Fairness and reliability
We strive for reliable AI outcomes and limit unwanted bias where possible. - Proportionality
AI is used only where it adds value and is appropriate to the intended purpose. - Continuous improvement
We continuously evaluate and improve our AI governance, security measures and processes on the basis of new insights, technological developments and changing legislation.
10. Laws and regulations
Nostrion follows relevant developments in the fields of privacy, cybersecurity and AI, including the European AI Act. Where applicable, we incorporate these developments into our governance, processes and services. Where relevant changes in laws and regulations or standards frameworks affect our services, we communicate these changes to our clients and users in a timely and proactive manner.
Clients remain responsible for their own regulatory compliance when they use AI systems, including our solutions.
11. Questions or comments
Do you have questions about our use of AI, privacy or information security, or would you like to report inaccurate, unfair or undesirable AI output? Please contact us at privacy@nostrion.com.