← Ataski · Trust & security · DPA · Subprocessors

AI Disclosure Statement — Cross-Cutting Policy

Last updated: 2026-10-02

Scope

This policy applies categorically, to every role that generates AI-drafted communications sent to third parties on a customer's behalf — by whatever channel (§C and the channel trigger below) — and to every such role Ataski ships in the future. It attaches to the capability, not to a list of roles.

A role is in scope the moment it can put an AI-drafted message in front of someone who is not the customer. No role is out of scope because it is new, renamed, merged into another role, or absent from an enumeration.

Why there is no list here. This document previously enumerated the roles in scope. Every enumeration in our legal and compliance corpus had rotted by 2026-07-14: this one still named a role that had been withdrawn from the Service, and one that was retired two months earlier and must never be reintroduced. A stale scope list in a document that governs our SB-1001 / CCPA notice-at-collection footers is not a typo — it is a defective compliance control, because it under-describes what the footers must cover. The categorical scope above cannot go stale.

The roles the Service currently offers are published on the workforce catalog (the canonical registry); the roles that Process personal data are named in the DPA, which derives that roster from the same registry rather than from prose.

Regulatory anchors

1. LLM-provider usage policy (contractual) — Anthropic Usage Policy (no presenting model output as human-generated; interactive AI must be disclosed to the counterparty). It binds Ataski for every recipient in every jurisdiction — it is the reason the AI sentence in §A is universal, not CA-gated.

2. California SB 1001 (Bot Disclosure) — California Business & Professions Code §17941. Requires disclosure when a "bot" attempts to incentivize a sale or influence a vote, used online with a person in California. Email outreach falls in scope.

3. CCPA / CPRA Notice-at-Collection — Cal. Civ. Code §1798.100(a)-(b). Requires notice at or before collection of personal information. B2B exemption expired Jan 1, 2023; business contact info from CA residents is in scope.

4. CAN-SPAM Act (federal) — already enforced in the existing outbound pipeline (verified sender, opt-out, physical address); not duplicated here.

5. EU AI Act, Article 50 (transparency) — Regulation (EU) 2024/1689. See §E for how Ataski's practice maps to it and which obligations sit with the customer as deployer.

Disclosure requirements

A. AI-assistance disclosure (UNIVERSAL — every recipient)

Every AI-drafted email sent to a third party MUST include one of the AI-assistance sentences, regardless of the recipient's inferred state or country (2026-08-07: the sentence was previously CA-gated; the provider usage policies in anchor 1 gate on nothing). The sentence has three variants, chosen by the dispatch path's truthfulness, never by geography:

• The "reviewed" variant: "This email was drafted with AI assistance and reviewed by [customer entity name] before sending." ONLY for paths where a human approval click is structurally guaranteed before dispatch.
• The "assisted" variant: "This email was drafted with AI assistance on behalf of [customer entity name]." The default — true on both operator-approved and automated sends. REQUIRED for any dispatch path shared between the approve click and an autopilot tick.
• The plain variant: "This email was drafted with AI assistance." For contexts where no customer entity name is available.

The sentence renders in the email's body language and is appended deterministically in code — never composed by the model, and never editable out by an operator.

Interactive surfaces carry the same duty: the support chat widget's byline discloses "AI assistant" as non-tenant-editable chrome copy, and the meeting bot's display name carries "AI note-taker".

A2. CA recipient-state inference (SB 1001 / CCPA branch only)

• US business address mapped to state via firmographic record → CA = inferred CA resident
• Public-profile location heuristic (if Bay Area / LA / SD / Sacramento mentioned) → inferred CA resident
• Conservative default for any US recipient with no firm location signal: treat as CA (over-discloses, no harm)
• The inference gates ONLY the CCPA notice-at-collection block (§B). It does not gate the AI sentence (§A).

B. CCPA notice-at-collection (CA recipients)

First email touch to an inferred CA recipient MUST include in footer:

• "Privacy: We collected your business email through public sources to send this one-time outreach. [Manage your data]" (link to the public opt-out page at /privacy/optout, pre-filled with the recipient's context)

C. Opt-out / unsubscribe (universal, CAN-SPAM + CCPA + CASL)

• Every email has one-click unsubscribe: the RFC-8058 List-Unsubscribe + List-Unsubscribe-Post headers on ALL sending transports (Ataski's transactional provider, connected Gmail, connected Outlook, connected SMTP), with a signed per-send unsubscribe URL that suppresses on the first click — plus the visible footer link
• Suppression propagates to all roles for the customer's workspace within 24h
• Customer cannot re-add a suppressed contact

Every outbound email record retains the recipient's inferred state and which disclosure variant was applied, for audit and compliance reporting.

Supervision

AI-drafted output may be reviewed by a second, separate AI model before or after it reaches a human. Ataski's supervision is tiered: routine, low-risk drafts run without a supervisor model; medium-risk work is re-read by the same model or a stronger one; the highest-risk work gets an independent adversarial review by a separate model, working from its own prompt. The worker and the reviewer are both operated by the same provider, Anthropic. Where the worker and the supervisor disagree on a high-stakes item, the item is routed to a human operator queue — there is no tiebreaker model, and no customer data is sent to any AI provider other than the one named in the Sub-Processors disclosure. This means content a customer processes through the Service is disclosed to that LLM provider, under the no-training, limited-retention terms stated there.

D. Live-meeting recording disclosure (wiretap-state two-party-consent)

Current status (2026-05-24). Live meeting recording (bot-join) is paused while we finalize per-participant consent capture. Manual transcript upload remains supported. When live recording is re-enabled, the consent-capture flow described below ships first; customers will receive 48-hour notice before re-enable. The disclosure text in this section describes the eventual flow — it is the contract every live-recording dispatch MUST honor once the feature is re-enabled.

Scope. Applies to any role that joins a live meeting on a customer's behalf — the capability, not a named role. Every meeting bot Ataski dispatches, under whichever role, is governed by this section.

Per-meeting consent capture (target state, gated behind the re-enable). When live recording is re-enabled and ANY participant is located in a two-party-consent US state OR the participant's jurisdiction is unknown (conservative default), the operator will be required to trigger pre-meeting consent capture before the bot is dispatched:

• The two-party-consent allowlist covers the approximately eighteen US states that require all-party consent: CA, CT, DE, FL, IL, KS, MD, MA, MI, MT, NV, NH, NJ, NY, OR, PA, VT, WA.
• Per-meeting flow: evaluate participants → send per-participant consent-request emails → record per-participant consent → only then dispatch the recording bot. The customer-facing consent page, the consent-token mechanism, the consent-request email, and the operator UI ship before the feature is re-enabled.
• The gate is total: empty / unknown participant list → consent required; one missing required consent → bot does NOT join.

Bot-join announcement (target state, gated behind the re-enable). Whether or not per-meeting consent is required, the recording bot's join surface will signal AI presence:

• Display name: <Customer entity> Recap Bot - AI note-taker.
• Verbal announcement at join, where the host platform supports TTS: "<Entity> Recap Bot is joining to draft a meeting recap with AI assistance. If you do not consent to being recorded, please object now or leave the meeting."

Customer-as-controller. Per the Terms of Service, the legal obligation to obtain consent under the destination-state wiretap statute runs with the customer. Ataski will provide the capture mechanism when live recording is re-enabled; the audit log and the export endpoint are live today. The customer's legal counsel owns the posture determination.

E. EU AI Act — Article 50 transparency

Article 50 of the EU AI Act (Regulation (EU) 2024/1689) sets transparency duties for certain AI systems, applying from 2 August 2026. This section states what Ataski does today against each duty that can touch the Service. It describes our practice; it is not a certification, and no regulator has assessed it.

• People interacting with an AI system (Art. 50(1)). Ataski's interactive surfaces say that the counterpart is an AI: the support chat widget's byline reads "AI assistant" and cannot be edited by the customer, and the meeting bot's display name carries "AI note-taker" (§A, §D).
• AI-generated text sent to people (Art. 50(2)). Every AI-drafted email sent to a third party carries the AI-assistance sentence of §A, appended in code and not removable by an operator. Ataski does not currently add a machine-readable marker (such as a watermark or a metadata header) to those emails; the disclosure is the human-readable sentence.
• Emotion recognition, biometric categorisation and deep fakes (Art. 50(3), 50(4)). The Service offers no emotion recognition, no biometric categorisation and no generation of images, audio or video.
• Customers as deployers. A customer that uses the Service in the course of its business is generally the deployer of the AI system under the AI Act. Obligations that attach to how the output is used — for example publishing AI-generated text to inform the public on matters of public interest (Art. 50(4)), or any disclosure required by the customer's own sector or member-state rules — are the customer's. Ataski keeps the §A sentence on every AI-drafted email so that the customer's recipients are told, but it does not decide whether, where or how the customer publishes other output.