Terms of Service

These Terms govern the business-to-business relationship between Min Sone AS, organisation number 930 830 747 (“we”, “us”, or “our”), and the business customer identified in an order form (“Customer” or “you”). Consumer use is not offered unless we expressly agree otherwise in writing.

By accepting an order form, creating an account where electronic acceptance is enabled, or using the Service after being presented with these Terms, you confirm that you are authorised to bind the Customer. The order form, these Terms, the applicable Data Processing Addendum, and any expressly incorporated schedules form the Agreement.

“AI System” An AI system within applicable AI legislation, including the EU AI Act where it applies.

“Assessment” A structured evaluation of an AI System against the applicable version of the Sustain AI Index methodology.

“Auditor” A person or organisation authorised to review an Assessment under the Sustain AI Index auditor requirements.

“Customer Data” Data supplied by or generated for the Customer through use of the Service, including Evidence.

“Evidence” Information supplied for an Assessment, including answers and supporting records.

“Rating” The scored outcome for a defined AI System, scope, evidence set, and methodology version.

“Registry” The publicly accessible index of authorised published Ratings.

“Service” The Sustain AI Index website, business portals, assessment and rating functions, reports, Registry, and related services stated in an order form.

Sustain AI Index is an independent AI assessment, rating, and trust assurance service. A Rating is not a statutory certification, declaration of conformity, notified-body decision, regulator approval, accreditation, legal opinion, or guarantee of compliance with the EU AI Act, GDPR, or any other law.

A Rating may support governance, procurement, assurance, and compliance work, but does not replace the Customer’s own legal responsibilities or professional advice.

The Service may include evidence collection, regulatory classification, assessment, AI-assisted analysis, human review, auditor review, scoring, reports, remediation recommendations, dashboards, Registry publication, and monitoring. The applicable scope is stated in the order form and Assessment record.

We may map an Assessment to the EU AI Act, Norwegian implementation, GDPR, security frameworks, sustainability criteria, human-rights or fundamental-rights considerations, and other requirements expressly included in the methodology.

An Assessment may record intended purpose, provider or deployer role, risk category, relevant obligations, evidence reviewed, and limitations. We do not conclusively determine legal status for a regulator or court. If statutory conformity assessment, certification, or notified-body activity is required, the Customer must obtain it from a legally competent body.

The Customer is responsible for the legality, accuracy, completeness, relevance, and currency of Evidence and confirms it has the rights, permissions, and legal bases needed to provide it and instruct us to process it.

Do not upload passwords, access tokens, authentication secrets, payment-card data, unnecessary special-category data, children’s data, malware, or other highly sensitive information unless it is expressly required, lawful, and protected by an agreed procedure.

Every Rating is tied to a methodology version, assessment date, evidence cut-off, defined system and scope, and recorded approval. We may change the methodology prospectively.

A material methodology change does not retroactively alter a completed Rating unless the Customer requests reassessment or we identify a material error, fraud, regulatory change, or another trigger that makes continued publication misleading.

We may use automation or AI to assist with extraction, classification, consistency checks, scoring recommendations, or report generation. Unless an order form expressly states otherwise and the applicable legal model permits it, an authorised human must approve the final Rating.

We do not use Customer Personal Data or Evidence to train or fine-tune general-purpose or third-party AI models unless separately agreed in writing and supported by an appropriate legal basis.

Unless the order form states otherwise, a Rating is valid for 12 months from the assessment date. It may be suspended, expired, withdrawn, or superseded earlier following a material system or intended-purpose change, material incident, material Evidence inaccuracy, methodology correction, or relevant regulatory development.

A Rating describes the defined assessment at a point in time and does not predict future compliance or performance.

Publication is optional unless expressly included in the order form. Only defined Registry fields may be published. Evidence, source documents, security architecture, vulnerabilities, confidential information, and unnecessary personal data are not published.

A Customer may request correction of factual inaccuracies. Limited historical records may remain where necessary to preserve Rating integrity, subject to privacy and other applicable law.

The Customer may appeal a Rating within 30 days after issue or after discovering a material factual error. The appeal must identify the disputed finding and provide supporting Evidence. We may conduct a factual correction, methodological review, or independent reassessment and may mark the Rating as under appeal.

We may suspend or withdraw a Rating where Evidence is materially false, the assessed system materially changes, a serious incident occurs, or continued publication would be materially misleading or unlawful.

Auditors must meet our applicable competence, confidentiality, independence, and conflict-of-interest requirements and must not materially assess their own work. We may suspend or remove an Auditor for misconduct, loss of competence, conflict, or material breach of those requirements.

The Customer retains ownership of Customer Data and Evidence and gives us the limited licence needed to host, reproduce, analyse, review, and otherwise process them to provide the Service and fulfil the Agreement.

We retain rights in our methodology, scoring framework, software, taxonomy, templates, database structure, Registry architecture, marks, and other pre-existing or independently developed intellectual property. Each party must protect the other’s confidential information and may disclose it only as permitted by the Agreement or law.

When we process personal data solely on the Customer’s documented instructions, the Customer is controller and we are processor under the applicable Data Processing Addendum. We act as controller for processing where we determine the purposes and means, as explained in the Privacy Policy. Actual processing facts, rather than contractual labels alone, determine the parties’ roles.

We maintain technical and organisational measures proportionate to risk, including access controls, privileged-access safeguards, encryption, tenant separation, logging, vulnerability management, backups, restoration processes, and incident response.

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, as required by the Data Processing Addendum and applicable law.

Where the EU Data Act or corresponding Norwegian implementation applies, we will meet applicable mandatory portability, switching, interoperability, and exit duties. On termination, we will provide exportable Customer Data in a commonly used machine-readable format, subject to security, intellectual-property, trade-secret, and legal constraints and the retrieval period in the order form.

You must not manipulate Ratings, submit materially false Evidence, impersonate another organisation, access another tenant, circumvent controls, introduce malicious code, use the Service unlawfully, reverse engineer protected parts of the Service, or systematically extract the Registry except under documented API terms.

Fees, billing period, renewal, taxes, and payment terms are stated in the order form. Unless it says otherwise, fees exclude applicable VAT and taxes. We may suspend access for material non-payment after reasonable notice.

Support levels and any service levels are stated in the order form or an incorporated service-level schedule. Monitoring or a stated target does not create a contractual uptime guarantee unless it is expressly designated as a service level.

Except where mandatory law provides otherwise, the Service is provided on the basis stated in the order form and these Terms. We do not warrant that it will be uninterrupted or error-free, or that a Rating will prevent regulatory action, security incidents, loss, or future non-compliance.

Any agreed liability cap, indemnity, and related carve-outs are set out in the order form or an incorporated schedule. Nothing in the Agreement excludes or limits liability that cannot lawfully be excluded or limited. The Customer remains responsible for false Evidence and unauthorised or misleading use of our marks or Ratings.

On termination, account access ends and the Customer may retrieve exportable Customer Data during the applicable retrieval period. We will return or delete personal data processed as a processor as stated in the Data Processing Addendum, except where law requires retention.

An authorised public Rating may remain in a limited historical status where necessary to preserve registry integrity, subject to privacy and other applicable law.

We will give advance notice of material contractual changes where required. Methodology changes are governed separately by section 7 and do not automatically rewrite completed Ratings.

Each party will reasonably cooperate with lawful regulatory inquiries relevant to the Service. Neither party must disclose privileged material, another customer’s confidential information, or information whose disclosure is prohibited by law.

A Customer may use our name, logo, Rating badge, and report only under the applicable brand and claims rules. It must not state or imply that a Rating is government approval, statutory certification, an AI Act conformity assessment, or legal compliance certification. Claims about us or a Rating must be accurate and supportable.

We may use vetted service providers under written terms and remain responsible to the extent required by applicable data-protection law. Where notice of a material processor addition or replacement is required by the Data Processing Addendum, we will provide at least 14 days’ notice and allow reasonable objections on documented data-protection grounds.

International transfers must use an applicable GDPR Chapter V mechanism. We verify the relevant transfer mechanism before relying on it.

Unless mandatory law requires otherwise, the Agreement is governed by Norwegian law. Disputes are subject to the Norwegian courts stated in the order form. Mandatory data-protection and other applicable rights remain unaffected.

Questions about these Terms can be sent to hello@sustainaiindex.com.

If a provision is invalid or unenforceable, the remaining provisions remain effective. The Agreement and incorporated schedules are the agreement between the parties about the Service. The Data Processing Addendum prevails over these Terms only to the extent needed to address personal-data processing obligations.