Our rules for using AI on client work, the numbers we hold it to, and a tracker of the laws and standards that apply, with dates and sources.
Last reviewed Reviewed every week against official sources
They apply to every AI system we build, run or use on your work, and to our own company first.
Version 1.0In effect
A named person at HQ Labz owns every AI system we build or run for you. Anything that sends, signs, pays or publishes in your name waits for your yes, or follows written rules you set.
Agents see only the records their job needs. Your data is never used to build work for anyone else, and when a project ends we return or delete it on your request.
Nothing of yours appears in our portfolio, a case study or a demo without your written yes. Demos run on invented data, and say so.
We pick the model for each task, test it on your real cases before it ships, and tell you which AI providers handle your data. Your prompts, tests and data stay yours.
An agent that talks with your customers never claims to be a person. Where a law or a platform asks for AI content to be disclosed, we disclose it.
Every agent is scored against real examples before launch and again after each change. Facts it states are checked against your records, not taken on its word.
Where an agent's work bears on decisions about people, such as hiring, lending, housing or health, a person makes the decision, and we test for uneven results across groups.
Least privilege, untrusted text fenced, secrets in a vault and a stop switch on every system we build or run. How we secure AI
Every agent starts at the lowest level that does the job, and moves up only on your word.
Questions about this policy?
AI earns its place with numbers, not demos. Before we build, we measure how the work runs today. After launch, we measure the same things the same way, every month.
Time per task, error rate, cost and volume, measured on your real work before anything changes.
A set of your real cases with the right answers, built with your team, that every version must pass.
The agent works beside a person who checks every output, and every miss goes back into the test set.
Approvals, guardrails and spend limits on, and every action logged.
Before and after, side by side. If a number slips, we fix it or switch it off.
Illustrative numbers for a lead follow up agent, not a client's results.
| Measure | Before | After |
|---|---|---|
| Time to first reply to a new lead | 4 h 10 min | 6 min |
| Quotes followed up within 2 days | 58% | 100% |
| Answers correct on the test set | Not measured | 96 of 100 |
| Cost per handled request | $6.40 | $0.85 |
The laws, guidance and standards that matter to a business using AI agents in the United States and Europe: what each means, its key dates and the official source.
Last reviewed Reviewed every week against official sources
General information, not legal advice. Laws change and apply differently to every business. Check the source, and talk to a licensed attorney about your situation.
The White HouseUnited States
The federal government is challenging state AI laws it calls burdensome. Until a court or Congress says otherwise, the state laws below still apply.
The White HouseUnited States
Federal agencies now say super intelligence, or SI, for what they called artificial intelligence, and a proposed legal definition is due within 60 days. Existing rules are not changed by it.
The White House: Inaugurating the Era of Super Intelligence (opens whitehouse.gov)Checked
Federal Trade CommissionUnited States
Claims about what AI can do must be true and provable, like any advertising claim. Deceptive AI claims are enforced under the laws already on the books.
FTC: Crackdown on Deceptive AI Claims and Schemes (opens ftc.gov)Checked
European Union
Applies to anyone whose AI is used in the EU. The high risk dates moved later in 2026; the duty to tell people they are dealing with AI did not.
EU AI Act implementation timeline (opens artificialintelligenceact.eu)Checked
Alabama LegislatureAlabama
Alabama now regulates how health care plans use AI to decide coverage. Insurers and their vendors should check where AI touches a coverage call.
Transparency Coalition: AI Legislative Update, May 15, 2026 (opens transparencycoalition.ai)Checked
California Privacy Protection AgencyCalifornia
Businesses under California's privacy law that use automated decisionmaking to make significant decisions must comply from 2027, with risk assessments and audits phasing in.
California Privacy Protection Agency: regulations finalized (opens cppa.ca.gov)Checked
State of CaliforniaCalifornia
Applies to developers of the largest frontier AI models, not to businesses that use them. Worth knowing because the providers behind your tools report under it.
Governor of California: SB 53 signed (opens gov.ca.gov)Checked
Colorado General AssemblyColorado
Colorado's AI law now centers on automated decision-making technology that materially influences consequential decisions. If AI shapes decisions about people there, plan for its duties in 2027.
Colorado General Assembly: SB26-189 (opens leg.colorado.gov)Checked
Connecticut General AssemblyConnecticut
Connecticut adds rules for AI companions now and, from October 2027, for employers using AI in recruiting, hiring, promotion, discipline, pay and termination.
Carmody Law: Connecticut's 2026 privacy and AI laws (opens carmodylaw.com)Checked
Illinois General AssemblyIllinois
Employers may not use AI in ways that discriminate in hiring and other employment decisions, and must tell workers and applicants when AI is used.
Texas LegislatureTexas
Texas bans a short list of intentionally harmful AI uses, enforced by the state attorney general.
Texas Legislature Online: HB 149 history (opens capitol.texas.gov)Checked
The White HouseUnited States
Federal AI policy favors speed and fewer rules. It is driving a revision of the NIST AI Risk Management Framework and how federal agencies buy AI.
The White House: America's AI Action Plan (opens whitehouse.gov)Checked
Federal Trade CommissionUnited States
The FTC proposes how its ban on deceptive practices applies when accuracy in an AI system is suppressed. Proposed, not final.
FTC: Policy Statement Concerning the Suppression of Accuracy in AI Systems (opens ftc.gov)Checked
State of AlabamaAlabama
Alabama's executive branch agencies now have a board overseeing emerging technology, moving them toward the NIST AI Risk Management Framework. Vendors selling AI to the state should expect it.
ISO and IECWorldwide
The international standard for running AI responsibly as an organization: policy, roles, risk, review and improvement. Larger buyers increasingly ask suppliers about it.
NISTUnited States
The voluntary framework US buyers and agencies expect: govern, map, measure and manage AI risk. NIST is revising it under the AI Action Plan.
No. We build on models from established AI providers and do not train those models. We tell you which providers handle your data, and where a provider offers a setting that keeps your data out of its training, we turn it on.
We are, for what we built. A named person owns every system, every action is logged, and when something goes wrong we fix it and tell you what happened. Decisions that commit you stay with you.
Yes. Every action is recorded with what it did, when and on whose word, and you can ask for that record at any time.
We measure the work before we build, then measure the same things the same way after launch. If the numbers do not beat the baseline, we say so, and we fix it or switch it off.
No. It is general information, kept current by our AI agents and checked against official sources every week. It is not legal advice and does not make us your lawyer. For your situation, talk to a licensed attorney.
We build AI agents and automations that are measured against your baseline, secured by design and run under the policy on this page.
