1. AI-Generated Content Disclosure (EU AI Act Art. 50 & Global Transparency Laws)
- Chat, voice, swarm, research, summaries, and images/documents generated via Kazma are AI-generated / AI-assisted.
- Deployers must disclose: inform any person interacting with or exposed to the system that content is AI-generated, clearly and at/before first interaction, accessibly (including Arabic/RTL where relevant). Use visible labels + machine-readable provenance where technically feasible (C2PA/metadata/watermark).
- Do not represent agent outputs as solely human-authored where disclosure is required (EU Art. 50(2)–(5); California SB-942 AI-transparency; Utah AI Policy Act; similar).
- Voice transcription and speech synthesis may mis-transcribe, mispronounce (especially dialectal Arabic/Khaleeji), or misattribute speakers — verify transcripts before reliance.
2. No Professional Advice; No Fiduciary Relationship
Kazma outputs are general information, not legal, medical, financial, tax, engineering, or safety advice, and create no professional-client relationship. Consult a licensed professional for consequential decisions. Never use Kazma as the sole basis for diagnosis, treatment, litigation, contracts, hiring/firing, credit, housing, education, immigration, or emergency response.
3. Human Oversight Is Mandatory (HITL)
- Kazma provides triple-wired HITL gates (graph interrupt / swarm bus / pipeline checkpoints), a commitment-layer resolve-before-act policy, and prompt-fenced memory. These reduce but do not eliminate risk.
- Do not disable approvals in production (
KAZMA_PRODUCTION=1; YOLO off). Approve/deny from Web, TUI, or Telegram/Discord/Slack cards only after reviewing diffs, recipients, and effects. - Automated sends (Gmail, Telegram, Discord, Slack, X), file writes, shell execution, vault retrieval, and deployments act on your behalf and at your risk. Verify recipients, attachments, and commands — agents can misread dates, invent beliefs, or follow injected instructions despite fencing.
4. Accuracy, Grounding & Known Limits
- Knowledge cutoffs, stale memory beliefs (valid-from/valid-until), retrieval gaps (full-text/vector), and web-search staleness can produce outdated answers. Time-travel replay/fork helps audit — it does not make outputs true.
- The prompt fence (
<kazma:data untrusted>) lowers the authority of recalled/web/MCP content but does not make the model immune to prompt injection. Treat third-party content as untrusted. - OCR, PDF/DOCX/XLSX parsing, browser automation, and code execution may misread layout, miss macros/malware (enable malware scanning + quarantine), or break on site changes.
- Model failover chains and self-healing watchdogs improve continuity, not correctness.
5. Third-Party Models & Data
Outputs depend on the LLM provider you select (OpenAI-compatible, Anthropic, Gemini, Azure, Bedrock, Ollama, etc.) and their training, filters, and policies. Provider guardrails may refuse, bias, or alter outputs. Your prompts/files are processed under that provider's terms — review them, and prefer local/EU-region models for sensitive matters.
6. Intellectual Property & Originality
AI outputs may resemble third-party copyrighted text/code/images. You are responsible for IP clearance (licenses, fair use/fair dealing, attribution, opt-outs) before publishing, merging, or commercializing. Do not use Kazma to circumvent paywalls or DRM, or to reproduce substantial copyrighted expression without rights. Upstream GPAI copyright policies belong to model providers; deployer duties (including EU Art. 53 downstream information flow) remain yours.
7. High-Stakes & Prohibited Contexts
Do not use Kazma for EU AI Act prohibited practices (Art. 5) or other unlawful high-risk uses — see the Acceptable Use Policy. In particular: no social scoring; no manipulative or exploitative systems; no non-consensual biometric identification or workplace/education emotion inference; no disinformation or deepfakes; no weapons, cyberattacks on critical infrastructure, or imminent-violence facilitation. Some Annex III high-risk deployments (employment, education, law enforcement, migration, safety components) trigger additional conformity, logging, and oversight duties — seek counsel before such use.
8. Security & Safety Limits
HMAC skill signing, tiered MCP trust, vault encryption, and circuit breakers are defense-in-depth, not proof of safety. Malicious skills, MCP tools, documents, or web pages can still attempt injection/exfiltration. Run untrusted content sandboxed, review diffs, and keep backups/restores tested (see the Disaster Recovery docs in the repository).
9. No Warranty; Liability Limited
Per the MIT License + Terms: provided "AS IS", no warranty of accuracy, fitness, non-infringement, or availability. To the extent permitted by law, we are not liable for losses from reliance on AI outputs or automated actions. Your operator verification is the last line of defense.
10. How to Use Kazma Responsibly — Checklist
- Disclose AI involvement to affected persons; label synthetic content.
- Keep HITL on in production; use the steering and abort controls to manage runs.
- Verify facts, citations, code, recipients, and amounts independently.
- Use least-privilege scopes; isolate workspaces per task/tenant.
- Log, snapshot, and back up; practice restores.
- Train operators (AI literacy, Art. 4) including Arabic-language nuances and RTL review.
- Get professional advice for legal/medical/financial/safety uses.
Questions: contact@kazma.ai · Security: admin@kazma.ai · This notice will evolve with the EU AI Office transparency guidance and Codes of Practice — check back.
Related: Privacy Policy · Terms of Use · Acceptable Use Policy