The terms we work to, written to be read once.

1Who we are, and what we are not

Probative Co is a company registered in England and Wales. Registration, VAT and ICO details are set out in our procurement pack, which we send on request and confirm in writing before any engagement starts.

We provide compliance, technology and AI governance services: independent AML file review, data protection and AI policy work, ISO/IEC 42001 readiness preparation, private AI design and deployment, training, and audit.

We are not a law firm and we do not provide legal advice. We do not carry out any reserved legal activity within the meaning of the Legal Services Act 2007, we do not act as your solicitor, and nothing we deliver is a substitute for legal advice on your own facts. Where a matter requires legal advice we will tell you and step back. We are also not a certification body: certification to ISO/IEC 42001 and comparable standards is issued only by an accredited body that must be independent of any consultancy engaged by you (ISO/IEC 17021-1). We prepare, and we never certify our own work.

2How these terms apply

These terms apply from the earlier of: (a) your written acceptance of a proposal, (b) your payment of a booking fee, or (c) the point at which we begin work at your request. They continue until the engagement ends under clause 13.

You confirm that you are authorised to instruct us on behalf of the firm or organisation named in the proposal, and that the person signing has authority to bind it.

3Scope, proposals and change control

Every engagement begins with a written proposal stating the scope, deliverables, assumptions, dependencies, turnaround and fee. We do not begin work until you approve it.

If the work turns out to be materially different from the agreed scope — more files, more systems, more offices, a different document environment — we tell you before doing the additional work and give you a revised fee in writing. We do not carry out unpriced work and invoice for it afterwards.

Turnaround times are given in good faith and depend on timely access to records, systems and people. Where delay is caused by the availability of your material or approvals, we will tell you and adjust the dates rather than absorb the problem silently.

Unless the proposal says otherwise, a free 3-file check is provided at no charge and without obligation: it sits outside any paid engagement, it is not advice on which you should act without further work, and the findings are yours to keep whether or not you proceed.

4Fees, expenses, VAT and payment

• Fixed fees. Fees are fixed for the scope agreed. We do not charge day rates on engagements quoted as fixed fees.
• Payment terms. One-off engagements are 50% on booking and 50% on delivery unless the proposal says otherwise. Larger deployments are billed to milestones agreed in writing before work starts. Retainers are billed monthly in advance.
• VAT. Fees exclude VAT. Where VAT applies it is shown separately on the invoice at the prevailing rate.
• Expenses. Travel for training and board sessions within mainland England and Wales is included. Any other expense is agreed with you in writing before it is incurred.
• Late payment. Invoices are payable within 30 days. We reserve the right to charge statutory interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998 on overdue amounts, and to pause work under clause 13 after giving you notice. We would much rather have a conversation about a difficult invoice than send a formal demand.
• Third-party costs. Hardware, licences, cloud capacity, certification body fees and similar third-party costs are yours, are contracted in your name where possible, and are not marked up by us.

5Your responsibilities

So that we can do the work properly, you agree to:

• provide accurate and complete information, records and access within the timescales agreed, and tell us promptly if something material changes;
• nominate a single contact with authority to approve scope and answer questions;
• use the agreed encrypted transfer route for client material, and not send confidential documents as email attachments;
• ensure you are entitled to share anything you send us, and redact privileged material where it is not needed for the work;
• apply your own professional judgement to our deliverables, and take your own legal, tax or regulatory advice where it is needed; and
• not ask us to do anything unlawful, or to sign off work we have not performed.

Where your instructions change after work has begun, we will accommodate them where we reasonably can; additional time or cost arising from a change of instructions is dealt with under clause 3.

6Confidentiality

Each of us will keep the other's confidential information confidential and use it only for the engagement. We will not disclose your information except: (a) to our personnel and engaged associates who need it for the engagement and who are bound by written confidentiality obligations; (b) to a subcontractor under clause 10; (c) where you authorise disclosure in writing; or (d) where we are required to disclose by law or by a regulator, in which case we will tell you before doing so unless we are prohibited from doing so.

These obligations continue for five years after the engagement ends, and indefinitely in respect of personal data and any information that is a trade secret.

7Data protection and information security

Where we process personal data on your behalf, we do so as your processor under a written data-processing agreement, provided with every proposal and taking precedence over this clause. That agreement sets out the subject matter, duration, nature and purpose of processing, the types of personal data, the categories of data subject, our obligations and those of our subprocessors.

Our security standards, controls, subprocessors and retention periods are published on our security page and summarised in our privacy notice. In summary:

• client files move by encrypted transfer only, never as email attachments;
• access is limited to the named reviewer and is logged;
• client files are deleted on completion with written confirmation, unless a longer period is agreed in the engagement letter;
• we name our subprocessors before engagement and will not add one for your engagement without telling you first; and
• if we become aware of a personal data breach affecting your data, we will notify you without undue delay, and in any event within 48 hours of becoming aware, with the information you need to meet your own obligations.

8How we deliver: AI-assisted, human-reviewed

We use our own tooling to perform a structured first pass over document sets, and we say so on every deliverable rather than hiding behind the word “technology”. The following applies to every engagement:

• A named human reviews every finding and is responsible for it. Automated observations are confirmed, rejected or escalated by a qualified specialist, and rejections remain in the audit trail;
• each finding states the rule applied, the evidence relied on, a confidence rating and the human decision;
• your material is not used to train any model, ours or a third party's, and is not processed outside the environment agreed with you;
• we record the ruleset and model versions used, so a deliverable can be reproduced and challenged later; and
• we will explain the methodology, its limitations and its known failure modes to you or your advisers on request, at no charge.

You acknowledge that our deliverables are professional judgements based on the sample and the records made available, not a guarantee of any regulatory outcome, and that our tooling is an aid to consistency rather than a substitute for specialist review.

9Independence, conflicts and ethical walls

We carry out a written conflict check before accepting an engagement and will decline or cease work where independence cannot be preserved. We do not review a firm we have advised, and every review report includes a signed independence statement. We do not accept vendor payments, referral fees or reseller margin in connection with any recommendation we make.

Where your instructions involve two parties whose interests conflict, or where an ethical wall is required, tell us before engagement so we can confirm whether the work can be accepted and, if so, on what separation terms.

10Subcontracting and associates

We engage independent specialist associates for specific engagements, and we may use subcontractors for defined parts of the work. Where we do: the associate or subcontractor is bound by written confidentiality and data-protection obligations no less protective than those in this agreement; we remain responsible to you for the work; and we will tell you who is working on your engagement before it starts.

We do not use subcontracted labour to replace specialist judgement, and we do not send client material offshore unless you have agreed it in writing.

11Intellectual property

You own your data, your documents and the deliverables we produce for you, and you may use and share them within your firm and with your regulator, insurer, client or professional advisers.

We retain ownership of our methodologies, tools, templates, rulesets and know-how, and we may reuse general knowledge and anonymised, aggregated patterns — never your identity, your clients' identities, or anything identifiable, without your written permission. Where a deliverable incorporates our template material, you have a perpetual, non-exclusive licence to use it internally.

Nothing in this clause gives us the right to name you as a client, or to quote you, without your written consent — which we will ask for separately, and which you are free to refuse.

12Our liability

Nothing in this agreement excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be excluded.

Subject to that:

• we do not exclude liability for direct loss caused by our breach of this agreement, but our total aggregate liability arising out of or in connection with an engagement is limited to the greater of the fees paid for that engagement and the amount recoverable under our professional indemnity insurance for that claim;
• we are not liable for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, loss of business or goodwill, or for any fine, penalty or regulatory sanction imposed on you;
• we are not liable for loss arising from your failure to provide accurate information, records or access, from your reliance on a draft or interim deliverable, or from your decision not to act on a recommendation; and
• we are not liable for the acts, omissions or performance of third-party software, hardware, model providers or certification bodies, though we will help you pursue a remedy with them.

Insurance is confirmed in writing, with certificate wording, in the procurement pack before any engagement starts — not after. If suitable professional indemnity cover is not in place for the work you need, we will tell you and decline the engagement rather than proceed uninsured.

13Term, suspension and termination

Either of us may end an engagement:

• For convenience: you may cancel at any time on written notice. If you cancel before work starts, nothing further is due beyond any work already performed. If you cancel during delivery, we invoice for work performed to that point and hand over everything completed.
• By us for cause: immediately if we are required to stop by law or by a regulator, if continuing would breach a professional or ethical obligation, if a conflict arises that cannot be managed, or if you ask us to do something unlawful.
• For non-payment: we may suspend work after giving you written notice of an overdue invoice. We will not withhold deliverables you have paid for as leverage in a fee dispute.
• Retainers: on 30 days' written notice by either party, with no minimum term and no exit fee. We will tell you what state a pause leaves your evidence in.

On termination you pay for work performed and expenses committed to that point; we return or delete your material in accordance with clause 7 and the engagement letter; and clauses 6, 7, 11, 12, 14, 15 and 16 survive.

14Complaints

If something is wrong, tell us first — write to diin@probativeco.com with the word “complaint” in the subject line. We will acknowledge within two working days and give a substantive written response within ten working days, including what we got wrong and what we will do about it. If we got a finding or a report wrong, we will correct it and issue a revised version with a change note at no charge.

If you are not satisfied with our response, the matter may be escalated, by agreement, to an independent mediator. Nothing in this clause prevents either of us from taking a dispute to court under clause 16.

15General

• Entire agreement. These terms, the proposal and the engagement letter are the entire agreement between us and supersede prior discussions. Neither of us relies on any statement not set out in them, except that nothing limits liability for fraudulent misrepresentation.
• Variation. These terms may only be varied in writing signed by both of us, or by our publishing a new version and agreeing it with you in the engagement letter.
• Assignment. Neither of us may assign this agreement without the other's written consent, except that we may assign it to a successor of our business on written notice to you.
• No third-party rights. A person who is not a party to this agreement has no right to enforce any of its terms, save as provided by law.
• Severability. If a provision is found unenforceable, the rest remains in force.
• Force majeure. Neither of us is liable for failure caused by events beyond reasonable control, provided we tell the other promptly and mitigate where we can.
• Notices. Notices to us go to diin@probativeco.com; notices to you go to the contact named in the engagement letter. Email is a valid means of notice.
• Anti-bribery and sanctions. Each of us will comply with the Bribery Act 2010 and applicable sanctions law, and neither will offer or accept improper inducements in connection with the engagement.

16Governing law and jurisdiction

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it. Where the client is established outside the United Kingdom, the engagement letter may specify a different governing law, which will take precedence over this clause.

S1Schedule 1 — what an engagement normally includes

Unless your proposal says otherwise, every paid engagement includes: a named lead reviewer or consultant who is available to speak to you; a written scope and fixed fee agreed in advance; encrypted transfer and deletion of your material on completion; a written deliverable with findings, ratings and, where relevant, a remediation plan with owners and dates; a methodology appendix stating the ruleset or method used and its limitations; and an independence statement where the work is an audit or review.

Deliverables are provided in editable and PDF formats, in your own file structures where practical. We do not lock deliverables in a portal that only we can access.

S2Schedule 2 — company details, registrations and insurance

Certificates and registration documents are provided in the procurement pack on request, before any engagement.

S3Schedule 3 — retention and deletion