AI Use Policy

1. Purpose

NorthQA OPC ("NorthQA", "we", "us") uses artificial intelligence to help our engineers test software faster and more thoroughly. This policy explains where AI fits into our work, what we will never do with client material, and how a qualified human stays accountable for every deliverable. It applies to our QA services, our consulting and training work, and the website at northqa.com.

Our position is simple: AI accelerates the work of a QA engineer. It does not replace the engineer's judgement, and it never signs off a release.

2. Scope

This policy applies to:

• All NorthQA employees, contractors, and dedicated team members placed with clients
• All AI Tools used in the course of delivering services, whether hosted by NorthQA or a third party
• All Client Data handled during an engagement, including data accessed inside a client's own systems
• Content published on northqa.com, including blog posts and free tools

Where a signed services agreement, statement of work, or data processing agreement sets stricter rules for a specific client, those rules take precedence over this policy for that client.

3. Definitions

AI Tool

Any software that uses machine learning or large language models to generate, classify, summarise, or transform content, including coding assistants, test generation tools, and chat-based assistants.

Client Data

Source code, builds, test environments, credentials, documents, user data, defect reports, and any other material a client shares with NorthQA for an engagement.

Output

Anything an AI Tool produces, such as test cases, scripts, summaries, code suggestions, or draft reports.

Approved Tool

An AI Tool that NorthQA has reviewed for data handling, access controls, and contractual terms, and that is listed on our internal register.

High-Impact Decision

A decision that materially affects a release, a person, or a legal obligation, such as a go or no-go recommendation, a security finding, or a compliance sign-off.

4. Core Principles

5. How We Use AI

Within the limits above, our engineers may use Approved Tools to:

• Draft test cases, test data, and edge-case lists from requirements or user stories
• Generate and refactor automation code, including self-healing locators and flaky-test analysis
• Triage and de-duplicate defect reports, and suggest likely root causes for an engineer to confirm
• Predict higher-risk areas of a codebase to prioritise regression effort
• Summarise logs, test runs, and long documents
• Draft reports, documentation, and training material that an engineer then edits and approves
• Research tools, frameworks, and standards

Every item on this list ends with a human who reads, runs, or edits the Output before it reaches a client.

6. What We Do Not Do

• Rely on AI alone for any High-Impact Decision, including release recommendations and security or compliance findings
• Paste Client Data into consumer AI chat products or any tool that is not on our Approved Tool register
• Send credentials, API keys, personal data, health, financial, or children's data to an AI Tool
• Allow AI agents to act autonomously against a client's production systems
• Use AI to generate fake test results, screenshots, or evidence
• Use AI to reverse engineer, probe, or test any system we are not authorised to test
• Train or fine-tune models on Client Data, or permit a vendor to do so
• Replace required manual, exploratory, or accessibility testing with unreviewed AI Output

7. Client Data and AI Tools

Before an AI Tool is approved for client work, we check its data retention terms, whether inputs are used for training, where data is processed, and what access controls and audit logs it offers. We keep an internal register of Approved Tools and review it when a vendor changes its terms.

Clients may restrict or prohibit AI Tool use on their engagement at any time. Tell your NorthQA point of contact and we will record the restriction in the engagement notes and comply with it. Where a client requires that work be done only inside the client's own environment and tooling, we work that way.

8. Human Oversight and Escalation

• AI-generated tests are executed and their results inspected by an engineer before they are reported
• AI-suggested defects are reproduced by a human before being logged as confirmed
• Low-confidence or unexpected Output is escalated to the engagement lead rather than passed on
• Any AI-assisted automation that behaves outside its intended scope is stopped and the client informed

9. AI on northqa.com

The free tools on this site, such as the bug cost calculator and the QA maturity assessment, use fixed formulas and scoring, not AI models. Your inputs are not sent to any AI service. Blog posts and other content may be drafted with AI assistance and are always reviewed and edited by a NorthQA team member before publication. We publish machine-readable versions of our pages so that AI assistants can accurately describe our services; see our llms.txt.

10. Regulated and Sensitive Use Cases

Engagements involving healthcare, finance, legal, government, employment, education, or minors' data receive a written AI usage plan agreed with the client before AI Tools are used. That plan may restrict tools further, require on-premises or client-controlled tooling, or exclude AI entirely.

11. Data Privacy and Security

Our use of AI Tools is subject to our Privacy Policy, the Data Privacy Act of 2012 (Republic Act No. 10173), and our obligations as an organisation registered with the Philippine National Privacy Commission. Suspected incidents involving Client Data and an AI Tool are treated as security incidents and reported to the affected client without undue delay.

12. Enforcement

Breaches of this policy by NorthQA personnel are handled under our internal disciplinary and contractor procedures, up to and including termination of employment or contract. Where a breach affects a client, the client is informed.

13. Reporting Concerns

If you believe NorthQA has used AI in a way that conflicts with this policy, or you have questions about how AI was used on your engagement, contact us at dataprotection@northqa.com.

14. Relationship to Other Terms

This policy supplements our Terms of Service, Privacy Policy, and Cookie Policy. If it conflicts with a signed agreement, the signed agreement controls for the subject it covers.

15. Changes to This Policy

We will update this policy as our tooling and the law evolve. Changes apply from the effective date shown at the top of this page. Clients with active engagements are notified of material changes.

16. Contact

NorthQA OPC
Cagayan de Oro City, Philippines
Email: dataprotection@northqa.com
Phone: (088) 323 0334