Responsible AI

Attolloo treats concern about AI as a governance question, not a marketing message. Every venture is assessed for misuse and dual-use risk before commitment, red lines apply regardless of commercial attractiveness, and where Attolloo holds equity, exit criteria govern who the technology can be sold to.

The Trust Gap

Alongside the governance gap sits a second, less quantified gap: trust. Public concern about AI has moved from abstract debate to concrete questions. Can this system be misused? Who has access to the models and the data? What happens if the company — or the technology — is acquired by someone with different intentions?

Why buyers now ask these questions

For AI companies in regulated markets, these questions are no longer reputational side issues. Banks, insurers and other institutional buyers increasingly ask them in procurement and due diligence. A founder who cannot answer them credibly will lose the deal, regardless of product quality.

Attolloo addresses the trust gap in three ways. First, misuse and dual-use risk is part of the 6Sense Filter, with explicit red lines. Second, security and privacy controls — access control, data minimisation, supply-chain oversight — are built into the governance architecture from the first engagement. Third, exit criteria ensure that the technology Attolloo helps to scale does not end up with actors who would use it to cause harm.

Attolloo takes the anxiety about AI seriously — without selling on fear. The answer to fear is not hype, and not doom. It is competence, control, and transparency about the choices we make.

Our Responsible AI Commitments

Attolloo applies the same standard to itself that it applies to the companies it works with. The commitments below are written to be verifiable.

We deploy AI to strengthen organisations and society, not to weaken them.

  1. We always ask what happens in the wrong hands. Every engagement is assessed for misuse and dual-use risk before we commit.
  2. We have red lines. We do not work with solutions for mass surveillance, manipulation, weapons, or uses prohibited under the EU AI Act.
  3. Where we hold equity, we have a say in where the technology ends up. Our exit criteria apply throughout the ownership period, including when a company is sold.
  4. Security and privacy are built in from the start. Access control, data minimisation, and supply-chain oversight are prerequisites, not add-ons.
  5. Humans have the final say. Decisions that affect individuals require meaningful human oversight.
  6. We look for growth before cuts. When AI frees capacity, we first ask how it can serve more customers, raise quality, or lower risk. Where roles do change, the people affected are told early, and the choice is documented.
  7. We tell it as it is. We neither overstate the opportunities nor the threats, and we do not sell on fear.
  8. We practise what we recommend. Attolloo follows the same principles in its own use of AI and data.
  9. We report openly. Once a year we summarise how the commitments have been followed — including where we said no.
The first step of the 6Sense Filter, in two parts Part one: red lines, five exclusions checked first. Any hit stops the assessment. Part two: misuse and dual-use risk, seven criteria each scored one to five, where one is high risk and five is low risk. Before the six dimensions are scored 1 Red lines Five exclusions, checked first any hit Stop no hits Scored with the six dimensions 2 Misuse and dual-use risk Seven criteria, each scored 1 to 5 1 is high risk, 5 is low risk. The score counts alongside the six dimensions.

The First Step of the 6Sense Filter

Before a venture is scored on the six dimensions, the 6Sense Filter asks one question: what happens if this ends up in the wrong hands? It is answered in two parts.

RED LINES

Any hit stops the assessment.

  • Mass surveillance or identification of individuals without a lawful basis is core to the product.
  • The product is designed to manipulate behaviour, opinions, or elections — including deepfakes or disinformation at scale.
  • Weapons-related applications or offensive cyber tooling.
  • Practices prohibited under the EU AI Act.
  • Owners, key persons, or funding sources that cannot be identified, or that appear on sanctions lists.

MISUSE AND DUAL-USE RISK

Scored across seven criteria, alongside the six dimensions. Each criterion is scored 1 (high risk) to 5 (low risk).

The seven criteria

MISUSE POTENTIAL — What could a malicious actor do with the solution, and how little modification would it take?

ACCESS CONTROL — Who can access models, data, and APIs — and is that access role-based, logged, and audited?

CUSTOMER CONTROL — Does the company know its customers and their use, with enforced terms of use?

DATA AND PRIVACY — Which personal data is processed, where, and with what minimisation and impact assessment?

SUPPLY CHAIN — Which models and sub-suppliers is the solution built on, and are they mapped and contracted?

REGULATORY MATURITY — Is the system classified under the EU AI Act and GDPR, with a plan and a named owner?

GOVERNANCE AND CULTURE — Do the founders take ownership of misuse risk, with their own principles and escalation routines?

Exit Criteria

Where Attolloo holds equity, it also has a say in who the technology ends up with. Exit criteria are agreed with founders at entry, not when an offer arrives.

BUYERS ATTOLLOO WILL NOT SUPPORT A SALE TO

  • Actors on sanctions lists, or subject to export controls relevant to the technology.
  • Actors who intend to use the technology for purposes that breach the Responsible AI red lines.
  • Actors whose ownership cannot be clarified through due diligence.

The Standard

As public concern about AI grows, the companies that earn trust will be those that can show — not just claim — that their technology is governed, secured, and in the right hands. That is the standard Attolloo holds the companies it works with to, and itself.

Questions about how these commitments apply to your company:

Send a message or email nils.johan@attolloogroup.com