How QL Security uses AI

QL Security's public statement on how we use AI in the content we publish, who holds editorial responsibility for it and our position under Article 50 of the EU AI Act.

Last updated: 13 August 2026

How QL Security uses AI

Effective: 2026-08-13 Owner: Director Review: 2027-08-13 Version: 1.0

Introduction

This statement sets out how Quantum Leap Security Limited (“QL Security”) uses AI in the material we publish, who is responsible for that material and what you can expect from us as a reader.

We advise organisations on using AI safely and accountably. It would be a poor advertisement for that advice if we were vague about our own practice, so this page states our position plainly. It also serves a second purpose. Article 50 of the EU AI Act, applicable since 2026-08-02, asks organisations publishing AI-assisted content to be transparent about it. This statement is part of how we meet that expectation.

Scope

This statement covers everything we publish externally under our own name: website pages, insights and blog posts, glossary and FAQ entries, the content of our online self-assessments and their reports, social media posts, advertising copy, press submissions and award entries. It does not cover client deliverables, which are governed by the terms of the relevant engagement, or our internal working documents.

How we use AI

We use AI assistance in drafting much of what we publish. A typical piece begins as an AI-assisted draft, informed by our own research, positions and prior work. It is then reviewed, corrected and approved by a person before anything is published.

We also use AI for supporting checks before that human review: reading a draft for clarity, flagging claims that need a source and identifying statements that need legal or regulatory scrutiny. These are advisory steps. They hold no approval authority and they always run before the human review, never after it.

What we do not do

  • We do not publish anything that has not been reviewed and approved by a person.
  • We do not allow AI tools to alter published content after approval. No automatic rewriting, no AI testing of live headlines and no scheduled regeneration.
  • We do not publish AI-generated images, video or audio depicting real people, places or events.
  • We do not operate an AI chatbot or assistant on our website. If we introduce one, it will identify itself as AI before any conversation begins.
  • We do not use AI to generate the results of our online self-assessments. Those tools contain no AI model. Their questions, scoring, verdicts and every line of report text are written by us in advance. The results you receive are assembled from that human-written material.

Editorial responsibility

Editorial responsibility for everything QL Security publishes rests with our Director, Jason Holloway. Every item passes a substantive review before publication, which means checking factual accuracy against sources, checking the accuracy of any regulatory or legal statement and checking that the piece says what we intend it to say. A proofread is not a review for this purpose.

Approval is recorded. Website content is approved through the version history of the site repository and pipeline-published content through a recorded approval step, so for any published item we can identify who approved it and when.

Where responsibility for a particular publication is delegated, it is delegated to a named person and recorded in our internal procedure rather than left to custom.

Labelling

We do not label our published content as AI-generated. We want to be clear about why.

Article 50(4) of the EU AI Act asks organisations to disclose AI-generated text where it is published to inform the public on matters of public interest. It disapplies that duty where the content has passed human review or editorial control and a person holds editorial responsibility for publication. Our process is built to meet those conditions rather than to avoid them. We have recorded that determination internally. Labelling reviewed and approved content as AI-generated would suggest a lower standard of oversight than the one we apply.

Where we publish an AI-generated image or graphic that could be mistaken for a photograph, we say so on the item itself. Where AI has done something unusual in producing a piece, we say that too.

Our own determination

We assessed our position under Article 50 and recorded the outcome. In summary, QL Security acts as a deployer of AI rather than as a provider. We use third-party AI models to assist with drafting. We do not build, fine-tune or supply generative AI systems under our own name, so the machine-readable marking duty in Article 50(2) rests with the providers of the models we use.

We review that determination every six months, or immediately if any of the following happens: we add an AI model to any customer-facing tool, we deploy a chatbot or assistant, we publish AI imagery of real people or events, or we customise a third-party model to the point where we would become its provider.

Review

We will review this statement annually, or sooner if our practice changes, if editorial responsibility passes to a different person or if the regulatory position moves. The date at the top of this page is the date it last changed.

Contact

If you have a question about how a particular piece of our content was produced, ask us and we will tell you. Please use our contact form.

Quantum Leap Security Limited
Registered in England and Wales, Company No. 16896166