Responsible AI & model governance

How Zero Human AI builds, tests, releases and monitors Origin, the video model behind Ori: principles, release gates, evaluations, red-teaming, training-data governance and regulatory alignment.

Last updated 16 October 2026

The short version

Origin, the model behind Ori, is still in development. Every release passes the same gates before it reaches customers.
We test quality, bias across skin tones, ages and dialects, and policy compliance, with red-teaming in Arabic and English.
We record where training data comes from, honour opt-outs, and don’t train on customer content without written opt-in.
Capabilities, evaluations and known limits are published in the model card.

1. Principles#

Finish the job, safely: An ad isn’t done until it’s checked, labelled and approved. Safety is part of the product, not a layer on top.
Explain, don’t just generate: Ori shows its plan and a director’s log before and after it makes anything, so people can direct it and catch mistakes.
People stay in charge: Customers choose how much Ori does alone, and Ori never spends or posts beyond the rules they set.
Consent for real people: No real person’s face or voice without their own verified, revocable consent.
Hard markets first: We test in Arabic and English, across dialects and right-to-left layouts, not English only.
Publish the limits: We say what Origin can’t do, what it refuses, and where it falls short.

2. Who is accountable#

A named safety and policy lead owns this framework and reports to the founders. A release review, made up of research, product and safety, signs off every model and every significant feature. Anyone at Zero Human can stop a release on safety grounds.

3. Release gates#

Every Origin release and every major Ori capability goes through these steps, in order:

Evaluations. Quality and instruction-following; consistency of products, logos and text on screen; bias across skin tones, ages, genders and dialects; and compliance with the Usage Policy. A release that misses an agreed threshold doesn’t ship.
Red-teaming. Internal and external testers try to break the content policy: deceptive claims, impersonation, sexualisation, political content, and evasion in Arabic and English.
Staged rollout. Internal use first, then pilot customers, then general availability, with monitoring at each stage.
Documentation. The model card is updated with what changed, evaluation results and known limits.

Results and limits are in the Origin model card.

4. After release#

Safety incidents, such as a harmful output reaching a customer or a check being bypassed, are logged in an incident register and reviewed every week.
We publish a summary of incidents and enforcement every quarter.
Customer and public reports go to the same trained reviewers (see Safety & Enforcement).
If a problem can’t be fixed quickly, we roll back or disable the feature.

5. Training data#

We record the source and licence of the data used to train Origin, and leave out material we don’t have the right to use.
When collecting publicly available material, we honour machine-readable opt-outs, including robots.txt and text-and-data-mining reservations, and we remove works when rights holders ask (see the Copyright & IP Policy).
We filter training data for illegal content, personal data and sexual content involving minors.
Customer briefs, assets, ads and likenesses aren’t used for training without written opt-in (see How we use data for AI).

6. Regulation and standards#

EU AI Act: Since 2 August 2026, providers of generative systems must mark outputs as AI-generated in a machine-readable way, and deployers must disclose deepfakes. Origin marks every output (see Content Credentials & AI Labels), and we give customers the tools to disclose. Before Origin is offered as a general-purpose model in the EU, we’ll publish the required public summary of its training content and our copyright policy.
ISO/IEC 42001: We’re building our AI management system to this standard, with certification targeted for 2027 (see Compliance).
NIST AI Risk Management Framework: We use it to structure how we map, measure and manage model risks.
C2PA: Every export carries signed content credentials based on the C2PA standard.

7. Known limitations#

Origin can get fine detail wrong: hands, small text on packaging, and exact product shapes. Review every cut.
Arabic dialects and right-to-left captions are checked by native speakers during the pilot, but errors can slip through.
Claims checks catch common problems; they can’t confirm that an offer, price or result is true. That’s the advertiser’s job.
No filter is perfect. Our checks are layered because each one misses some things.

Spotted a problem? Write to info@zerohuman.co.

AI & safetySafety & EnforcementHow Ori checks every ad before it exists, when people review content, how violations are handled, how to appeal, and how to report misuse.AI & safetyContent Credentials & AI LabelsHow every ad made with Ori says where it came from: signed C2PA content credentials, an invisible watermark, platform AI labels, an account trail and an optional visible label. Plus what provenance can’t do.Privacy & dataHow we use data for AIExactly what happens to your briefs, brand assets and ads inside Ori: what the model sees, what we keep, what we never train on, and the controls you have.SecurityComplianceWhere Zero Human AI stands on SOC 2, ISO/IEC 27001, ISO/IEC 42001, data protection laws in the GCC, EU, UK and US, the EU AI Act and content provenance, with dates.

Questions about this document? Write to info@zerohuman.co.