Compliance and human review

What our systems will not do.

Island Workflow builds practical workflow tools, not regulators, lawyers, or licensed professionals. This page lays out where humans stay in the loop, what kinds of decisions never get automated, and how legal responsibility is shared between us and the client.

The short version

You stay legally responsible for your business. Your industry’s regulators, your privacy obligations, your professional licenses, and your final approvals remain yours. We design Claws around that reality, not around it.

Every Claw is built with a default rule: sensitive decisions go to a person. The system can collect, summarize, route, remind, and prepare. The person decides.

Decisions that always stay with a person

Across every Claw in the suite, the following are never automated by default. They are routed to your staff with the information the Claw has gathered, ready for a human to review and act on.

Legal decisions, contract interpretation, dispute outcomes, and anything that needs a lawyer.
Medical and clinical decisions, diagnosis, triage, prescribing, dosing, and emergency assessment. These belong to licensed clinicians.
Financial advice, tax positions, investment recommendations, and insurance adjudication. These belong to licensed professionals and the insurer.
Tenant screening on protected grounds, tenancy decisions, and fair-housing-sensitive judgements.
Building code, permit, engineering, architectural, electrical, gas, and plumbing sign-off. These belong to licensed trades and design professionals.
Cannabis, agricultural, hemp, pesticide, food safety, livestock, and other regulated-product decisions. These belong to the license holder and qualified advisors.
Short-term rental bylaw, tourism tax, and host-of-record decisions.
Marine navigation, vessel safety, and emergency maritime traffic.
Emergency calls. A Claw will hand a person back, not handle a 911-equivalent situation.
Approvals, refunds, claim outcomes, contract changes, and anything else the client has marked as a human-review boundary during the Readiness Session.

How privacy is handled

The client is the data controller for their business. Island Workflow is a processor: we handle what we are instructed to handle, only for the purposes that were agreed during Readiness.

Personal information is collected with consent and used for the purpose it was collected for.
Health, financial, and other sensitive information is scoped tightly. The Claw is not a clinical record, not a financial record of truth, and not a substitute for the client’s existing systems of record.
If your industry has a privacy regulator or a professional college with privacy obligations, your existing privacy policy and your privacy officer’s instructions take precedence. We work within them.
Cross-border processing, retention, and deletion are confirmed in advance and reviewed during ongoing support.

What we do not promise

Honesty here matters more than marketing comfort.

We do not claim a Claw is automatically compliant with any specific regulation. Compliance is a client and industry-specific assessment.
We do not hold third-party compliance certifications on the client’s behalf. If your industry requires a specific certification on the systems you use, ask us during Readiness and we will be straight about what we can and cannot support.
We do not give legal, medical, financial, tax, or licensed-professional advice as part of any Claw or any Island Workflow communication. The chat assistant on this site is also bound by the same rule.
We do not act as merchant-of-record, host-of-record, license holder, regulated-trade signatory, or clinical record holder for any client workflow.

Messaging, recording, and consent

Voice, SMS, email, and any other outbound communication a Claw sends or handles follows the consent rules of the client’s jurisdiction. Recording calls, sending commercial electronic messages, dialing automatically, and contacting consumers all carry rules that vary by region. We configure the Claw to respect the client’s compliance setup, and the client remains responsible for what is sent in their name.

AI-specific transparency

Where AI is part of the workflow, the people interacting with the system are told. Where a jurisdiction has rules about automated decision-making, human review of automated decisions, or AI use disclosure, we design for them as part of the Readiness Session and the build.

How this plays out in the Readiness Session

Before a Full Build is quoted, we map the workflow boundary in writing: what the Claw can read, what it can write, what it can send, what it must hand to a person, what it is forbidden from doing, and which sensitive categories trigger immediate human handoff. The client signs off on that map before we build.

If something goes wrong

If the Claw makes a mistake, our default is honest: log it, surface it, and feed it into the improvement loop the same way we treat any other software issue. We do not hide errors behind the model. Remote Support hours and Managed AI Runtime monitoring are how we keep the system safe over time.

If you have a specific compliance question

Tell us during the Readiness Session, or send the question through our contact page with enough detail that we can answer honestly. If a specific commitment is not something we can make, we will say so directly.