Version 1.0 · Published 12 November 2026
AI safety and security framework
How Vedametric builds, deploys and governs the AI in its products, including BoardSafe. It follows the six obligations the Australian Government announced for AI companies on 10 November 2026, ahead of the legislation that will make them law.
Why we publish this
The rules are coming. We are not waiting.
On 10 November 2026 the Prime Minister announced that mandatory AI safety and security protections will be legislated through Australian AI Standards, enforced by a new regulator for AI safety. Companies will have to maintain security controls, manage serious risks, allow independent evaluation, notify the Government of incidents rapidly, publish safety and security frameworks, and respond to updated standards.
The legislation has not been introduced yet, and its details are still to come. We have adopted all six obligations now, because our customers in government, defence and critical infrastructure should not have to wait for a law to know how we work.
1 · Security controls
Controls across development and deployment.
From the first line of model code to a scan on a customer's bench, these controls apply to every AI system we build and run.
- In-house modelsOur products run Vedametric's own proprietary models, built and run in house.
- No data sharedNo customer data is sent to any other AI model, outside system or third-party staff.
- Deployed on the customer's siteBoardSafe runs on site. Customer design files and the inspection infrastructure stay on the customer's premises.
- Vetted peopleAll staff hold security clearances and undergo mandatory police checks and mandatory substance testing.
- Records for every deviceEvery BoardSafe inspection is recorded against the individual device, for security and audit logging.
2 · Managing serious risks
We name the risks, then manage them.
Each AI system has a risk register. We review it at least every 12 months, and sooner when a model, a deployment or the threat picture changes.
- Data leaving customer controlManaged by running in house and on site, with no data sent to outside models or systems.
- Unauthorised accessManaged by vetted staff and by limiting access to models, data and results to the people who need it.
- Wrong resultsA missed tampered part, or a false alarm. Models are tested internally before release, and we say so: BoardSafe's 97% detection figure is from internal testing on boards with planted faults.
- Use outside intended purposeEach model is used only for the job it was built and tested for.
- Changes in behaviourA new model version is tested before it reaches customers, and the risk register is reviewed with it.
3 · Incident notification
Within 12 hours for serious incidents.
An incident is any event where one of our AI systems, or the data it handles, is accessed without authority, leaves our control, is misused, or produces results that could cause serious harm.
| Incident | Who we notify | When |
|---|---|---|
| Serious: significant impact on a customer's operations, systems or data | Affected customers and the relevant Australian Government agency | As soon as practicable, and within 12 hours of becoming aware |
| Any other incident | Affected customers and the relevant Australian Government agency | Within 72 hours of becoming aware |
These match the cyber incident reporting timeframes for critical infrastructure in sections 30BC and 30BD of the Security of Critical Infrastructure Act 2018. Cyber security incidents are reported to ASD's Australian Cyber Security Centre. Once the AI safety regulator is set up, we will also notify it, within its timeframes or ours, whichever is shorter.
After every incident, affected customers receive a written account of what happened, the cause and what we changed.
4 · Outside evaluation
Our models are open to independent evaluation.
We allow independent evaluation of our models by government regulators, the Australian AI Safety Institute, and qualified evaluators engaged by our customers. Evaluations run under confidentiality terms that protect customer data and our intellectual property, at our premises or the customer's site.
To request an evaluation, email sales@vedametric.com.au with "AI evaluation request" in the subject.
5 · Transparency
Published, versioned, and honest about limits.
- Public frameworkThis page is our safety and security framework. Every change is recorded in the change log below.
- Measured claimsWhen we publish a performance figure, we say how it was measured.
- Clear limitsOur products support customers' compliance; they are not certifications, and we do not present them as such.
6 · Keeping up with standards
Reviewed every year, and when the rules change.
We review this framework at least every 12 months, and within 90 days of the Australian AI Standards legislation, or guidance from the AI safety regulator, taking effect.
Accountability and contact
Who answers for this.
- Accountable executiveKunal Miind, CTO and Director
- Security and incident contactsales@vedametric.com.au (subject "Security") or (02) 9011 10 10
- Legal entityVedametric is a business name of Amala Innovation Group Pty Ltd, ABN 54 635 436 109
- Change logVersion 1.0, 12 November 2026: first published.