Hiroshima AI Reporting Framework

The Hiroshima AI Reporting Framework is open to organisations across the AI value chain, including developers, deployers, and providers of advanced AI systems. Participants are invited to report on their practices for managing risks and advancing trustworthy AI. Participation strengthens transparency, contributes to a shared understanding of organisational practices, and enables organisations to demonstrate their approaches to trustworthy AI.

League Inc.: G7 Hiroshima AI Process (HAIP) Transparency Report

Publication date: Oct 2, 2026, 07:33 AM GMT+2

Reporting period: Q2 2026

Download

Section 0 - Your role in the AI system lifecycle

Responding as (please select all that apply):

Application developer (/provider)
Deployer

If any of the fields above are selected, please indicate your organization size:

Large enterprise: 250 or more employees

Section 1 - Risk Identification and Evaluation

1. How does your organization define and/or classify different types of risks related to AI?¹

Maintain an internal taxonomy, classification system, and/or set of risk area definitions
Define enhanced safety measures for specific dangerous capability thresholds, that, once reached, require safeguards (e.g. capability threshold for dangerous Chemical, Biological, Radiological and Nuclear (CBRN), cybersecurity attacks, dangerous advanced autonomy capabilities, or other capabilities).
Align with specific external frameworks, standards, reports, and/or guidance documents such as taxonomies, classification systems, and/or sets of definitions for risk areas (e.g. the NIST AI Risk Management Framework, the ISO/IEC 42001, the OECD AI Principles, the EU General-Purpose AI Code of Practice, the International AI Safety Report). (please specify): NIST AI Risk Management Framework 1.0 (formal compliance assessment completed) as the AI-governance baseline; ISO/IEC 27001, HITRUST CSF, and AICPA SOC 2 (certified); alignment with ISO/IEC 42001; and the OECD AI Principles. For AI-specific risk identification and adversarial testing, League uses the OWASP Top 10 for LLMs, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS. League also monitors the EU AI Act and ISO/IEC AI-governance standards.
Consult with external stakeholders (e.g., from academia, industry groups, civil society, or standard development organisations) when developing or updating risk taxonomies
Other (please specify): see above

How does your organization define thresholds at which severe risks, unless adequately mitigated, may be considered "unreasonable"? Please describe the framework(s) most relevant to your organization's role and context. If your organisation does not use formal thresholds, you may describe instead the policies, decision criteria, or governance processes you apply when assessing severe AI risks. You may also describe: • Specific examples of contexts in which your models or systems could, in your assessment, pose unreasonable or intolerable risk; • How mitigations are graduated by capability or propensity level; • How your organisation considers the specificities of different AI technologies, such as generative AI and agentic AI, including any specific risk assessment or governance mechanisms applied to agentic AI capabilities.

League does not use fixed numeric thresholds. An 'unreasonable risk' is harm that cannot be adequately mitigated through technical or procedural controls commensurate with the benefit the AI system delivers. Risks are scored by severity (critical/high/medium/low) and lifecycle stage; critical and high findings are mandatory deployment blockers, and the AIGC accepts or rejects residual risk. For generative and agentic AI, mitigations are graduated by capability: runtime guardrails, prompt-injection/exfiltration/excessive-agency detection, and human-in-the-loop review of high-risk autonomous actions; agentic risk is assessed via design reviews and AI governance committee review.

2. Both before and after deployment, what practices does your organization use to identify and evaluate vulnerabilities, incidents, emerging risks and misuse throughout the AI system lifecycle?

Internal red teaming³
Independent third-party red teaming
Adversarial testing to detect technical vulnerabilities
Internal benchmarks, standard metrics (e.g., frequency, severity scores)
Qualitative assessments (e.g., expert judgment, narrative scoring)
Impact assessments such as personal data protection assessment and fundamental rights impact assessments
Vulnerability reports
Incident reports, including reports shared by other organizations
Automated monitoring / remote status reporting (e.g., telemetry pipelines, automated alerts when risk thresholds are breached)
Specific risk identification practices for agentic AI capabilities, e.g., autonomous action-taking, tool use, multi-step planning (please specify): For agentic AI, League applies excessive-agency detection, runtime guardrails that constrain tool use and enforce data-access policies, agent activity baselining and runtime monitoring, prompt-injection detection (direct and indirect), and human-in-the-loop review for high-risk autonomous actions. Multi-step plans and tool calls are logged and monitored.

Are any national AI safety / security institutes of the AISI network involved?

Please briefly describe your organization’s decision-making process for deploying an AI model or system including: who has decision authority; what evidence and criteria are required (e.g., performance, safety/security, robustness, fairness, privacy, compliance, independent external testing, evaluation, validation and verification (TEVV) or assurance); contextual caveats or limitations required in interpreting risk evaluation metric results; what approvals/sign-offs are needed; and what safeguards (e.g., mitigations, monitoring, or phased release) must be in place to move into deployment.

Governed by the Responsible AI Feature Deployment and Operations Policy.

Decision authority: the AI Governance Committee (AIGC) — a cross-functional body of senior leaders from Legal, Compliance, Privacy, Security, Product & Design, and Engineering & Data, empowered by executive leadership. The Chief Technical Officer provides the final go/no-go deployment decision.

Evidence/criteria: a completed TEVV (Test, Evaluation, Validation, and Verification) report covering validity/reliability, security/resilience, fairness/bias, privacy, and explainability/transparency, executed against an AIGC-approved test plan; the feature must successfully pass TEVV, and unresolved critical or high-risk findings will not receive AIGC deployment approval.

Release approach: features move through Test/Stage/UAT pre-production environments and deploy via feature-flag-controlled, CI/CD-managed release with rollback.

Safeguards before/after go-live: runtime guardrails, content filtering, RAG grounding, and user-facing disclaimers; human oversight of high-risk interactions with Tier-2 escalation; continuous post-deployment monitoring (drift, escalation rate, user feedback) with at-least-quarterly re-evaluation against a reference standard dataset; and an AI-specific incident playbook with a feature-flag kill switch.

Following deployment, how do you use incident reports — including those shared by other organizations — to identify emerging issues, update risk assessments, and trigger corrective actions.

Following deployment, League maintains continuous runtime monitoring with automated incident triage. The security team monitors the OWASP Top 10 for LLMs, external vulnerability disclosures, and AI incident databases, feeding findings into threat-detection rules and policy updates. The AIGC reviews significant AI incidents, and incident response requires root-cause analysis and documented remediation, which can update risk assessments and trigger corrective action.

3. Does your organization have mechanisms to receive and/or share reports of risks, incidents or vulnerabilities by/with third parties?

Yes, both receiving and sharing

If yes, please indicate which stakeholders reporting mechanisms may be accessible to, recognising specifics will depend on the nature of the report and risk level. For each, indicate whether access is on a standing basis (Always), activated based on context (Ad hoc/as relevant), or not currently accessible.

	Always	Ad hoc / as relevant
Relevant employees (security, legal/compliance, etc.)	✓
Public authorities (e.g., public reporting offices for security incidents or data breaches)		✓
Supervisory authorities (e.g., data protection authorities)		✓
Industry partners or industry fora		✓
Users (end users, enterprise customers, developers using APIs)
Business customers / deploying organizations (if different from “users”)	✓
Supply-chain partners (cloud, data providers, etc.)		✓
Academia / researchers
Independent auditors		✓
Standards bodies / multi-stakeholder initiatives (OECD.AI, ISO/IEC, IEEE, etc.)		✓
Specific civil society organizations
Media / general public (people or communities indirectly impacted)
Other

Please describe how your organisation determines when and how reporting mechanisms are made accessible to different stakeholders (e.g. based on legal or regulatory requirements, internal policies, or risk level). Please also provide public URLs or details on how to submit reports. If none, write “Not applicable”

League makes reporting channels accessible by stakeholder type, legal/regulatory requirements, contractual terms, and risk level. Employees use always-on internal channels (security event reporting, manager escalation, anonymous whistleblower hotline). External parties and security researchers report at compliance@league.com or via the Trust Center (trust.league.com). Customers report through contractual support channels. Regulatory and breach reporting follows applicable law (e.g., HIPAA). Public URLs: trust.league.com and league.com.

How does your organization share relevant information as appropriate?

Publicly
Information-sharing partnerships (with confidentiality agreements as appropriate)
Reporting to regulatory authorities as relevant

Please describe what type of information is shared.

Aggregated, non-identifying AI-safety and security learnings; League's security, privacy and responsible-AI posture and certifications (via the Trust Center); and, where legally required, incident and breach notifications to affected parties and regulators. Customer-specific transparency reporting is provided on request.

4. If your organization has programs to incentivize risk(s) disclosure, incidents and systemic vulnerabilities, please share what type of programs you use?

Paid rewards (“bug bounty”)
Internal incentives and culture
Research grants, contracts, and hiring red teamers

Please provide public URLs and/or details on your incentive program(s). If none, write “Not applicable.”

Public intake is published via security.txt at https://league.com/.well-known/security.txt (security contact: secteam@league.com; PGP key provided). The reward program runbook is maintained internally.

5. Does your organization use or contribute to the development of international technical standards, best practices or tools for the identification, assessment, and evaluation of risks?

Uses

If contributes or uses, please select all that apply:

ISO/IEC standards (e.g., ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 42005)
NIST AI Risk Management Framework (AI RMF)
OECD Due Diligence Guidance for Responsible AI
General Purpose AI Code of Practice
Industry-led best practices or codes of conduct

6. Does your organization collaborate with relevant stakeholders across sectors to assess and adopt risk mitigation measures to address risks that could have broad and potentially cascading socio-economic impacts? Please indicate which stakeholders you collaborate with, and whether collaboration is on a standing basis (Always-on), activated based on context (Ad hoc/as relevant), or there is no current collaboration.

	Always-on	Ad hoc / as relevant
Relevant employees (security, legal/compliance, etc.)	✓
Public authorities / regulators / AI safety institutes / other public sector bodies and inter-governmental coordination structures		✓
Industry partners or industry fora		✓
Users (end users, enterprise customers, developers using APIs)
Business customers / deploying organizations (if different from “users”)	✓
Supply-chain partners (cloud, data providers, etc.)		✓
Academia / researchers		✓
Independent auditors		✓
Standards bodies / multi-stakeholder initiatives (OECD.AI; ISO/IEC; IEEE; AIID etc.)		✓
Independent civil society organizations (e.g., for evaluations, audits, or policy review)
Media / general public (people or communities indirectly impacted)
Other(s) (please add any other relevant stakeholder groups):
Not applicable

Please describe examples of how your organization collaborates. Examples may include: participating in multi-stakeholder or industry initiatives; partnering with academia, civil society, or the public sector; establishing internal or joint governance structures with external experts or in partnership with other efforts to share knowledge and jointly address risks.

League collaborates with healthcare payer and provider customers to align AI deployments with the risk tolerance and compliance requirements of regulated healthcare environments; engages the broader healthcare-AI ecosystem to share responsible-deployment learnings; staff hold credentials with and speak at IAPP conferences and engage the Vector Institute; League participates in the public-private AI innovation & research program ScaleAI; and the cross-functional AIGC reviews and approves mitigations, reporting quarterly to the Governance Committee of the Board of Directors which includes external experts and advisors.

Any further comments and implementation documentation.

No answer provided

Section 2 - Risk Management and Information Security

7. Across the AI system lifecycle, what steps does your organization take to manage risks and vulnerabilities? Please indicate which specific practices, tools or metrics your organization uses at each lifecycle stage. You may refer to tools or metrics present in the OECD.AI Catalogue of Tools and Metrics or suggest additions. Respondents may complete only the lifecycle stages relevant to their organisation's role. Stages that do not apply may be left blank.

Plan and design

OneTrust AI GovernanceNIST AI RMF Playbook

Collect and process data

OneTrust AI GovernanceAmount of Leaked InformationAnonymity Set Size

Build, integrate and interpret model

MITRE AtlasOWASP Top 10 for Large Language Model ApplicationsAccuracy

Verify and validate

MITRE AtlasOWASP Top 10 for Large Language Model ApplicationsAccuracy

Deploy

Operate and monitor

OneTrust AI Governance

Please provide a consolidated description of your organisation's approach to risk management across the AI system lifecycle, including how the practices identified above operate together and any cross-cutting governance, review or escalation processes. Please also indicate how often these practices are reviewed and what types of events trigger reviews and updates. Where relevant, please distinguish between different types of AI systems (e.g. generative or agentic AI).

AI-specific controls are integrated into League's broader information-security program under the Risk Management Policy and the Responsible AI Feature Deployment and Operations Policy, aligned to NIST AI RMF 1.0. The process flows from Privacy and AI Impact Assessment (PAIA) intake to an AI Risk Inventory, to TEVV, to AIGC approval, to runtime monitoring. The AIGC reviews the overall posture quarterly; policies are reviewed at least annually and ad hoc on material change or incident. Generative and agentic systems receive additional controls: configurable guardrails, prompt-injection/exfiltration/excessive-agency detection, and human-in-the-loop review of high-risk actions.

Please describe any measures used to ensure data quality and fairness across the data collection and curation stage (e.g., dataset audits, filtering training data to remove harmful content or personal information, fine-tuning on curated data, use of moderation tools, assessment of limitations to model generalisability).

League invests in curated reference standards ('Golden Datasets') to measure accuracy and detect bias and drift; clinical and content subject-matter experts are embedded in AI development; synthetic data is used by default for development and testing; no personal data is used for training or development; and fairness/bias is evaluated in TEVV and AIGC approval, including usability evaluations with representative users, consistent with the NIST AI RMF.

8. What security measures are used in testing AI systems?

Isolated and secure test environments
Network isolation from external access
Controlled environments for red-teaming and adversarial testing
Containment measures for prompt-injection and jailbreak attempts
Controlled security vulnerability testing
Access controls, including roles-based permissions
Audit logging and monitoring
Use of synthetic, anonymized, or dummy data, as appropriate
Isolation of staging environments (from production / operational environments)
Human-in-the-loop controls for higher-risk test cases
Restrictions on outbound Internet or API access, including a list of permitted domains or APIs

8.A. Please indicate, if relevant, the team or role responsible for overseeing secure testing and whether this responsibility is shared across multiple teams and/or functions.

League's Security Engineering team performs internal red-teaming and vulnerability testing as part of the Test, Evaluation, Validation, and Verification (TEVV) process as well as continuously, and additional platform penetration testing and red teaming is performed by a qualified independent third-party assessor. The cross-functional AI Governance Committee (AIGC) — composed of senior leadership from Legal, Compliance, Privacy, Security, Product & Design, and Engineering & Data — oversees secure testing, reviews TEVV results, and provides final deployment sign-off. This responsibility is shared across Security Engineering, the AIGC, and the Engineering & Data team.

9. How does your organization protect intellectual property, including copyright-protected content?

9.A. Safeguards that promote lawful data use and transparency in AI training:

Maintain a copyright policy that addresses data sourcing, content provenance, safeguards, and organizational roles and responsibilities
Publishing “model cards” or contextual information on training data and model limitations
Refrain from the unlawful circumvention of technological protection measures in data sourcing
Conduct data cleaning, qualification, and/or tokenization activities as part of a transformative data preparation process
Consult and/or retain an intellectual property attorney to protect, enforce, and comply with, intellectual property rights.
Other(s) (please specify): League currently utilizes third-party foundational models with RAG (no self-training; no training on customer data without permission); enterprise GenAI agreements contractually bar providers from training on League prompts/outputs; open-source license compliance review for GenAI-generated code; and user-facing transparency (data-source disclaimers, e.g., “this information is from your benefits booklet dated…”).

9.B. Safeguards that reduce the risk of dissemination of outputs that may infringe copyright:

Restricting outputs that raise ethical, human rights, or legal concerns—such as non-consensual intimate imagery, unauthorized deepfakes, or outputs that are substantially similar to copyrighted works.

10. How do you protect privacy and prevent your systems from disclosing confidential or sensitive data across the AI lifecycle?

Make information about data privacy, practices, and controls accessible to a diverse set of stakeholders
Use security controls, including encryption at rest and in transit
Provide organizational customers with controls to configure and implement privacy choices (e.g., data retention, logging, access, or processing settings)
Apply Privacy-Enhancing Technologies (PETs) where applicable (e.g. differential privacy, federated learning, synthetic data generation, homomorphic encryption)

Describe key privacy measures and data-protection standards applied.

Field-level encryption, de-identification / anonymization techniques, Privileged Access Management (PAM) least-privilege/time-limited access, data minimization, and disclosure-prevention guardrails. Standards: HIPAA, PIPEDA, GDPR (and EU-US DPF / UK Extension/Swiss Extension), SOC 2 Type 2, HITRUST r2, ISO/IEC 27001, plus CCPA/CPRA, Australia and the NZ Privacy Act — governed by the Privacy & Data Protection Policy.

11. How does your organization assess cybersecurity risks and implement policies to enhance the cybersecurity of advanced AI systems across the AI system lifecycle? Respondents may complete the checkbox subsections in 11.A–11.D or describe their overall approach under 11.E.

11.A. Governance, policy and assessments

Perform threat modeling that includes AI-specific risks (e.g., data poisoning, prompt injection)
Conduct regular cybersecurity risk and vulnerability assessments tailored to AI models or systems
Maintain or update security policies aligned with recognized standards (e.g., NIST CSF, ISO/IEC 27001, SOC 2, CIS Critical Security Controls), and review them regularly in response to emerging risks or regulatory guidance
Maintain vulnerability management processes (scanning, channels for external reporting, patching, remediation)
Implement incident response, disaster recovery, or business continuity plans, including escalation procedures for high-severity incidents
Train staff on cybersecurity best practices and AI-specific threats, including how to recognize and respond to misuse or unintended outcomes of advanced AI systems
Integrate cybersecurity AI risks into broader cybersecurity risk management activities
Regularly review security measures and update them in response to emerging risks, incidents, or major releases

11.B. Technical and operational controls

Conduct security testing focused on AI-specific risks (e.g., red-teaming, adversarial testing, stress tests)
Conduct secure AI development and/or deployment practices
Monitor system activity and log access to detect anomalies or misuse
Restrict physical access to servers, GPUs, or devices hosting AI models, systems, and/or applications
Encrypt AI assets (datasets, models, configurations) in storage and in transit as appropriate
Apply multi-factor authentication (MFA) and role-based access controls for advanced AI systems

11.C. Protection of sensitive or high value AI assets

Limit access to proprietary AI assets based on role or need-to-know
Store model weights, datasets, and algorithms in secure, access-controlled environments
Use hardware security modules (HSMs) or trusted execution environments (TEEs) where feasible
Require NDAs or confidentiality agreements for staff and contractors with access
Track and log access to sensitive AI resources

11.D. Insider risk protection detections

Conduct pre-employment screening or role-sensitive vetting
Monitor for unauthorized internal access or suspicious activity
Provide staff training on cybersecurity best practices and AI-specific threats
Implement insider-risk escalation or response procedures

11.E. Please describe the main security measures your organization applies and indicate which are specific to particularly sensitive AI assets, where relevant.

Main measures: MFA, encryption at rest (AES-256) and in transit (mutual TLS) with keys managed in Google Cloud, RBAC/PAM least-privilege, continuous monitoring and audit logging, secure SDLC, and independently audited controls (SOC 2 Type 2, HITRUST r2, ISO 27001). AI-specific: real-time dual-layer guardrails; prompt-injection/exfiltration/excessive-agency detection; agent activity baselining; read-only agents with restricted access to retrieval content and configurations; sensitive data detection and redaction.

12. What is your organization's vulnerability management process? Does your organization take actions to address identified risks and vulnerabilities, including in collaboration with other stakeholders?

Internal vulnerability disclosure receipt and tracking processes
Bug bounty or incentive programs for external reporters
Investigation of reported or identified risks and vulnerabilities
Development of patches or other mitigations for confirmed risks or vulnerabilities
Testing of patches or other mitigations
Scanning for and mitigation of similar risks or vulnerabilities
Reporting to regulators / authorities when relevant
Recognition of external finders of confirmed risks or vulnerabilities
Defined escalation criteria and follow-on actions for identified vulnerabilities (e.g., for external reporting or information sharing)

13. What post-deployment practices does your organization use to monitor and respond to vulnerabilities, incidents, emerging risks and misuse of advanced AI systems?

Conduct post-deployment monitoring
Perform root-cause analysis and apply lessons learned to improve future development and/or deployment practices
Monitoring and emergency controls specific to agentic AI systems (e.g., ability to interrupt autonomous action sequences, override tool-use permissions, or revoke delegated authority)

14. Do you develop or deploy agentic AI systems (systems that can autonomously plan/act or use tools)?⁴

Yes

14.A. If yes, please indicate which categories of controls your organization applies. Please select all.

Constraints on the agent's action space (e.g., tool-use permissions, environment sandboxing, allowlists/blocklists of resources, scope limits per task)
Human oversight or interruptibility mechanisms (approval requirements for sensitive actions, escalation paths, interruption interfaces)
Monitoring (anomaly detection, multi-agent interaction monitoring)
Logging of agent actions

Please provide any further comments and implementation documentation.

League's member-facing AI operates as a multi-agent system — a Concierge agent routes to specialised sub-agents, including the Health Coach — governed by the Guarded Conversation framework. Action-space constraints: sub-agents are read-only, tenant-scoped, and limited to approved tools and retrieval content, with PHI excluded from tool outputs and excessive-agency detection. Human oversight: high-risk interactions escalate to tenant-configured human support, guardrail-blocked messages surface a member-visible notice, and emergencies route to local emergency services (non-configurable). Monitoring: runtime monitoring, agent activity baselining, drift detection, and automated incident triage. Logging: full conversation transcripts are retained for audit.

Section 3 - Transparency Reporting on Advanced AI Systems

15. Does your organization publish public reports and/or technical documentation related to the capabilities, limitations, and domains of appropriate and inappropriate use of advanced AI systems? Are these clear and understandable by non-technical audiences?

Yes

15.A. If yes, which of the following information is included in your organization’s publicly available documentation for any of your AI products?

Risk management policies
Capabilities, behaviours, and limitations, including domains of appropriate and inappropriate use or indicative thresholds associated with systemic risks.
Plain-language or non-technical summaries

Please provide links or references showing where this information is made public.

League's public AI documentation is available at the Trust Center (trust.league.com) and the Responsible AI Principles (league.com/ai-policy/), covering AI training data, bias, AI security, monitoring, risk management, governance, responsible AI, third-party AI diligence, and employee AI usage.

15.B. If yes, how often are such reports usually updated?

Time-based cadence (e.g., quarterly, biannually)

16. How does your organization share information with a diverse set of stakeholders (other organizations, governments, civil society and academia, etc.) regarding the outcome of evaluations of risks and impacts related to an advanced AI system?

Public documentation
Protected information sharing
Regulatory reporting as relevant
Direct engagement with AI safety institutes, civil society or academic partners

Describe how evaluation results are shared and with which stakeholders (e.g. other organizations, governments, civil society and academia, etc). You may also indicate whether non-technical or plain-language summaries are provided for broader audiences.

League shares AI-governance status with its Board quarterly via the Audit and Governance Committees. Customers receive AI capability, limitation, and evaluation disclosures through product documentation, the Trust Center, and contractual agreements (including transparency reports on request). Internally, awareness campaigns, mandatory training, and organization-wide communications ensure staff understand League's AI practices. Plain-language summaries are provided through the Responsible AI Principles.

17. Does your organization publish public privacy policies addressing the use of personal data, user prompts, and/or the outputs of advanced AI systems?

Yes

If yes, provide links to privacy policies or notices covering personal data, user inputs, and AI-generated outputs.

League's public privacy policies are published at https://league.com/privacy-policy/ (Website Privacy Policy) and https://league.com/privacy-policy-platform/ (Platform Privacy Policy), with additional disclosures via the Trust Center (trust.league.com) and the AI Policy (https://league.com/ai-policy/). Privacy notices covering personal data, user inputs, and AI-generated outputs are surfaced in the customer-branded applications that deploy League's AI features.

18. How does your organization provide information about the sources of data used for the training of advanced AI systems, as appropriate, including information related to the sourcing of data annotation and enrichment?

Public documentation
Protected information sharing
Regulatory reporting as relevant

Please provide links to any publicly available information.

At this time, League uses third-party foundation models (Google Gemini and Claude Sonnet, both via Vertex AI) and does not fine-tune or train them on personal or customer data; production AI features run on unmodified foundation models with curated retrieval (RAG) content. Public information on League's data approach is available at the Trust Center (trust.league.com); foundation-model training-data sourcing is documented by the provider (Google model cards).

19. Does your organization demonstrate transparency related to advanced AI systems through any other methods?

Yes

If yes, describe additional method(s), including where relevant transparency measures related to AI agents

In addition to published documentation, League discloses AI use in-product: design standards require AI-generated content and AI agent interactions to be clearly labelled to end users via UI elements and notices, in alignment with applicable law and the Responsible AI Principles. Because features are delivered through customers' branded applications, customers also surface applicable privacy notices. League provides customer-facing product documentation and transparency reporting on request.

20. Does your organization publish statistical insights derived from anonymised, aggregated usage data to advance understanding of AI adoption and its economic impacts in areas including occupations and tasks by region, sector and country? To this end, do you contribute to international cooperation efforts?

Not applicable

Please estimate the total staff time and annual expenses associated with conducting compliance activities and include any further comments and implementation documentation (optional).

No answer provided

Section 4 - Organizational Governance, Incident Management, and Transparency

21. How has AI risk management been embedded in your organization's governance framework?

Board of Directors oversight
Executive oversight
Senior management oversight
Governance council or committee

Please describe how AI risk management is integrated into governance structures, including: which roles or bodies have advisory versus decision-making authority; which roles or bodies have final accountability for AI risk-related decisions; and how often policies are reviewed or updated (e.g., following major incidents, regulatory changes, or material updates to systems).

The AIGC — cross-functional membership from Compliance, Privacy, Legal, Product, Security, and Engineering, chaired by the CTO — oversees AI risk and deployment decisions, with its charter formalizing responsibilities and decision rights. Board-level oversight occurs quarterly through the Audit and Governance Committees. An AI Risk Inventory tracks all known AI risks and mitigation status, and the Code of Conduct sets ethical-AI obligations for all employees. Policies are reviewed at least annually and ad hoc following material incidents, regulatory changes, or system changes.

22. Are relevant staff trained on your organization's governance policies and risk management practices?

Yes

If yes, describe training methods (e.g., onboarding modules, regular sessions, and confidential channels to report concerns).

Mandatory new-hire training covers AI governance, data privacy, the Responsible AI Feature Deployment and Operations Policy, and the GenAI Tools Policy. Mandatory annual compliance and privacy refreshers are delivered through League's LMS and include AI-specific obligations, supplemented by continuous monthly modules. Targeted role-based training is delivered to Product and Engineering. Ongoing AI literacy is provided through an internal technical training platform containing industry leading content on responsible AI development as well as departmental budgets for external training and relevant professional certifications. Confidential reporting channels — an anonymous whistleblower hotline and a security-event reporting process — are available to all staff.

23. Are steps taken to address reported incidents documented and maintained internally?

Yes

If yes, describe how incident records are kept and used for follow-up (e.g., incident logs, root-cause analysis reports, internal tracking systems). You may indicate whether and how you define escalation thresholds for when incidents must be surfaced to senior leadership or external parties.

Incident-response procedures require documentation of all steps taken, including root-cause analysis and remediation, retained in League's issue-tracking and compliance systems. Incidents are classified by severity with defined maximum response times that drive escalation according to internal and contractual Service Level Agreements (SLA's). The AIGC reviews significant AI-related incidents, and material incidents are escalated to senior leadership and the Board, and reported to affected parties and regulators where legally required (e.g., HIPAA breach notification).

24. Does your organization share research and best practices on addressing or managing risk?

Yes

If yes, describe how research or good practices are shared (e.g., publications, conferences, collaborations with other sectors).

League shares responsible-AI learnings across the healthcare-AI ecosystem, engaging payer and provider organizations on responsible deployment in regulated environments. Key staff hold professional credentials with, attend, and speak at IAPP conferences, engage in research consortiums such as the Vector Institute, and participate in public-private innovation & research programs like ScaleAI. Generalized AI-safety learnings are shared through industry forums and publications, within confidentiality constraints.

25. Does your organization use international technical standards or best practices for AI risk management and governance policies?

Yes

If yes, please indicate which standards or frameworks apply:

ISO/IEC standards (e.g., ISO/IEC 27001, ISO/IEC 42001)
NIST AI Risk Management Framework (AI RMF)
OECD AI Principles
Industry-led best practices or codes of conduct

If yes, describe which international technical standards or best practices your organization uses.

League's AI-governance baseline is the NIST AI Risk Management Framework 1.0 (formal compliance assessment completed). League maintains ISO/IEC 27001 certification and references the OWASP Top 10 for LLMs (and the OWASP Top 10 for Agentic Applications) and MITRE ATLAS for day-to-day detection and scoring. It aligns with the OECD AI Principles, the Hiroshima Process Code of Conduct, and ISO/IEC 42001, and monitors ISO, NIST, and the EU AI Act. League also maintains SOC 2 Type 2, HITRUST r2, and NCQA, and complies with HIPAA, PIPEDA, and GDPR.

Any further comments and implementation documentation.

No answer provided

Section 5 - Content Authentication & Provenance Mechanisms

26. What mechanisms, if any, does your organization put in place to allow end-users, where possible and appropriate, to know when they are interacting with an advanced AI system developed by your organization?

User disclosure (e.g., text notice, verbal statement, or system label)
Persistent visual or audio indicators (e.g., watermark, icon, chime, banner) during AI interaction
Distinct branding or labeling for AI-generated content (e.g., “AI-generated” tag, metadata label)
Documentation or FAQs explaining when and how AI is used in the system

Provide any additional details or context on how or when users are informed they are interacting with advanced AI systems (e.g. if such mechanisms are planned, in testing, or applied only to certain products).

League discloses AI use at the point of interaction through product UI elements and notices that identify AI-powered interactions, in alignment with applicable law and the Responsible AI Principles. In the Health Coach experience these include: an AI-identifying welcome message; an enhanced, persistent AI disclosure label shown beneath the chat input at all times; and a member-visible notice when a guardrail blocks a message. A tenant-configurable AI consent screen is available at the start of the chat. Design standards require AI-generated content and AI agent interactions to be clearly labelled. Because features are delivered through customers' branded applications, customers also surface applicable notices. League continues to align disclosure practices with emerging standards and regulatory requirements.

27. Does your organization use content provenance detection, labeling or watermarking mechanisms that enable users to identify content generated by advanced AI systems?

Not applicable

Any further comments and implementation documentation.

No answer provided

Section 6 - Research & Investment to Advance AI Safety & Mitigate Societal Risks

28. Does your organization advance research and investment in the following areas?

Security
Safety
Data quality and representativeness
System performance and outcomes (e.g. accuracy, consistency)
Explainability or interpretability
Transparency
Robustness or reliability

If yes, please describe key research or investment initiatives in the areas selected above (e.g., dedicated safety teams, funding of research programs, contributions to open-source safety tools, publishing research, partnerships and collaborative research initiatives). You may also indicate whether related outputs are publicly shared, shared with partners or within consortia or not publicly disclosed.

League's R&D investment spans: retrieval-augmented generation (RAG) to ground responses in approved, customer-specific content; privacy-first development practices (unmodified third-party foundation models with RAG; no proprietary model training); a real-time dual-layer guardrail system (deterministic rule engine + LLM-as-judge) for safety and robustness; curated reference standards and rubrics with continuous TEVV to benchmark accuracy, safety, and bias; and applied privacy-preserving techniques (e.g. redaction, tokenization, synthetic data, differential privacy techniques, data provenance and labeling). Explainability and transparency are evaluated within the TEVV process.

29. Does your organization pursue research or investment related to socio-economic or environmental considerations in the development and deployment of AI?

Socio-economic considerations (e.g., AI adoption and productivity, workforce transitions, skills development, access to AI tools)
Environmental considerations (e.g., energy use, computational efficiency, resource use)

If yes, please provide examples of relevant research or investment initiatives for the areas selected above.

Environmental: League reduces the energy and inference footprint of its AI features by selecting efficient third-party foundation models (e.g., Gemini Flash) paired with retrieval-augmented generation rather than larger general-purpose models; its ESG Policy governs the broader environmental approach.
Socio-economic: League's accessibility approach aims to bring high-quality healthcare guidance to underserved populations through scalable digital tools; the training and awareness program, and general staff resourcing, tooling and project work supports workforce transitions and skills development with foundational AI literacy, use-case guidance, and ongoing learning.

Any further comments and implementation documentation.

No answer provided

Section 7 - Advancing Human and Global Interests

30. Does your organization support any digital literacy, education or training initiatives to improve user awareness and/or help people understand the nature, capabilities and limitations of advanced AI systems?

Yes

If yes, describe any digital literacy or training initiatives your organization supports (e.g., user education, public AI-education programs, school or university partnerships, community workshops). You may also indicate whether these efforts include or prioritise underserved or underrepresented communities.

In addition to workforce training, League staff routinely participate in and speak in an educational capacity at professional organizations.

31. Does your organization pursue AI projects that aim to deliver societal or public benefits, including through partnerships with civil society and community groups?

Yes

If yes, please provide examples, including any collaborations with civil society, community groups, or efforts to address broader societal challenges.

League is currently partnering with leading healthcare delivery organizations, including non-profits, to evaluate the responsible deployment of advanced AI systems to deliver the benefits and potential of such systems to patients and the broader society

Any further comments and implementation documentation.

No answer provided

Back to reports