End User Terms

AIMS-in-a-Box

• Effective date: 9 September 2026
• Last reviewed: 9 September 2026
• Version: 1.0

Please read these terms carefully. By installing, accessing or using AIMS-in-a-Box, you agree to be bound by them. If you are agreeing on behalf of an organisation, you confirm that you have authority to bind that organisation, and “you” means that organisation.

Section 9 is important and unusual, and you should read it before installing. The App is a tool for organising an AI Management System. It does not certify compliance with anything, and it is not legal advice.

1. Parties and structure

1.1 These End User Terms (“Terms”) form a binding agreement between ITSM Ltd, a company registered in England and Wales under company number 17339600 whose registered office is at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF (“we”, “us”, “our”), and you, the customer identified in the applicable Atlassian Marketplace order (“you”, “your”).

1.2 The App is licensed to you by us, not by Atlassian. Atlassian is not a party to these Terms and has no obligation or liability to you in respect of the App.

1.3 The following documents are incorporated into these Terms by reference:

1.4 Where there is a conflict, the order of precedence is: (a) any signed order form or amendment between us; (b) the Data Processing Agreement; (c) these Terms; (d) the incorporated documents listed in clause 1.3.

1.5 These Terms are in addition to, and do not replace, your agreement with Atlassian for the underlying Atlassian product. Nothing in these Terms modifies the Atlassian Cloud Terms of Service or the Atlassian Marketplace Terms of Use.

2. Definitions

“App” means AIMS-in-a-Box, including its Forge modules, documentation and any updates we make available. “Atlassian” means Atlassian Pty Ltd, Atlassian Corporation and their affiliates. “Forge” means the Atlassian Forge application platform on which the App runs. “Your Data” means data originating from your Atlassian site that the App reads or stores, together with the configuration and governance data you enter into the App. “Generated Document” means a document the App assembles from Your Data, including an AIMS policy, a Statement of Applicability, a risk register, an AI system register, an AI system impact assessment and a roles and responsibilities document. “Subscription Term” means the period for which you hold a valid licence to the App, as recorded by Atlassian.

3. Licence grant and licensing model

3.1 Subject to your payment of applicable fees and compliance with these Terms, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable licence during the Subscription Term to install and use the App on the Atlassian site(s) covered by your licence, for your internal business purposes.

3.2 How the App is licensed. The App is licensed per agent through the Atlassian Marketplace, at Atlassian’s tiers, and Atlassian determines and enforces entitlement. The App itself contains no plan, tier, quota, seat count or feature gate. Every person who has access to it has the same capabilities; the only distinction the App makes is between read access and contribute access, which is a matter of authority within your organisation, not of price.

3.3 Evaluation and trial licences issued through the Atlassian Marketplace are granted on the same basis but are provided without charge and without warranty, and may be withdrawn at any time. Support during an evaluation or trial is provided on a reasonable-endeavours basis only, without response-time targets, as set out in the Support and Maintenance Description.

3.4 What happens if your licence lapses. If your subscription lapses or is not renewed, the App does not delete anything and does not lock you out of your own governance record. It displays a message saying the data is intact and that an administrator can restore access from Apps → Manage apps in Jira. We do not degrade features, hide records or destroy data on the basis of a licence signal; enforcing the licence is Atlassian’s function, not a second and weaker enforcement in our code. This clause describes the App’s behaviour as at the effective date; if it changes, we will give notice under clause 12.2.

3.5 Who may be granted access. Access to the App within your site is granted by your own Jira project administrators, and may be granted to any Atlassian account they can select. You are responsible for ensuring that the people you admit to the App are appropriately licensed for your Atlassian products and appropriate to hold access to your AI governance record. Section 6.2 of the Cloud Security Statement describes the access model in full, including one consequence you should weigh before installing: an administrator of any single project on your site can admit a person to the whole AI Management System.

3.6 We reserve all rights not expressly granted. The App is licensed, not sold. We and our licensors retain all intellectual property rights in the App.

4. Restrictions

You must not, and must not permit any person to:

• (a) copy, modify, translate or create derivative works of the App;
• (b) reverse engineer, decompile or disassemble the App, or attempt to derive its source code, except to the extent this restriction is prohibited by applicable law;
• (c) rent, lease, lend, resell, sublicense, distribute or provide the App as a service bureau or on a time-share basis to any third party;
• (d) remove, obscure or alter any proprietary notice, or remove or suppress any disclaimer the App displays or prints on a Generated Document;
• (e) circumvent, disable or interfere with any security, licensing, metering or access-control feature of the App or of the Atlassian platform;
• (f) use the App to store or transmit unlawful, infringing or malicious material, or in breach of any applicable law or of the Atlassian Acceptable Use Policy;
• (g) use the App in a manner that imposes an unreasonable or disproportionate load on the Forge platform, or that is designed to defeat platform quotas or rate limits;
• (h) benchmark or publish performance results relating to the App without our prior written consent; or
• (i) use the App to develop a competing product.

Clause (d) is not a formality. The disclaimers the App prints on a Generated Document are the basis on which that document is supplied to you, and removing one before passing the document to an auditor, regulator or customer misrepresents what it is.

5. Platform limits, quotas and availability

5.1 Forge quotas and limits. The App runs on the Atlassian Forge platform and is subject to platform quotas and limits set by Atlassian, including limits on function invocation time, memory, payload size, storage volume and storage operation rates. These limits are set and varied by Atlassian, not by us.

5.2 Atlassian Platform rate limits. The App’s interactions with Jira are subject to Atlassian’s REST API rate limits and, where applicable, per-app rate limits.

5.3 Effect on your use. Where a Forge quota or an Atlassian rate limit is reached, the App may operate more slowly, defer or retry operations, return an error, or temporarily decline to perform a requested operation. Large data volumes and high concurrency make this more likely. You acknowledge that these behaviours arise from the Atlassian platform and that we cannot vary Atlassian’s quotas or limits. We will design the App to degrade gracefully and to surface meaningful messages where a limit is reached, and we will use reasonable endeavours to work within published limits, but we do not warrant uninterrupted operation and we are not liable for the consequences of Atlassian platform limits.

5.4 Platform dependency. Availability of the App depends entirely on the availability of the Atlassian Cloud and the Forge platform. We do not offer an availability service level for the App and give no uptime commitment. Atlassian’s own service commitments, where applicable to you, are made by Atlassian under your agreement with Atlassian.

5.5 Platform change. Atlassian may change, deprecate or withdraw Forge platform capabilities, APIs, modules or storage services at its discretion. Where such a change materially affects the App, we will notify you as set out in section 9.9 of the Support and Maintenance Description.

6. Fees, payment and refunds

6.1 Where the App is a Paid via Atlassian app, Atlassian is the merchant of record. Atlassian sets and collects the fees, issues invoices, administers renewals, and applies its own policies on trials, grace periods, tax and refunds. We do not process your payments and do not hold your payment card details.

6.2 Refunds and credits are administered by Atlassian in accordance with Atlassian’s refund policy, including its standard 30-day window for eligible purchases, and are granted at Atlassian’s discretion. Requests should be directed to Atlassian, not to us.

6.3 Nothing in these Terms conflicts with, or purports to override, Atlassian’s licensing mechanisms — including trial licences, grace periods, licence tiers, renewal handling and enforcement of licence status. Where these Terms and an Atlassian licensing policy differ in respect of a Paid via Atlassian transaction, the Atlassian policy prevails.

6.4 Where the App is licensed directly by us outside the Atlassian Marketplace, payment terms are 30 days from the date of invoice, and we may charge interest on overdue sums under the Late Payment of Commercial Debts (Interest) Act 1998.

7. Your data and data protection

7.1 As between you and us, you own Your Data and are responsible for its accuracy, legality and for having the necessary rights and lawful bases to process it.

7.2 The App is hosted entirely on Atlassian Forge. Your Data is stored in Forge hosted storage within Atlassian’s infrastructure and inherits your Atlassian data residency settings. The App declares no external egress domains, holds only read-only Atlassian permissions, writes nothing to any Atlassian product, and does not transmit Your Data to us or to any third party. We have no routine access to Your Data.

7.3 Where we process personal data on your behalf, we do so as processor and you as controller, on the terms of the Data Processing Agreement at https://aims.itsm-ltd.com/legal/data-processing-agreement, which forms part of these Terms. Our handling of personal data is further described in the Privacy Policy.

7.4 You are responsible for administering user access to your Atlassian site and to the App, and for configuring permissions appropriately.

7.5 The audit trail cannot be edited or deleted. The App maintains an append-only record of who changed what and when. Individual entries cannot be amended or removed by you, by your administrators, or by us. This is a deliberate design decision and it is what makes the record usable as audit evidence. It has consequences for data subject erasure requests, which are set out in clause 9.5 of the Data Processing Agreement. Satisfy yourself that this is acceptable before you install the App.

7.6 On termination — and what you can take with you. When the App is uninstalled, Forge app data is deleted by Atlassian in accordance with its platform processes. We hold no copy of Your Data and therefore cannot restore it. If you require a copy of App data, you must take it before uninstalling.

You should understand the limits of what “taking it” means:

• You can generate the App’s governance documents from your data and save each one using your browser’s print or save-as-PDF function from the App’s audit pack page. That is the whole of the export mechanism.
• There is no CSV export, no JSON export and no bulk download.
• The audit trail cannot be exported at all.
• Readiness assessment history and evidence records leave the App only insofar as they appear within a Generated Document.

8. Support and maintenance

8.1 We provide support in accordance with the Support and Maintenance Description at https://aims.itsm-ltd.com/legal/support-and-maintenance. In summary, support is provided by email only, between 09:00 and 17:00 UK time on UK business days.

8.2 Support is available only in respect of the App, only to customers holding a current licence, and only for supported versions. Response-time targets apply to paid licences only; see clause 3.3 for evaluation and trial licences.

8.3 Support covers the operation of the App. It does not extend to advising you on ISO/IEC 42001, on Regulation (EU) 2024/1689, or on how either applies to your organisation — see section 7 of the Support and Maintenance Description, and section 9 below.

8.4 We may release updates to the App. Minor updates deploy automatically across the Forge platform; major updates, and any update that adds a permission scope, require approval by your Atlassian site administrator. Release cadence, supported versions, notice of breaking changes and end-of-life notice are set out in section 9 of the Support and Maintenance Description, which we will comply with.

9. The nature of the App — what it is and what it is not

This section allocates a risk that is central to this product. Please read it.

9.1 The App is a working aid. AIMS-in-a-Box helps you organise, record and evidence an AI management system. It does not certify compliance with ISO/IEC 42001 or the EU AI Act, and it is not legal advice.

9.2 What its outputs are. The App displays these statements at the point each output is produced, and they form part of these Terms:

• Of the readiness self-assessment: “This self-assessment is an indicative readiness signal — not legal advice, and not a guarantee of EU AI Act or ISO/IEC 42001 compliance.”
• Of the EU AI Act classification: “This is a structured aid for organising obligations under Regulation (EU) 2024/1689. It is not a legal determination, and where the Act is ambiguous it takes the safer (higher) tier.”
• Of every Generated Document: “Generated from your data to accelerate your AIMS. Review and adapt before relying on it. Not legal advice.”

A Generated Document is a draft assembled from data you entered, to be reviewed and adapted by you before you rely on it or provide it to anyone. Its accuracy depends on the accuracy and completeness of what you put in.

9.3 No certification, and no conformity assessment. We are not an accredited certification body, a conformity assessment body, a notified body or an accredited auditor, and we do not act as one. Use of the App does not confer, guarantee, evidence or substitute for certification to ISO/IEC 42001, which can be granted only by an accredited certification body following its own audit, nor for any conformity assessment, registration, declaration or other procedure required under Regulation (EU) 2024/1689 or any other law.

9.4 Your systems remain yours. Recording an AI system in the App does not make us a provider, deployer, importer, distributor or authorised representative of that system for the purposes of Regulation (EU) 2024/1689 or any comparable law, and does not transfer to us any obligation attaching to those roles. You remain solely responsible for determining your own role and obligations in respect of each AI system you operate, for the classification you adopt, and for meeting the requirements that follow from it. Where the App suggests a risk tier, it does so by applying published rules to answers you supplied, taking the safer tier where the Act is ambiguous; the determination is yours.

9.5 Take your own advice. The App is not a substitute for legal, regulatory, audit or professional advice, and no relationship of adviser and client arises between us. You should obtain your own advice before relying on any output of the App in a regulatory filing, a certification audit, a contractual representation, or a statement to a customer or supervisory authority.

9.6 Changing law and changing standards. The App’s content reflects our understanding of ISO/IEC 42001 and Regulation (EU) 2024/1689 as at the date each version is released. Both the law and its interpretation develop, and guidance from supervisory authorities may change what is required. We update the App’s content from time to time, but we do not warrant that it reflects the current state of the law at any given moment, and a Generated Document reflects the position as at the moment it was generated.

9.7 Third-party standards and intellectual property. ISO/IEC 42001 is a copyright work published by ISO and IEC and licensed by them and their national member bodies. The App’s control catalogue consists of our own paraphrases, written for working use, and cites clause numbers so that you can find the corresponding provision. It does not reproduce the text of the standard, and it is not a substitute for it. To be certified against ISO/IEC 42001 you will need your own licensed copy, obtained from ISO or an authorised distributor. ITSM Ltd is not affiliated with, endorsed by, accredited by or connected to ISO, the IEC, BSI or any national standards body, and no such relationship should be inferred from the App or its documentation.

10. Warranties

10.1 We warrant that we have the right to grant the licence in clause 3, and that we will provide support with reasonable skill and care.

10.2 We warrant that the App will perform materially in accordance with its published documentation. Your exclusive remedy for breach of this warranty is that we will, at our option, correct the defect or terminate the licence and support a pro-rata refund request to Atlassian for the unused portion of your Subscription Term.

10.3 Except as expressly stated in these Terms, the App is provided “as is” and we exclude all other warranties, conditions and representations, whether express or implied by statute, common law or otherwise, including implied warranties of satisfactory quality, fitness for a particular purpose and non-infringement, to the fullest extent permitted by law. We do not warrant that the App will be uninterrupted, error-free, or that it will meet your particular requirements.

10.4 Without limiting clause 10.3, and consistently with section 9, we give no warranty that any output of the App is legally accurate, complete, current or sufficient for any regulatory, certification or contractual purpose.

10.5 Safety-critical use. The App is a record-keeping and documentation tool. It is not designed or licensed for use in the operation or control of systems where failure could lead to death, personal injury or severe environmental damage, and must not be used for that purpose.

For the avoidance of doubt, this clause restricts how the App itself may be used. It does not restrict you from recording, classifying or documenting an AI system of any kind in the App, including a system that is high-risk within the meaning of Regulation (EU) 2024/1689. Recording such systems is what the App is for.

11. Indemnity

11.1 We will defend you against any third-party claim that the App, used in accordance with these Terms, infringes that party’s intellectual property rights, and will pay damages finally awarded or agreed in settlement, provided you notify us promptly, give us sole conduct of the defence and provide reasonable assistance.

11.2 This indemnity does not apply to claims arising from: Your Data or content; modification of the App by anyone other than us; combination of the App with anything not supplied by us where the claim would not have arisen otherwise; use after we have notified you to stop; use of a free, trial or evaluation licence; or your use, publication or distribution of a Generated Document.

11.3 If a claim arises or is likely, we may at our option procure the right for you to continue using the App, modify or replace it so it is non-infringing, or terminate the licence and support a pro-rata refund request. This clause states our entire liability for intellectual property infringement.

12. Limitation of liability

12.1 Nothing in these Terms limits or excludes either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be limited or excluded.

12.2 Subject to clause 12.1, neither party is liable for loss of profit, loss of revenue, loss of anticipated savings, loss of business or business opportunity, loss of goodwill, loss or corruption of data, or any indirect or consequential loss, however arising.

12.3 Subject to clauses 12.1 and 12.2, and without limiting section 9, we are not liable for any regulatory fine, penalty, enforcement action, censure, certification failure or audit finding incurred by you, nor for any loss arising from a classification, score, assessment or document produced by the App, or from your reliance on one. Responsibility for your compliance position rests with you.

12.4 Subject to clauses 12.1 and 12.2, our total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total fees you paid for the App in the 12 months immediately preceding the event giving rise to the claim. Where the App was supplied free of charge or under a trial or evaluation licence, our total aggregate liability is limited to £100.

12.5 We are not liable for any failure, delay, degradation, data loss or unavailability caused by the Atlassian Cloud, the Forge platform, Atlassian platform quotas or rate limits, or any act or omission of Atlassian.

12.6 You acknowledge that these limitations are reasonable given the fees charged, the nature of the App as a working aid rather than a source of advice, and the allocation of risk between us.

13. Term, changes and termination

13.1 These Terms take effect when you first install or use the App and continue for the duration of your Subscription Term.

13.2 Changes to these Terms. We may amend these Terms. We will publish the amended version and update the effective date. Where a change materially reduces your rights or increases your obligations, we will give at least 30 days’ notice before it takes effect, and the change will not apply retrospectively or materially reduce our obligations during your then-current Subscription Term. Continued use after the notice period constitutes acceptance.

13.3 Termination by you. You may terminate at any time by uninstalling the App. Fees already paid to Atlassian are refundable only under Atlassian’s refund policy. Take any export you need first — see clause 7.6.

13.4 Termination by us. We may suspend or terminate the licence immediately on written notice if you materially breach these Terms and, where the breach is capable of remedy, fail to remedy it within 14 days of notice; or immediately if you become insolvent or cease trading.

13.5 End of life. We may discontinue the App on 90 days’ written notice to the technical contact recorded on your licence. Where the App is discontinued during a paid Subscription Term, we will support a pro-rata refund request to Atlassian for the unused portion.

13.6 Effect of termination. On termination you must cease use and uninstall the App. Clauses 4, 7.6, 9, 10.3, 10.4, 11, 12, 14 and 15 survive.

14. General

14.1 Assignment. You may not assign these Terms without our written consent. We may assign them to an affiliate or in connection with a merger, reorganisation or sale of substantially all our assets.

14.2 Publicity. We will not use your name or logo as a reference without your prior written consent.

14.3 Notices. Notices to us must be sent to support@itsm-ltd.com. Notices to you will be sent to the technical or billing contact recorded on your Atlassian licence.

14.4 Force majeure. Neither party is liable for failure to perform caused by events beyond its reasonable control.

14.5 Entire agreement. These Terms and the incorporated documents constitute the entire agreement between us in respect of the App and supersede all prior discussions. Nothing in this clause limits liability for fraudulent misrepresentation.

14.6 Third-party rights. No person other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce these Terms, save that Atlassian may enforce clause 1.2.

14.7 Severance. If any provision is held invalid or unenforceable, it is severed and the remainder continues in force.

14.8 Waiver. No failure or delay in exercising a right constitutes a waiver of it.

14.9 Export and sanctions. You must comply with all applicable export control and sanctions laws, and confirm you are not located in, or acting on behalf of a person in, a sanctioned territory.

15. Governing law and jurisdiction

15.1 These Terms and any dispute or claim arising out of or in connection with them, including non-contractual disputes, are governed by the laws of England and Wales.

15.2 The courts of England and Wales have exclusive jurisdiction, save that either party may seek injunctive relief in any court of competent jurisdiction.

Published in accordance with the Atlassian Marketplace Partner Agreement. Read alongside the Privacy Policy, Cloud Security Statement and Support and Maintenance Description for AIMS-in-a-Box.