AI & AUTOMATION SYSTEMS ADDENDUM

This AI & Automation / Managed Intelligence Services Addendum ("Addendum") supplements the IMPACT Master Services Agreement ("MSA"). In the event of any conflict between this Addendum and the MSA, this Addendum shall govern solely with respect to AI, automation, and managed intelligence services, in accordance with the order of precedence set forth in MSA Section 2.5. Capitalized terms not defined herein shall have the meanings set forth in the MSA.

This Addendum applies only to the extent AI & Automation services are expressly described in, and provided pursuant to, an executed Order. In the absence of an executed Order for AI & Automation services, this Addendum shall have no force or effect.

1. DEFINITIONS

"AI & Automation Services" means the design, configuration, deployment, integration, monitoring, or support of artificial intelligence tools, automation platforms, workflows, scripts, agents, and decision-support systems.

"AI Platforms" means third-party platforms or tools used in connection with AI & Automation Services, including but not limited to Microsoft Power Automate, n8n, Hatz.AI, large language models, automation engines, application programming interfaces, and related services.

"Inputs" means any data, content, prompts, instructions, files, records, or other materials submitted by or on behalf of Client to an AI Platform in connection with the AI & Automation Services.

"Outputs" means any recommendations, classifications, insights, decisions, actions, or results generated by AI or automation systems in response to Inputs.

"Sub-Processors" means the third-party AI Platforms, model providers, hosting providers, and other vendors engaged by IMPACT in connection with the delivery of AI & Automation Services. The current list of Sub-Processors, together with links to their applicable terms, is maintained at a URL designated by IMPACT and may be updated from time to time.

2. NO PROFESSIONAL OR DECISION-MAKING SERVICES

Client acknowledges and agrees:

AI & Automation Services are tools and enablement services, not professional advice;
Outputs are informational and assistive only;
IMPACT does not provide legal, financial, HR, medical, regulatory, or other professional advice through AI & Automation Services;
Client retains sole responsibility for decisions, actions, approvals, and outcomes informed by Outputs.

IMPACT does not guarantee the accuracy, completeness, currency, or suitability of Outputs. Client expressly acknowledges that AI systems are known to produce incorrect, fabricated, biased, or misleading Outputs (commonly referred to as "hallucinations"), and that Client is solely responsible for verifying Outputs before relying on them in any decision with material consequence.

3. HUMAN OVERSIGHT REQUIRED

Client is solely responsible for:

reviewing Outputs before reliance;
approving automated actions, particularly those affecting financial transactions, employment, customer relationships, or regulated decisions;
monitoring workflows and agents on an ongoing basis;
implementing appropriate internal controls, including segregation of duties, approval workflows, and audit logging;
defining and enforcing Client's own acceptable-use policies for AI & Automation Services within Client's organization.

Client acknowledges that AI and automation systems may:

produce incorrect, fabricated, or unexpected results;
act on incomplete, biased, or stale data;
change behavior over time due to upstream platform updates, model retraining, or vendor configuration changes;
exhibit non-deterministic behavior, such that the same Input may produce different Outputs on different occasions.

4. AUTOMATION RISK ACKNOWLEDGMENT

Client acknowledges that automation may:

execute actions at scale and at high velocity;
modify, delete, or transmit data;
trigger downstream systems, integrations, or communications, including communications to Client's customers, employees, or third parties;
propagate errors rapidly across systems before human intervention is possible.

IMPACT shall not be responsible for damages arising from:

Client-approved automations operating as designed;
improper configuration Inputs supplied by or on behalf of Client;
inadequate internal controls;
Client's failure to monitor automation outcomes or to implement appropriate stop, alert, or rollback mechanisms.

Schedule G sets forth a library of Risk Acknowledgments that may apply to the Services governed by this Addendum, including G.17 (AI Output Limitations), G.18 (Autonomous Automation Action Without Human Approval), and G.19 (Unmonitored or Unmanaged Automation Tolerance). An Acknowledgment becomes binding only when invoked and initialed in accordance with Schedule G Section 1.1 on an Order, Variance Sheet, Assignment Zones Attachment, or Risk Acknowledgment Form. Nothing in this Section 4 requires execution of an Acknowledgment, and the absence of an executed Acknowledgment does not expand IMPACT's obligations or responsibility under this Addendum.

5. DATA HANDLING, INPUTS & OUTPUTS

5.1 Ownership of Inputs

As between the Parties, Client retains all right, title, and interest in and to Inputs, subject to the licenses granted in this Section. Nothing in this Addendum or the MSA transfers ownership of Inputs to IMPACT.

Client grants IMPACT a limited, non-exclusive, royalty-free license to access, transmit, process, store, and submit Inputs to AI Platforms solely as necessary to deliver the AI & Automation Services, comply with legal obligations, and enforce this Agreement.

5.2 Ownership and Permitted Use of Outputs

As between the Parties, Outputs generated specifically for Client through the AI & Automation Services are deemed Client-owned upon full payment of all applicable fees, subject to the following:

(a) Client's ownership of Outputs is subject to the rights, licenses, and restrictions of the underlying AI Platform vendor or model provider, which may include limitations on commercial use, redistribution, or use in competing products. IMPACT does not warrant that any particular AI Platform's terms grant Client any specific scope of ownership or use rights.

(b) Outputs do not constitute professional advice, certified information, or guaranteed factual statements, and ownership of an Output does not validate the Output's accuracy or fitness for any particular purpose.

(c) Generic methodologies, prompt frameworks, automation patterns, model-tuning techniques, and reusable templates developed or used by IMPACT in connection with the AI & Automation Services remain IMPACT's intellectual property in accordance with MSA Section 13 and Section 8 of this Addendum, even where applied to Client-specific use cases.

IMPACT shall not, and shall not knowingly permit any AI Platform engaged by IMPACT to, use Client Inputs or Outputs to train, fine-tune, or improve general or shared machine-learning models accessible to other customers, except as expressly authorized by Client in writing.

Where an AI Platform's standard terms of service permit such use, IMPACT shall, where commercially reasonable, configure the AI Platform to opt out of such use prior to processing Client Inputs, or shall disclose to Client that opt-out is not available so that Client can make an informed decision regarding the use of such AI Platform. Client acknowledges that some AI Platforms do not offer opt-out from training-data use as a feature, in which case IMPACT will so disclose and Client may elect not to use that AI Platform for Inputs Client deems sensitive.

For clarity, this Section does not prohibit the use of Inputs or Outputs to train, fine-tune, or operate a Client-dedicated model, instance, workspace, or fine-tune that is logically segregated from other customers' data and used solely for Client's benefit.

5.4 Prompts, Instructions, and Configuration Confidentiality

Custom prompts, system instructions, agent configurations, automation workflow logic, and similar configurations developed for Client in connection with the AI & Automation Services ("Custom Configurations") are Confidential Information of both Parties and are subject to MSA Section 12:

(a) The substantive business logic, decision rules, and Client-specific operational requirements embedded in Custom Configurations are Client Confidential Information.

(b) The general framework, structure, prompt engineering patterns, and reusable techniques applied in Custom Configurations are IMPACT Confidential Information and constitute IMPACT Intellectual Property under MSA Section 13.2.

The Parties shall not disclose the other Party's portion of any Custom Configuration to any third party except as permitted under MSA Section 12. Confidential Information classification under this Section is distinct from ownership, which is governed by Section 8.

5.5 Data Classification; Restricted Data

Client is solely responsible for classifying its data and for determining which classes of data may be appropriately processed through which AI Platforms. Client shall identify to IMPACT, in writing, any class of data that requires elevated handling, including but not limited to:

protected health information ("PHI") subject to HIPAA;
payment card data subject to PCI-DSS;
federal contract information ("FCI") or controlled unclassified information ("CUI") subject to CMMC, DFARS, or similar frameworks;
export-controlled or ITAR-regulated data;
personal data subject to GDPR, CCPA/CPRA, or other applicable privacy laws;
attorney-client privileged or work-product material;
material non-public financial information.

IMPACT shall not knowingly route data classes identified by Client as restricted through AI Platforms not approved for such data. However, IMPACT cannot inspect or classify Inputs in real time, and Client retains primary responsibility for ensuring that restricted data is not submitted through AI Platforms or workflows not approved for such data. Client acknowledges that the consequences of submitting restricted data through an unapproved AI Platform may include regulatory exposure, contractual breach with third parties, and forfeiture of legal privileges, and that such consequences are Client's risk.

The identification, notification, and supplemental-agreement obligations of MSA Sections 5.8 and 8 apply to AI & Automation Services. Where Client's data or use case is subject to a regulatory framework that requires execution of a Business Associate Agreement, Data Processing Agreement, CMMC Addendum, or similar supplemental agreement, the Parties shall execute the applicable supplemental agreement prior to processing data subject to such framework through any AI Platform.

5.6 Sub-Processor Disclosure

IMPACT maintains a current list of Sub-Processors at a URL designated by IMPACT. The Sub-Processor list identifies, at a minimum, the name of each Sub-Processor and the nature of services provided.

IMPACT may add, remove, or substitute Sub-Processors from time to time in its discretion to maintain service quality, security, or availability. Where IMPACT engages a new Sub-Processor for AI & Automation Services that will materially affect the processing of Client Inputs or Outputs, IMPACT shall provide reasonable advance notice through update of the Sub-Processor list or other commercially reasonable means.

If Client objects to a new Sub-Processor on reasonable security, regulatory, or contractual grounds, the Parties shall discuss in good faith whether an alternative configuration or Sub-Processor is available. If no acceptable alternative exists, Client may terminate the affected AI & Automation Service without early-termination penalty by providing written notice within thirty (30) days of IMPACT's notice of the new Sub-Processor, subject to Client's continuing obligations for fees and charges accrued through the effective date of termination and reasonable transition assistance fees pursuant to MSA Section 4.7.

5.7 Data Inputs — General Client Responsibility

In addition to the obligations set forth above, Client is solely responsible for:

the quality, accuracy, completeness, legality, and appropriateness of Inputs;
ensuring that Inputs comply with applicable privacy, employment, intellectual property, and regulatory laws and with any contractual obligations Client owes to third parties;
obtaining all consents, authorizations, and notices required for IMPACT to process Inputs through AI Platforms.

IMPACT does not validate the legality, accuracy, or appropriateness of Client data, Inputs, or use cases.

6. THIRD-PARTY AI PLATFORMS

6.1 AI Platform Licensing and Hosting; Nature of Fees.

(a) Internal Business Purpose; Nature of Fees. The AI & Automation Services, including any Custom Configuration that IMPACT designs, builds, installs, or operates, are provided for Client's internal business purposes. Except where IMPACT expressly resells or provisions an AI Platform license or subscription to Client under a reseller, distributor, or cloud-solution-provider arrangement, IMPACT does not sell, resell, sublicense, or grant Client or any third party access to any AI Platform. The recurring service fees payable under this Addendum are consideration for IMPACT's professional and managed services, including design, build, installation, hosting on Client's behalf, monitoring, maintenance, and support, and are not a license fee, a resale of any subscription, or a charge for access to or usage of any AI Platform. Where IMPACT does resell or provision an AI Platform license or subscription to Client, the fee for that license or subscription is separately characterized as such and is distinct from IMPACT's service fees.

(b) Client Licensing. Each AI Platform that requires a license or subscription shall be licensed to or subscribed by Client for Client's internal business purposes, in Client's name where the AI Platform's terms so require. IMPACT may, at Client's direction and on Client's behalf as Client's agent, procure, provision, configure, host, and maintain such license or subscription, and any third-party license or subscription fees so incurred shall be Client's responsibility and shall be passed through to or reimbursed by Client.

(c) IMPACT as Reseller. For certain AI Platforms, IMPACT procures usage, capacity, or licenses from the AI Platform vendor at wholesale and resells access to Client as principal, including by creating, provisioning, and administering tenants within the AI Platform and by repackaging such capacity under IMPACT's own service tiers, packaging, or pricing. The AI Platform vendor invoices IMPACT and does not bill Client directly. Client acknowledges that resale of such an AI Platform remains subject to the vendor's applicable end-customer terms, that Client or its authorized users may be required to accept those end-customer terms as a condition of access, and that the AI Platform vendor's name, marks, and branding may remain visible within the platform. Any such resold access is provided for Client's internal business purposes, and the fee for such resold access is separately characterized from IMPACT's service fees as provided in subsection (a). (d) Fees Not Metered to Platform Consumption. IMPACT's recurring fees for AI & Automation Services are determined by the scope of services IMPACT provides, such as the number of Custom Configurations under management and the level of monitoring, maintenance, and support elected by Client, and are not calculated as, or represented to be, a charge per execution, per node, or per unit of AI Platform consumption.

6.2 Third-Party Terms; No Warranty.

AI Platforms are subject to third-party terms, limitations, capabilities, and changes beyond IMPACT's control. The applicable third-party terms are incorporated by reference and shall apply in addition to this Agreement, in accordance with MSA Section 11 and MSA Section 2.8.

IMPACT does not warrant:

AI Platform availability, uptime, or performance;
model behavior, accuracy, or consistency;
vendor security posture or compliance certifications;
the continued existence, pricing, or feature set of any AI Platform.

Each AI Platform vendor's liability to Client is limited by that vendor's applicable terms, which may cap the vendor's liability at a nominal amount. IMPACT does not assume, guarantee, or backstop any AI Platform vendor's obligations or liabilities to Client, and Client's recourse against IMPACT arising from or relating to AI Platform availability, performance, output, or security is subject to the limitations, exclusions, and disclaimers of the MSA, including the limitation of liability in MSA Section 15.

6.3 Substitution; Relationship to Third-Party Terms.

This Section supplements and does not limit the other provisions of this Addendum or MSA Section 11 incorporating applicable AI Platform terms by reference. IMPACT may modify, replace, or substitute AI Platforms in accordance with MSA Section 11.5, subject to the Sub-Processor notification provisions of Section 5.6 of this Addendum. In the event of a conflict between an AI Platform's terms and the manner in which the AI & Automation Services would otherwise be delivered, IMPACT may modify, replace, or substitute the AI Platform in accordance with its substitution rights under this Addendum and MSA Section 11.5.

7. NO GUARANTEES OR OUTCOMES

IMPACT makes no guarantees regarding:

business results;
cost savings or efficiency gains;
accuracy of Outputs;
bias mitigation;
regulatory compliance outcomes;
decision quality.

Any performance metrics, benchmarks, or expected outcomes communicated by IMPACT are estimates only and do not constitute commitments unless expressly stated as such in an executed Order.

8. INTELLECTUAL PROPERTY

8.1 Definitions.

"IMPACT-Built Automation" means any automation, workflow, agent, prompt, prompt chain, script, custom node, integration, connector, or other Custom Configuration that IMPACT authors, builds, or materially develops for Client on any AI Platform, tool, model, or service, including Hatz AI, Claude Code, MCP servers, n8n, and any other platform or vendor, and regardless of whether Client supplied the idea, request, requirement, or specification for it. "Client-Built Automation" means any automation or Custom Configuration that Client's own personnel independently author and build without IMPACT's authorship or material development.

8.2 Authorship governs ownership.

Ownership is determined by who authors and builds an automation or Custom Configuration, not by who conceived the idea, requested it, or supplied the specification. A Client idea, request, specification, or instruction does not transfer to Client any ownership of the resulting IMPACT-Built Automation.

8.3 IMPACT intellectual property.

As between the Parties, IMPACT owns all right, title, and interest in and to the IMPACT-Built Automations and in IMPACT's reusable frameworks, templates, prompt libraries, automation patterns, methodologies, model-tuning techniques, and evaluation harnesses, including any developed or refined in delivering the Services. IMPACT retains all rights set forth in MSA Section 13. No transfer of intellectual property in IMPACT-Built Automations occurs except for the license granted in Section 8.5 or as expressly stated in an executed Order.

8.4 Client intellectual property.

As between the Parties, Client owns its Inputs, its Client Data, the Outputs generated for it (subject to the AI Platform terms described in Section 5.4 of this Addendum and Section 5.2), its own underlying business rules, processes, requirements, and know-how, and any Client-Built Automation. IMPACT claims no ownership of Client's business processes, requirements, or know-how, including those classified as Client Confidential Information under Section 5.4(a); IMPACT owns only the IMPACT-Built Automation that implements them.

8.5 License grant.

Subject to Client's payment of the applicable fees, IMPACT grants Client a non-exclusive, non-transferable, non-sublicensable, royalty-free license to use, run, and receive the benefit of the IMPACT-Built Automations solely for Client's internal business purposes, solely on the platform instance licensed to Client and operated under this Agreement, for the term of the applicable Order. The recurring fees for the Services include this license. The license is not a sale or assignment of the IMPACT-Built Automations.

8.6 Restrictions.

Except as expressly licensed in Section 8.5, Client shall not copy, reproduce, modify, create derivative works from, distribute, sublicense, sell, reverse-engineer, decompile, or port any IMPACT-Built Automation to another provider, platform, or environment, or permit any third party to do so. These restrictions do not apply to Client-Built Automations or to Client's Inputs, Client Data, or Outputs.

8.7 Term and effect of termination.

The license in Section 8.5 is coterminous with the applicable Order and ends on its expiration or termination. Upon termination, IMPACT may remove, disable, or retain the IMPACT-Built Automations, which remain IMPACT's property. Termination does not affect Client's ownership of its Inputs, Client Data, Outputs, business rules, processes, requirements, know-how, or Client-Built Automations.

8.8 Designation; when use is licensed.

Each automation or Custom Configuration delivered or maintained under the Services is, or shall be, designated on the applicable Order, deliverable register, or catalog record as either an IMPACT-Built Automation, licensed to Client under Section 8.5, or a Client-Built Automation, owned by Client. Absent a contrary written designation, any automation or Custom Configuration authored, built, or materially developed by IMPACT is an IMPACT-Built Automation and Client's use of it is licensed, not owned.

9. SECURITY & COMPLIANCE ALIGNMENT

AI & Automation Services are subject to the MSA's:

security obligations (MSA Section 7);
regulatory compliance framework provisions (MSA Section 8);
limitation of liability (MSA Section 15);
indemnification provisions (MSA Section 16);
insurance requirements (MSA Section 19).

This Addendum, standing alone, does not create regulatory compliance obligations or constitute a Business Associate Agreement, Data Processing Agreement, or other supplemental agreement under any framework. Where such an agreement is required for AI & Automation Services involving regulated data, the Parties shall execute the applicable supplemental agreement in accordance with MSA Sections 5.8 and 8.3.

10. LIMITATION OF LIABILITY

AI & Automation Services are subject to the limitation of liability provisions of MSA Section 15, including the Default Cap, Super-Cap, and uncapped categories set forth in Section 15.2.

For clarity:

ordinary-negligence claims arising from AI & Automation Services are subject to the Default Cap under MSA Section 15.2(a);
claims arising from IMPACT's gross negligence, willful misconduct, or material breach of confidentiality in connection with AI & Automation Services are subject to the Super-Cap under MSA Section 15.2(b);
claims falling within the uncapped categories of MSA Section 15.2(c) are not subject to either cap.

Client acknowledges that reliance on AI Outputs presents inherent risk that may be disproportionate to the fees paid for AI & Automation Services and agrees that the MSA's liability allocation, taken as a whole and including the carve-outs under Section 15.2(b) and 15.2(c), is reasonable.

11. INDEMNIFICATION (AI-SPECIFIC)

In addition to the indemnification obligations set forth in MSA Section 16, Client shall defend, indemnify, and hold harmless the IMPACT Indemnitees from and against any claims, demands, damages, losses, liabilities, penalties, fines, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

Client's reliance on Outputs without appropriate verification;
automated decisions or actions executed by Client-approved automations or agents;
Client's submission of Inputs in violation of Section 5.5 (Data Classification) or in violation of applicable law, contractual obligation, or third-party rights;
regulatory violations related to Client's use of AI & Automation Services, including violations arising from Client's failure to identify an applicable regulatory framework or to execute a required supplemental agreement under MSA Sections 5.8 and 8.3;
employment, financial, healthcare, legal, or other operational decisions made by Client and informed by Outputs;
intellectual property claims arising from Inputs supplied by Client or from Client's use of Outputs in a manner inconsistent with the underlying AI Platform's terms.

This indemnification is subject to the same procedural requirements set forth in MSA Section 16.4 and the same coordination with insurance set forth in MSA Section 16.6.

12. SERVICE LEVEL TARGETS

Service Level Targets applicable to the Services governed by this Addendum are set forth in Schedule B, in the version in effect as of the Order Effective Date. Service Level Targets are internal operational performance objectives only. They are not service level agreements, are not guarantees, and carry no service credit, refund, fee reduction, damages, or termination right. Client's sole recourse for a missed Service Level Target is the escalation procedure set forth in Schedule B.

Schedule B establishes no standard Service Level Targets for AI & Automation Services. Targets apply only where expressly identified in an Order, and where so identified apply only to the deliverables, workflows, agents, automations, or use cases expressly named. The absence of standard Service Level Targets does not relieve IMPACT of the limited services warranty set forth in MSA Section 14.2, and does not expand it.

Service level commitments offered by a Third-Party Provider, including any third-party AI platform, are not extended to or guaranteed by IMPACT, in accordance with MSA Section 11.4.

13. SURVIVAL

This Addendum shall survive termination or expiration of the MSA to the extent necessary to enforce rights, obligations, and remedies arising during the term, including provisions relating to ownership of Inputs and Outputs, confidentiality of Custom Configurations, intellectual property, limitation of liability, and indemnification.

14. EXECUTION AND EFFECTIVENESS

This Addendum becomes effective on the Order Effective Date of the first Order referencing it and requires no separate signature page. Where this Addendum is delivered as a supplemental document with an Order executed by Client, Client's execution of that Order constitutes Client's execution of this Addendum. This Addendum binds the Parties with the same force and effect as if separately executed.

End of Addendum

IMPACT MSA AI & Automation Addendum