AI acceptable use policy generator

1. Purpose and scope

This policy sets out how people at the Company may use artificial intelligence (AI) tools, including chat assistants, writing and coding assistants, and AI features built into other software. Its aim is to let us benefit from AI while protecting our clients, our people and our information.

It applies to all employees, contractors and temporary staff, on any device, whenever they use AI for the Company's work.

2. Approved AI tools

The following AI tools are approved for work use:

• ChatGPT (Business or Enterprise)
• Microsoft 365 Copilot
• Use these tools only through accounts provided by the company. Don't use personal or free accounts for work: business plans give the company control over how data is stored and typically don't use it to train AI models.
• Any other AI tool, including AI features newly added to software we already use, needs approval first (see "Approving new tools and uses").

3. Information you must not put into AI tools

Never enter the following into any AI tool, approved or not, unless the Operations Director has approved that specific use in writing:

• Passwords, API keys, access tokens and other credentials (never, in any tool)
• Personal data about clients or customers
• Employee and HR records
• Payment card and bank account details
• Confidential client documents
• Anything a client, partner or contract has asked us to keep confidential

4. Checking AI output

• A person checks any AI output before it leaves the company: anything sent to clients, published, or given to regulators, auditors or courts.
• AI output used internally is checked at the user's judgement, with care proportional to how much it matters.
• The person who uses AI output is responsible for it, as if they had written it themselves.
• AI tools can be confidently wrong. Check facts, figures, names, quotes and references against reliable sources.

5. Being open about AI use

• We tell clients when AI did a substantial part of the work we deliver to them.
• Chatbots and other AI that talks directly to customers always say they're AI, and offer a way to reach a person.
• Never present AI-generated content as a real person's words, image or voice without their consent.

6. Uses that are not allowed

• Making decisions about people (hiring, firing, pay, credit, insurance, access to services) without a person reviewing and owning the decision.
• Creating content that is deceptive, discriminatory, harassing or illegal, or that impersonates someone.
• Using AI to get around security controls, licences or other people's rights.
• Using AI to monitor employees or infer their emotions or personal characteristics.

7. Rules for accounting work

• Reconcile any figure an AI tool produces or extracts back to the source document before it's used in accounts, returns or client reports.
• AI may prepare working papers and drafts. A qualified person reviews and signs off every return, set of accounts and piece of advice.
• Client financial data goes only into tools approved for client data, covered by a data processing agreement.

8. Approving new tools and uses

• The Operations Director approves new AI tools and new uses of AI for client work or company data.
• Before approving a tool, check where it stores data, whether it uses our data to train models, who can access it, and that a data processing agreement is in place.
• Keep a list of approved tools and approved uses, and share it with staff.

9. Legal and regulatory requirements

• GDPR applies to any personal data entered into AI tools: use only approved tools covered by a data processing agreement, and only where there is a lawful basis.
• People have the right not to be subject to decisions based solely on automated processing that significantly affect them (GDPR Article 22). A person makes those decisions.
• The EU AI Act requires us to make sure staff using AI have sufficient AI literacy (Article 4), which the training in this policy covers.
• The EU AI Act bans certain uses outright, including emotion recognition in the workplace, social scoring and manipulative techniques. We don't use AI for any of them.
• Images, audio or video generated or altered by AI that could pass as real (deepfakes) are labelled as AI-generated.
• Uses the EU AI Act treats as high-risk (for example hiring and managing staff, creditworthiness, and life and health insurance pricing) need approval and a compliance review before any use.

10. Training

• Everyone who uses AI for work completes AI training before using it, covering how the tools work, their limits, and this policy.
• Training is refreshed when tools or this policy change significantly.

11. Reporting problems

• Report immediately to the Operations Director if restricted information was entered into an AI tool, if an AI output caused or nearly caused harm, or if you see AI being used against this policy.
• Reporting a mistake quickly is always the right call. We treat honest reports as a chance to improve, not as misconduct.

12. Policy owner and review

The Operations Director owns this policy and reviews it at least every 12 months, and sooner when tools, regulations or how we use AI change.

Breaching this policy may lead to disciplinary action, in line with our other policies.