[Company] Responsible AI Policy

• Version: 1.0
• Owner: Chief Technology Officer (CTO)
• Approved by: Chief Executive Officer (CEO)
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose

[Company] uses artificial intelligence ("AI") tools to support its internal work. This policy sets out the principles [Company] follows when it evaluates, approves and uses AI, and the commitments that put those principles into practice so that AI is used responsibly, safely and in a way that respects the rights of the people it affects.

This policy applies to everyone at [Company] who uses AI tools as part of their work, and it explains how new uses of AI are approved, how data is protected, and how [Company] oversees the output that AI tools produce.

2. Scope

This policy applies to all AI tools used by [Company] staff in connection with company work, regardless of the device or account used to access them. [Company] does not currently build AI-powered features into a product; this policy governs the internal use of third-party AI tools.

This policy covers:

• Generative AI tools, such as large language models, used to draft, summarize, translate, or analyze text or other content.
• AI-powered features built into software [Company] already uses, such as office, communication, or business software.
• Any other AI tool that a staff member proposes to use for company work, including tools that assist with decisions about people, such as hiring or performance.

3. Principles

[Company] applies the following principles to every use of AI, whatever the size of the task.

• Fairness: AI tools must not produce outcomes that unfairly disadvantage people based on characteristics such as race, sex, age, or disability, and [Company] checks for this before using AI in decisions about people.
• Transparency: People are told when AI has materially contributed to a decision about them, and AI-generated content is not passed off as unaided human work where that would mislead.
• Human oversight: A person with the authority and knowledge to change the outcome reviews any AI output used in a decision with legal or similarly significant effects on a person.
• Accountability: A named role is responsible for this policy, and every use of AI is approved and recorded before it starts.
• Privacy: Personal data is only used with AI tools that meet [Company]'s data protection requirements, and only for purposes consistent with why the data was collected.
• Safety and security: AI tools are chosen and used in a way that protects [Company]'s systems, data, and the confidentiality of the information staff work with.

4. Roles and Responsibilities

• Chief Technology Officer (CTO): Owns this policy, is accountable for its implementation, approves or delegates approval of new AI tools and uses, maintains the AI system inventory described in Section 13, and looks after security matters relating to AI.
• Chief Executive Officer (CEO): Approves this policy and approves any use of AI that is higher-risk, such as a use that affects customers, staff, or personal data, as described in Section 5.
• Staff: Use only approved AI tools, follow this policy and any related guidance, check AI output before relying on it, and raise concerns about AI use as described in Section 16.

5. Approving New Uses of AI

Every new use of AI at [Company] must be approved before it starts, and the amount of review scales with the risk involved. Low-risk uses, such as drafting internal text with an already-approved tool, need only confirmation that the tool itself has been approved for use. A use that affects customers, staff, or the public, or that involves personal or customer data, needs a short assessment of who could be affected and how before it can go ahead.

1. The staff member proposing the use identifies the AI tool, its intended purpose, and the data it would touch.
2. The CTO reviews the proposal and determines whether it is low-risk or requires further assessment.
3. Where the use affects customers, staff, or the public, or involves personal or customer data, the CTO carries out a short impact assessment describing who could be affected and how, and the CEO approves the use before it starts.
4. The approved tool, its purpose, and the outcome of any assessment are recorded in [Company]'s AI system inventory.

6. Data Governance

[Company] does not train or fine-tune AI models. Any proposal to train or fine-tune a model must be approved by the CTO and CEO before any work begins, following the same process as any other new use of AI.

• Personal data and customer data are entered into an AI tool only where that tool has been approved for that type of data.
• Before approving an AI tool, [Company] checks the AI model provider's terms to confirm whether it may use [Company]'s inputs and outputs to train its own models, how long it retains that data, and where it processes it.
• Personal data and customer data are sent only to AI services whose terms confirm that the provider will not use that data to train its models.
• [Company]'s data retention and access controls apply equally to any data stored, cached, or logged by an AI tool.
• The AI system inventory records which AI tools are approved, what data each may be used with, and the basis for that approval.

7. Fairness and Bias

Before an AI tool is used in a decision about a person, such as hiring, performance, or promotion, [Company] takes steps to understand and reduce the risk of unfair or biased outcomes. This applies whether the tool is used directly by [Company] or embedded in software [Company] already uses.

• Before using an AI tool in a decision about people, [Company] obtains the supplier's bias-testing results where available, or tests the tool itself using realistic examples.
• The result of that check is recorded in the AI system inventory alongside the tool's approval.
• Any AI tool found to produce biased or unreliable results in this context is not used for that purpose until the issue is resolved.

8. Human Oversight

AI does not make a decision with legal or similarly significant effects on a person, such as hiring, dismissal, or performance decisions, without a person reviewing the case who has the authority and knowledge to change the outcome. That person must genuinely review the case, not simply approve the AI's output as a formality.

• Staff using AI to support a decision about a person must record that a human reviewed the AI's output and made the final decision.
• Reviewers must have enough context and expertise about the situation to identify when the AI's output looks wrong, incomplete, or unfair.
• AI output used to inform a decision about a person is treated as one input among others, not as the decision itself.

9. Transparency

[Company] is clear with staff and with the people its work affects about where AI has played a role. This applies both to AI tools staff use directly and to AI features embedded in other software [Company] uses.

• People are told when AI has been used in a decision that affects them.
• AI-generated content sent outside [Company], such as in customer communications, is not presented as unaided human work where doing so would mislead the recipient.
• Staff disclose the use of AI tools when asked by a customer, partner, or colleague about how a piece of work was produced.

10. Safety, Security and Reliability

AI tools are subject to the same security expectations as any other software [Company] uses, and staff must satisfy themselves that an AI tool is reliable enough for the task before relying on its output.

• AI tools must be accessed only through accounts and configurations approved by the CTO.
• Staff must check AI-generated output for accuracy, relevance, and appropriateness before relying on it or sharing it, particularly for anything sent to a customer or used in a business decision.
• Any AI tool that behaves unexpectedly, produces harmful or clearly wrong output, or appears to expose data it should not have access to, must be reported as described in Section 13.
• Access to AI tools is removed promptly when a staff member leaves [Company] or no longer needs it.

11. Third-Party AI Services

[Company] accesses AI models through AI model providers' own services or APIs rather than running models on its own infrastructure. Before approving any such service for use, [Company] reviews the provider's terms to understand how it will treat [Company]'s data.

• Before approval, the CTO checks whether the provider may use [Company]'s inputs or outputs to train its own models, how long the provider retains that data, and where the data is processed.
• Personal data and customer data are only sent to AI services whose terms confirm the provider will not use that data to train its models.
• Providers are re-checked when their terms change materially, or at least once a year for any service handling personal data.
• Any AI service that cannot meet these requirements is not used for work involving personal data or customer data, even if it is otherwise useful.

12. Staff Use of AI Tools

Staff must use only AI tools that the CTO has approved for work, and must check AI output for accuracy before relying on it or sending it outside [Company]. Staff remain personally responsible for any work product they create with the help of AI, in the same way they are responsible for work they create without it.

• Personal data and customer data must only be entered into AI tools that have been approved for that type of data.
• Staff must not use unapproved AI tools for company work, even where a free or convenient option is available.
• Any use of AI in a decision about a person, such as hiring or performance, must follow the review process in Sections 5, 7, and 8.
• These rules apply to contractors performing work for [Company] in the same way they apply to employees.

13. Monitoring, Incidents and Records

[Company] keeps an AI system inventory recording, for each AI tool it uses: its purpose, the staff member or role responsible for it, the AI model provider, the data it uses, its risk rating, its approval record, and, where applicable, any fairness or reliability checks carried out.

• Any AI-related incident, such as harmful or biased output, a data leak through an AI tool, or a tool behaving outside its intended use, is handled through [Company]'s general incident response process.
• Staff must report suspected AI incidents to the CTO as soon as they notice them.
• The AI system inventory is reviewed at least once a year, and updated whenever a new tool is approved, an existing tool changes significantly, or a tool is retired.

14. Training and Awareness

[Company] makes sure staff understand this policy and know how to use AI tools responsibly, including how to check AI output, when human review is required, and how to raise a concern. This awareness is refreshed at least once a year and whenever this policy changes materially.

15. Legal and Regulatory Requirements

[Company]'s use of AI is subject to existing US laws on consumer protection, discrimination, and privacy, which apply to AI in the same way they apply to any other technology. Where AI is used in a decision about staff, such as hiring or performance, the CTO checks which state or local rules on AI in employment decisions apply before that use is approved.

• Personal data used with AI tools is handled in line with the requirements of CCPA and other applicable US state privacy laws, including the rights those laws give individuals over their personal data.
• AI systems and AI suppliers fall within the controls [Company] already runs as part of its SOC 2 program.

16. Raising Concerns

Any staff member, contractor, customer, or other person affected by [Company]'s use of AI may raise a concern about that use, including concerns about unfair, inaccurate, or unsafe AI output. Concerns should be sent to [AI concerns contact email] and will be acknowledged within 3 business days. Anyone who raises a concern in good faith will not be penalized for doing so.

17. Policy Review and Exceptions

This policy is reviewed at least once a year and updated as [Company]'s use of AI changes. Any exception to this policy must be approved in writing by the CTO or CEO before it takes effect.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Responsible AI Policy

• Version: 1.0
• Owner: Chief Technology Officer
• Approved by: Chief Executive Officer
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose

[Company] provides software used by banks and other FCA-regulated firms, and its product includes features built on artificial intelligence (AI). This policy sets out the principles [Company] follows when it builds, buys and uses AI, and the practical commitments that put those principles into effect. It exists to protect customers, their staff and their customers' data, [Company]'s own staff, and the integrity of the decisions AI supports.

This policy applies to every AI feature in [Company]'s product, every AI tool used internally, and every AI model or service [Company] fine-tunes, hosts or procures from a third party. It sets expectations for how AI is approved, tested, monitored and explained, and assigns responsibility for making sure those expectations are met.

2. Scope

This policy covers all forms of AI that [Company] develops, fine-tunes, hosts or uses, whether embedded in its product, run internally, or supplied by a third party. It applies to all employees, and to contractors who use AI on [Company]'s behalf.

• AI features built into [Company]'s product and used by its customers.
• Machine learning models, including large language models (AI models trained to generate or process human-like language), that [Company] fine-tunes or runs in its own cloud environment.
• Third-party AI tools and services, such as an AI model provider's service or a hosting platform, whether used by staff internally or incorporated into the product.
• Generative AI tools used to draft, summarise, translate or analyse text, code or data.
• Any AI system used, directly or indirectly, to make or support a decision about a customer, a member of staff or another individual.

3. Principles

[Company] applies the following principles to every AI system it builds, buys or uses.

• Fairness: AI systems must be designed, tested and used so they do not produce unjustified different outcomes for different groups of people.
• Transparency: People must be able to understand when they are interacting with AI, what an AI feature does, and the basis on which it produces its output.
• Human oversight: A person with the authority and knowledge to change the outcome must remain responsible for decisions that significantly affect people, rather than the AI acting alone.
• Accountability: Every AI system has a named owner and a recorded approval, and [Company] can explain how it was assessed, tested and is monitored.
• Privacy: AI systems must use personal data and financial data only as this policy, [Company]'s privacy notices and its contracts with customers allow.
• Safety and security: AI systems must be tested before use, secured to the same standard as [Company]'s other systems, and monitored for problems once in use.

4. Roles and Responsibilities

• Chief Technology Officer (CTO): owns this policy, is accountable for [Company]'s compliance with it, and chairs the AI Review Group.
• AI Review Group: a small group made up of existing senior roles, including the CTO, the head of the security team and the head of product, that reviews and approves higher-risk uses of AI and any proposal to train or fine-tune a model.
• Security team: assesses the security and data-handling risks of AI systems and third-party AI providers, supports incident response involving AI, and advises on where models and data are hosted.
• Product and engineering managers: responsible for designing, testing, releasing and re-testing AI features in the product in line with this policy, and for keeping the AI system inventory up to date for the systems they own.
• All staff and contractors: must use AI tools in line with this policy, check AI output before relying on it, and raise concerns about AI systems or their use.
• Chief Executive Officer (CEO): approves this policy and any material exception to it.

5. Approving New Uses of AI

Every new use of AI, including a new AI feature, a new internal tool, or a new third-party AI service, must be approved before it starts. The level of review scales with the risk the use presents.

1. The team proposing the use describes its purpose, the data it involves, and who it could affect, and submits this to the CTO.
2. Low-risk uses that only involve using an already-approved AI tool for internal drafting or similar tasks require no further approval beyond confirming the tool is approved for the data involved.
3. Any use that affects customers, staff or the public, or that involves personal data or financial data, requires a short impact assessment describing who could be affected and how, reviewed by the AI Review Group.
4. The AI Review Group approves or rejects the use, and may set conditions, such as further testing, restrictions on data, or additional human review.
5. The proposal, impact assessment and approval are recorded in [Company]'s AI system inventory before the use goes live.

6. Data Governance

[Company] does not train AI models from scratch. It fine-tunes models using data other than customer data; it does not fine-tune models using customer data. Any proposal to train or fine-tune a model must be approved under the process in Section 5 before work starts.

• Before a dataset is used to fine-tune a model, its origin and the licence or permission under which it may be used must be recorded, and the dataset must be checked for personal data.
• Customer data is not used to fine-tune models.
• Data used with AI systems is classified, minimised and retained in line with [Company]'s existing data handling standards.
• Where models are run in [Company]'s own cloud account, [Company]'s usual security controls, including access control, encryption and logging, apply to those models, the data they use and the logs they produce.
• Financial data and personal data used with any AI system are handled only for the purpose the system was approved for.

7. Fairness and Bias

Before an AI feature is released, and after any significant change to it, [Company] tests it for differences in performance across the groups of people it affects, and records the results.

• Testing covers the groups of customer end users the feature is reasonably expected to affect.
• Test results are reviewed by the owning product or engineering manager before release.
• Where an AI tool is used in a decision about staff, such as hiring or performance, [Company] obtains the supplier's bias-testing results or tests the tool itself before it is used, and records the outcome.
• Significant fairness issues found in testing or in use are treated as an incident under Section 13.

8. Human Oversight

AI does not make a decision with legal or similarly significant effects on a person without a human who reviews the case and can change the outcome. That person must have the authority and knowledge to overrule the AI's output, and must not simply approve it without review.

• Where [Company]'s product includes AI features used by its customers, the customer's staff make any decision with legal or similarly significant effects on a person; [Company] does not make that decision on the customer's behalf.
• [Company] designs its AI features so the customer's staff can review the basis for the AI's output, question it, and override it.
• Internally, any use of AI in a decision about a member of staff must include review by a person with the authority to change the outcome before the decision is finalised.
• Human oversight requirements are recorded in the AI system inventory alongside each system.

9. Transparency

Users must be able to tell when they are dealing with AI, and customers must understand what an AI feature does and its limits.

• Where a person interacts with an AI feature and this is not obvious, the feature tells them they are interacting with AI.
• Content generated by AI is labelled where a person could otherwise mistake it for human work.
• Customers receive a description of what each AI feature does, what data it uses, and its known limitations, before or at the point they start using it.
• Anyone subject to a decision that used AI is told that AI was used in reaching it.
• Material produced with the help of AI and sent outside [Company] is not presented as unaided human work where that would mislead the recipient.

10. Safety, Security and Reliability

AI systems are held to the same safety, security and reliability standard as [Company]'s other production systems, and are tested before release and after change.

• Each AI feature is tested for accuracy, reliability and security before release and after any significant change, including a change to the underlying model.
• Where a model provider updates or retires a model version that an AI feature relies on, the feature is re-tested before the change goes live for customers.
• Access to AI models, their training and fine-tuning data, and their logs is restricted to staff who need it.
• AI systems are monitored for unexpected or unsafe behaviour, and issues are handled under [Company]'s incident process.
• AI systems that support customer-facing services are included in [Company]'s business continuity and operational resilience arrangements.

11. Third-Party AI Services

Before using a third-party AI model, service or hosting platform, [Company] checks the terms that apply to it.

• Where a model is obtained through a hosting platform, its licence and published documentation are checked before use.
• Where [Company] uses any AI model provider's service, it checks whether the provider may use [Company]'s inputs and outputs to train its own models, how long it retains them, and where it processes them.
• Customer data and personal data are sent only to AI services whose terms do not allow the provider to train its own models on that data.
• Models run in [Company]'s own cloud account are subject to [Company]'s usual security controls, as set out in Section 6, rather than to a third party's separate hosting environment.
• New third-party AI services are approved under Section 5 before they are used with customer data or personal data.

12. Staff Use of AI Tools

Staff must use AI carefully and remain responsible for the work they produce with it.

• Staff use only AI tools that [Company] has approved for work purposes.
• Staff check AI output for accuracy before relying on it or sending it outside [Company], and remain responsible for the final work product.
• Customer data and personal data are entered only into AI tools [Company] has approved for that data.
• AI is not used to make a decision about a member of staff, such as in hiring or performance, without the review set out in Section 8, and without the bias check set out in Section 7.

13. Monitoring, Incidents and Records

[Company] keeps an AI system inventory recording every AI system it builds, fine-tunes or uses, and handles problems with AI through its existing incident process.

• The inventory records, for each AI system: its purpose, owner, model or supplier, the data it uses, its risk rating, its approval, and its test results.
• AI features are re-tested and the inventory updated when the underlying model changes, including when a provider updates or retires a model version.
• Incidents involving AI, such as harmful or biased output, a data leak through an AI tool, or a system behaving outside its intended use, are handled under [Company]'s incident process and logged in the same way as other security incidents.
• The security team reviews AI-related incidents to identify whether controls need to change.

14. Training and Awareness

[Company] provides AI awareness training to staff whose role involves building, approving or using AI, at least once every 12 months and when this policy changes materially. Training covers how to use approved AI tools appropriately, how to recognise and check AI output, and how to raise a concern. [Company] takes measures to support the AI literacy of its staff, and of any contractor who operates or uses AI systems on its behalf, suited to their role and to the people the AI affects.

15. Legal and Regulatory Requirements

[Company]'s use of AI is subject to the following laws and frameworks, in addition to any customer contract that governs a specific AI feature.

• Where [Company] decides how personal data is used, such as for its own staff and the people it deals with directly, it uses personal data in AI only where it has a lawful basis and has told the people concerned, and the impact assessment in Section 5 decides whether a data protection impact assessment is needed, which it is wherever the processing is likely to result in a high risk to people.
• Where [Company] processes personal data on behalf of a customer, it uses that data in AI only as the customer's contract allows; the customer remains responsible for the lawful basis, for telling the people affected, and for any assessment required.
• A person subject to a decision based solely on automated processing that has legal or similarly significant effects on them can obtain human intervention, express their point of view, and contest the decision. Under the EU's GDPR, such decisions are permitted only in limited cases.
• DORA obligations passed down by EU financial customers apply to the AI systems and AI suppliers [Company] uses to support those customers; these are managed within [Company]'s existing third-party and operational resilience risk management.
• SOC 2 covers the AI systems and AI suppliers [Company] uses, within the controls it already runs for its SOC 2 Type II report.
• ISO 27001 covers the AI systems and AI suppliers [Company] uses, within the information security controls it already runs under that framework.
• Where the EU AI Act applies to an AI system, [Company] records whether it is a provider of that system (where it develops it and places it on the market or puts it into service under its own name) or a deployer (where it uses it under its own authority), and records the system's risk category in the AI system inventory.
• [Company] does not use AI for practices the EU AI Act prohibits, such as social scoring.
• The EU AI Act treats AI used in areas such as recruitment and other employment decisions, assessing the creditworthiness of individuals (other than for detecting fraud), and pricing life and health insurance as high-risk; before [Company] builds or uses an AI system in such an area, it confirms that system's obligations with legal counsel.
• Where an AI feature interacts with people, it is designed so those people are told they are interacting with AI unless this is obvious, and any synthetic audio, image, video or text the feature generates is marked as AI-generated in a machine-readable format.

16. Raising Concerns

Staff, contractors, customers and people affected by [Company]'s AI may raise a concern about an AI system, such as suspected bias, an error, or a possible data protection issue, by contacting [AI concerns contact email]. Concerns are acknowledged within 2 business days. Anyone who raises a concern in good faith is not penalised for doing so.

17. Policy Review and Exceptions

The CTO reviews this policy at least once every 12 months and whenever a significant change occurs to the law, [Company]'s AI systems or its risk profile. Any exception to this policy requires the approval of the CTO or the AI Review Group and is recorded in the AI system inventory.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Responsible AI Policy

• Version: 1.0
• Owner: Chief Technology Officer (CTO)
• Approved by: Chief Executive Officer (CEO)
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose

This policy sets out the principles [Company] follows when it builds, buys, and uses artificial intelligence (AI), including the AI features in the clinical decision support product used by its hospital and health system customers. It exists because AI can affect the people it touches — patients, clinicians, staff, and customers — in ways that are different from, and sometimes harder to see than, conventional software.

[Company] is committed to using AI in a way that is fair, transparent, subject to human oversight, accountable, respectful of privacy, and safe and secure. This policy sets out how those commitments work in practice, alongside [Company]'s other security and data protection policies.

2. Scope

This policy applies to every AI system [Company] builds, buys, or uses, and to everyone who works for [Company], including employees and contractors. It covers:

• AI features built into [Company]'s product, including its clinical decision support features.
• AI models [Company] trains, and any model it may fine-tune in the future.
• Third-party or pre-trained AI models [Company] runs in its own cloud environment.
• AI tools staff use to support their day-to-day work.
• Any use of AI in a decision about a person, such as hiring or performance.

3. Principles

[Company] applies the following principles to every AI system it builds or uses:

• Fairness: AI systems are tested for differences in how well they work across the groups of people they affect, and significant gaps are addressed before an AI system is used or released.
• Transparency: People are told when they are interacting with an AI system, and customers and affected individuals are given a clear description of what an AI feature does and its known limits.
• Human oversight: A person with the authority and knowledge to change the outcome reviews any decision made with the help of AI that has a legal or similarly significant effect on a person.
• Accountability: Named roles are responsible for approving, building, testing, and monitoring each AI system, and every AI system is recorded in [Company]'s AI system inventory.
• Privacy: Personal data and protected health information are used in AI only where permitted, and only to the extent needed for the approved purpose.
• Safety and security: AI systems are tested before use, monitored afterward, and protected by the same security controls [Company] applies to its other systems.

4. Roles and Responsibilities

• CTO — accountable for this policy; gives final approval for higher-risk or novel uses of AI; chairs the AI Review Group; ensures the policy is resourced and followed.
• AI Review Group — a small group made up of the CTO, the Head of Security, and the leads of Product and Clinical Affairs/Compliance; reviews new and changed uses of AI, decides whether an impact assessment is required, and oversees the AI system inventory.
• Head of Security — responsible for the security, privacy, and reliability of AI systems and the infrastructure that hosts them, and for handling AI-related security incidents; works with the security contractor on technical tasks.
• Security contractor — supports the Head of Security on technical security work relating to AI systems; does not own this policy.
• Product and Engineering leads — design, build, and test AI features so they meet the fairness, human oversight, transparency, and safety requirements in this policy before release.
• Managers and staff — use only AI tools [Company] has approved, follow this policy, and escalate concerns.

5. Approving New Uses of AI

Every new use of AI at [Company] — a new product feature, a new internal tool, or a new use of an existing tool — is approved before it starts. The effort involved scales with the risk of the use.

1. The person or team proposing the use describes it, including its purpose, the data involved, and who it could affect.
2. Low-risk uses, such as drafting internal text with an already-approved tool, need only confirmation that the tool is on [Company]'s approved list.
3. A use that affects customers, staff, patients, or the public, or that involves personal data or health data, requires a short impact assessment describing who could be affected and how, reviewed by the AI Review Group.
4. Uses affecting patients or clinical decisions, or involving a new AI feature in the product, additionally require the CTO's approval before development or release.
5. The impact assessment and its approval are recorded in [Company]'s AI system inventory before the use begins.
6. A material change to an approved use — including a change to the underlying model — is reassessed under this process.

6. Data Governance

[Company] trains some of its own AI models using data other than customer data; it does not currently fine-tune models. Training or fine-tuning a model, or making a material change to how an existing model is trained, requires approval under Section 5 before it starts.

• [Company] keeps a record of where each training dataset came from and confirmation of the licence, contract, or other permission under which it may be used.
• Training data is checked for personal data or protected health information before use, and any such data is removed or minimized unless its use has been separately approved.
• Customer data, including protected health information, is not used to train or fine-tune models.
• Protected health information is used to train, fine-tune, or run AI only as permitted by the applicable business associate agreement with the customer.
• Models [Company] runs in its own cloud account are subject to the same access control, encryption, and logging standards as its other production systems.

7. Fairness and Bias

Because [Company]'s clinical decision support features can influence patient care decisions, they are tested for differences in performance across the patient and clinician groups they are likely to affect, both before release and after any significant change.

• Each AI feature is tested before release, and after any significant change, for differences in accuracy and outcomes across relevant patient and clinician groups, and the results are recorded in the AI system inventory.
• Testing takes into account the clinical populations the feature is intended to serve.
• Where AI is used in a decision about [Company]'s own staff, such as hiring or performance, [Company] obtains the supplier's bias-testing results or tests the tool itself before use, and records the result.
• A feature is not released, and an internal tool is not used for decisions about people, where testing shows a fairness gap that creates unacceptable risk to patients or unfair treatment of individuals.

8. Human Oversight

No AI system at [Company] makes a decision with a legal or similarly significant effect on a person — including a hiring, performance, or clinical decision — without a human reviewer who has the authority and knowledge to change the outcome and who does not simply approve the AI's output.

• For customers using [Company]'s clinical decision support features, the customer's clinicians make every clinical decision; the clinician using the product remains responsible for it.
• Each clinical decision support feature is designed so a clinician can review, question, and independently verify the basis for each recommendation.
• Before releasing a clinical decision support feature, [Company] assesses whether it is regulated as a medical device and handles it accordingly.
• [Company] tells its customers which inputs each clinical decision support feature uses, including any input that measures race, color, national origin, sex, age, or disability, because U.S. health care providers and other recipients of federal health program funding must make reasonable efforts to identify such tools and reduce the risk of discrimination arising from their use.
• For decisions about [Company]'s own staff, such as hiring or performance, a manager with the authority to change the outcome reviews the AI's output before it is acted on.

9. Transparency

[Company] tells the people its AI affects, and the customers who use its product, what its AI systems do and how they are used.

• Users of [Company]'s clinical decision support features are told they are interacting with an AI system, unless this is obvious from the context.
• Content generated by AI is labeled where a person could otherwise mistake it for unaided human work.
• Customers receive a description of what each AI feature does, what data it uses, and its known limitations.
• Where AI has been used in a decision about a person, such as an employment decision, that person is told AI was used.
• Material created with the help of AI and sent outside [Company] is not presented as unaided human work where doing so would mislead the recipient.

10. Safety, Security and Reliability

Each AI feature is tested for safety, accuracy, and reliability before release, and monitored afterward, using the same security controls [Company] applies to its other production systems.

• Each AI feature is tested against defined acceptance criteria before release and after any significant change.
• A feature is re-tested whenever the underlying model changes, including when a model is updated or retired.
• Models run in [Company]'s own cloud account are protected by the same access control, encryption, network security, and logging standards as its other production systems.
• AI systems are monitored in production for errors, drift, and unexpected behavior, and issues are handled through [Company]'s incident process (Section 13).
• Access to AI system configurations, training data, and model outputs is limited to authorized staff.

11. Third-Party AI Services

[Company] runs the AI models behind its product in its own cloud account rather than calling an external AI model provider's hosted service for that purpose. Where it obtains a pre-trained model, model weights, or another AI component from a hosting platform, it checks the applicable licence and documentation before use.

• Before using a model obtained from a hosting platform, [Company] reviews its licence and published documentation to confirm it may be used for the intended purpose.
• Customer data and personal data, including protected health information, are not sent to any external AI service whose terms allow the provider to use that data to train its own models.
• Where [Company] does use an external AI model provider's service, it reviews the provider's terms before use to establish whether the provider may use [Company]'s inputs and outputs to train its models, how long it retains them, and where it processes them.
• Models run in [Company]'s own cloud account remain subject to [Company]'s usual security and access controls, as described in Section 10.

12. Staff Use of AI Tools

Staff and contractors use AI tools to support their work, and remain responsible for the results.

• Staff and contractors use only AI tools [Company] has approved for work use.
• Staff check AI-generated output for accuracy before relying on it or sending it outside [Company], and remain responsible for the work they produce with AI assistance.
• Customer data and personal data, including protected health information, are entered only into AI tools [Company] has approved for that data.
• Before AI is used in a decision about a staff member, such as hiring or performance, the approval and testing steps described in Sections 5 and 7 are followed.
• These rules apply to contractors and to anyone else performing services for [Company], not only to employees.

13. Monitoring, Incidents and Records

[Company] keeps an AI system inventory covering every AI system it builds or uses.

• The AI system inventory records, for each AI system, its purpose, owner, underlying model or supplier, the data it uses, its risk rating, its approval, and its test results.
• A feature is re-tested and the inventory is updated whenever the underlying model changes, including when a model is updated or retired.
• Harmful or biased AI output, a data leak through an AI tool, or an AI system behaving outside its intended use is treated as a security incident and handled through [Company]'s incident response process.
• Incident records include what happened, who was affected, and what corrective action was taken.

14. Training and Awareness

All staff receive training on this policy and on the responsible use of AI tools appropriate to their role. Staff who build or test AI features receive additional training on fairness testing, human oversight, and safety requirements. Training is refreshed periodically and whenever this policy changes materially.

15. Legal and Regulatory Requirements

[Company]'s use of AI is governed by the laws and frameworks that already apply to its handling of health data and personal information.

• As a HIPAA business associate, [Company] uses protected health information in AI only as permitted by the applicable business associate agreement and by HIPAA's privacy and security requirements.
• [Company]'s SOC 2 controls extend to its AI systems and AI suppliers.
• [Company]'s HITRUST program, currently in progress, extends to its AI systems and AI suppliers.
• U.S. consumer protection, anti-discrimination, and privacy laws apply to [Company]'s use of AI as they do to any other technology.
• Some U.S. states and cities regulate the use of AI in employment decisions; before AI is used in hiring, performance, or other decisions about staff, [Company] checks which rules apply.

16. Raising Concerns

Anyone — staff, a contractor, a customer, or a person affected by [Company]'s AI — may raise a concern about an AI system or this policy by contacting [AI concerns contact email]. Concerns are acknowledged within 3 business days. Staff and contractors who raise a concern in good faith are not penalized for doing so.

17. Policy Review and Exceptions

The CTO reviews this policy at least once a year and after any significant change to [Company]'s use of AI or to applicable law. Any exception to this policy requires the CTO's written approval and is recorded in the AI system inventory.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Responsible AI Policy

• Version: 1.0
• Owner: Chief Information Security Officer (CISO)
• Approved by: Chief Executive Officer (CEO)
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose

This policy sets out the principles [Company] follows when its staff use artificial intelligence (AI) tools in their work, and the commitments that put those principles into practice. [Company] provides managed IT and security services to defense contractors and government agencies, and it handles personally identifiable information (PII) and controlled unclassified information (CUI) on their behalf. Using AI responsibly is part of protecting that data and meeting the commitments [Company] makes to its customers.

This policy applies to every use of AI at [Company], regardless of which team proposes it, and it must be followed alongside the company's other security and data protection policies. It does not describe how [Company] builds AI products, because [Company] does not develop or offer AI products to its customers; it governs how AI tools are selected, approved, and used internally.

2. Scope

This policy covers any use of artificial intelligence by [Company] staff or on [Company]'s behalf, whether the AI runs inside a tool staff use directly, is embedded in another product [Company] uses, or supports an internal process. It applies to:

• Generative AI tools used by staff for drafting, summarizing, research, or coding assistance.
• AI features embedded in IT service management, ticketing, or monitoring systems, including AI used for service desk triage.
• AI-based tools used by the Security Operations Center (SOC) for detection, analysis, or response.
• Any new AI capability under consideration for adoption, whether built internally, purchased, or included in another vendor's product.

3. Principles

[Company] applies the following principles to every use of AI. These principles guide how AI tools are selected, approved, and used, and how their output is checked.

• Fairness: AI tools must not produce or contribute to unjustified different treatment of people based on characteristics such as race, sex, age, or disability.
• Transparency: People are told when AI has materially affected a decision about them, and AI-generated content is not presented as unaided human work where that would mislead.
• Human oversight: A person with the authority and knowledge to change the outcome reviews any AI-supported decision that has a legal or similarly significant effect on a person.
• Accountability: Every AI use has a named owner responsible for its approval, performance, and ongoing review.
• Privacy: Personal data and controlled government information are used with AI only where this policy and the company's data protection controls allow it.
• Safety and security: AI tools are treated as part of [Company]'s IT estate and are subject to its usual security, access control, and monitoring standards.

4. Roles and Responsibilities

• Chief Information Security Officer (CISO): owns this policy, is accountable for its implementation, approves low-risk AI tool requests, and maintains the AI system inventory.
• AI Review Group (comprising the CISO, an IT or engineering lead, and a compliance or legal lead): reviews higher-risk proposed uses of AI and their impact assessments before they are approved.
• Chief Executive Officer (CEO): approves this policy and approves higher-risk uses of AI following review by the AI Review Group.
• SOC team: monitors AI-enabled security tools for unexpected or unsafe behavior and investigates AI-related security incidents.
• People managers: ensure any use of AI in decisions about their staff follows the requirements in sections 7 and 8 before it is relied on.
• All staff and contractors: use only approved AI tools, follow this policy, and report concerns as set out in section 16.

5. Approving New Uses of AI

Every new use of AI at [Company] is approved before it starts, and the level of review scales with the risk it presents. Approval is required whether the use is proposed by an individual, a team, or as part of adopting a new product or vendor.

1. The person or team proposing a use of AI submits a request describing the tool, its purpose, and the data it will process.
2. A use that only involves internal drafting, research, or similar low-risk tasks with an approved tool needs no further approval.
3. A use that affects customers, staff, or the public, or that involves personal data or controlled government information, requires a short impact assessment describing who could be affected and how, reviewed by the AI Review Group and approved by the CEO.
4. The impact assessment and approval are recorded in [Company]'s AI system inventory before the use begins.
5. Any change to an approved use that changes its purpose, its data, or its risk level is treated as a new use and follows this process again.

6. Data Governance

[Company] does not train or fine-tune AI models. Training or fine-tuning a model requires approval from the CISO before any work begins. Where AI tools are used, the data they access is controlled under [Company]'s existing data protection standards.

• AI tools access only the data necessary for their approved purpose.
• Personal data and controlled government information are used with AI tools only where entered into systems approved to hold that type of data, as set out in section 12.
• AI models are run within [Company]'s own cloud environment; the company's existing access control, encryption, logging, and monitoring standards apply equally to the AI models themselves, the data they process, and their logs.
• Data used with AI tools is retained, backed up, and disposed of according to [Company]'s existing data retention and disposal standards.
• Access to AI tools and their output is limited to staff whose role requires it.

7. Fairness and Bias

Where an AI tool is used to support a decision about a person, such as hiring, performance evaluation, or discipline, [Company] checks the tool for unfair bias before relying on it for that purpose.

• Before an AI tool is used in hiring, performance, or other decisions about people, the CISO obtains the supplier's bias-testing results or tests the tool itself.
• The result of that check is recorded in the AI system inventory before the tool is used for that purpose.
• An AI tool found to produce materially different outcomes for different groups of people is suspended from that use until the issue is addressed.
• Staff report suspected biased or unfair AI output through the process described in section 16.

8. Human Oversight

AI does not make a decision with a legal or similarly significant effect on a person without a person who reviews the case and can change the outcome.

• No decision with a legal or similarly significant effect on a person, such as a hiring, disciplinary, or contract decision, is made solely by an AI system.
• The person reviewing an AI-supported decision must have the authority and knowledge to overrule the AI output, and must not simply approve it without review.
• AI used for service desk triage or similar operational tasks only prioritizes or routes work; a member of staff decides and acts on the outcome.
• Staff who rely on AI output remain responsible for the accuracy and appropriateness of any resulting action.

9. Transparency

[Company] is clear with people about when AI has played a role in a decision or in material it produces.

• Anyone affected by a decision that involved AI is told that AI was used, on request or as part of how the decision is communicated to them.
• Content created substantially with AI and sent to customers, partners, or the public is not presented as unaided human work where that would mislead the recipient.
• Staff disclose their use of AI tools in their work where a customer, contractor, or auditor asks.

10. Safety, Security and Reliability

AI tools are treated as part of [Company]'s IT estate and are subject to the same security requirements as any other system that processes customer or government data.

• AI tools and systems are included in [Company]'s asset inventory and are subject to the same access control, patching, and monitoring standards as other IT systems.
• The SOC team monitors AI-enabled security tools for unexpected or unsafe behavior and investigates alerts through [Company]'s existing incident process.
• AI tools are tested for reliability before being approved for a new use and are re-tested after a significant change to the tool or its underlying model.
• AI tools that process controlled government information or PII operate only within systems that meet the security requirements [Company] applies to that data.

11. Third-Party AI Services

Before adopting an AI tool or service from an external supplier, [Company] reviews the supplier's terms to understand how it will handle [Company]'s data.

• Before use, the CISO reviews whether the supplier may use [Company]'s inputs and outputs to train its own models, how long it retains that data, and where it processes it.
• Personal data and controlled government information are sent only to AI services whose terms confirm the supplier does not use that data to train its own models.
• AI suppliers go through [Company]'s existing vendor risk management and security assessment process before use.
• Contracts with AI suppliers reflect [Company]'s data protection and security requirements, including its CMMC, NIST SP 800-171, and SOC 2 obligations where relevant.

12. Staff Use of AI Tools

Staff must use AI carefully and only in ways this policy allows.

• Staff use only AI tools that [Company] has approved for work purposes.
• Staff check AI-generated output for accuracy and appropriateness before relying on it or sending it outside the company.
• Staff remain responsible for any work product they create with the help of AI.
• Customer data and personal data are entered only into AI tools [Company] has approved for that type of data.
• Controlled government information is entered only into AI tools operating inside systems [Company] has authorized to hold that information.
• Contractors who perform work for [Company] follow these rules in the same way as employees.

13. Monitoring, Incidents and Records

[Company] keeps records of the AI it uses and treats problems with AI as security or operational incidents.

• [Company] maintains an AI system inventory recording, for each AI system it builds or uses: its purpose, owner, model or supplier, the data it uses, its risk rating, its approval, and its test results.
• AI systems are re-tested when the underlying model changes, including when a supplier updates or retires a model version.
• Incidents involving AI, such as harmful or biased output, a data leak through an AI tool, or a system behaving outside its intended use, are reported and handled through [Company]'s existing incident response process.
• The SOC team investigates AI-related security incidents alongside other security incidents.
• Records of AI approvals, assessments, and incidents are retained according to [Company]'s record retention standards.

14. Training and Awareness

[Company] provides training on this policy and on the safe, responsible use of AI tools to staff who use them, suited to their role and the tasks they perform. This training is refreshed at least once a year and is updated whenever this policy changes materially.

15. Legal and Regulatory Requirements

[Company]'s use of AI is governed by existing US law and by the frameworks it already follows for its security and compliance obligations.

• Existing US laws on consumer protection, unfair or deceptive practices, discrimination, and privacy apply to [Company]'s use of AI in the same way they apply to any other technology.
• Some US states and cities regulate the use of AI in employment decisions; before AI is used in hiring, performance, or other decisions about staff, [Company] checks which such rules apply and follows them.
• AI systems and AI suppliers fall within the controls [Company] already runs for CMMC.
• AI systems and AI suppliers fall within the controls [Company] already runs for NIST SP 800-171.
• AI systems and AI suppliers fall within the controls [Company] already runs for SOC 2.
• Contracts with defense and government customers may impose additional requirements on the use of AI with their data; [Company] follows those requirements as set out in the applicable contract.

16. Raising Concerns

Anyone who has a concern about how AI is being used at [Company], including staff, contractors, customers, and people affected by [Company]'s use of AI, can raise it with [AI concerns contact email]. Concerns are acknowledged within 3 business days. Staff who raise a concern in good faith are not penalized for doing so.

17. Policy Review and Exceptions

The CISO reviews this policy at least once a year and whenever [Company]'s use of AI changes materially. Any exception to this policy requires the CEO's approval and is documented in the AI system inventory.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Responsible AI Policy

• Version: 1.0
• Owner: Chief Technology Officer
• Approved by: Chief Executive Officer
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose

[Company] builds artificial intelligence ("AI") features into its products, uses AI internally to support its own operations, and trains and fine-tunes AI models. This policy sets out the principles [Company] follows when it builds, buys, and uses AI, and the practical commitments that put those principles into effect, so that AI is used in a way that is fair, safe, and accountable to the enterprise customers, staff, and individuals it affects.

This policy applies alongside [Company]'s existing information security, data protection, and vendor management policies. Where those policies already cover a topic, such as access control or incident response, this policy explains how AI systems and AI suppliers fit within them rather than repeating them.

2. Scope

This policy applies to every AI system [Company] builds, buys, or uses, wherever it operates and whichever business unit or region is responsible for it. It covers:

• AI features built into [Company]'s products and made available to customers.
• AI tools used internally by staff for tasks such as drafting, analysis, coding assistance, or research.
• AI models [Company] trains or fine-tunes, whether from scratch, from open datasets, or using customer data.
• AI services obtained from external AI model providers, through an application programming interface (API) or similar service, and models run in [Company]'s own cloud environment.
• Decisions supported or made by AI that affect customers, staff, job applicants, or members of the public.

3. Principles

[Company] applies the following principles to every AI system it builds, buys, or uses.

• Fairness: AI systems are tested and monitored so they do not produce unjustified different outcomes for different groups of people.
• Transparency: People are told when they are interacting with AI or when AI has materially influenced a decision about them, and AI-generated content is labeled where it could be mistaken for human work.
• Human oversight: A person with the authority and knowledge to change the outcome reviews any AI-supported decision that has a legal or similarly significant effect on a person.
• Accountability: Every AI system has a named owner, is recorded in [Company]'s AI system inventory, and is approved before it is used.
• Privacy: Personal data used in or with AI is protected and used only as this policy, [Company]'s data protection policies, and applicable law allow.
• Safety and security: AI systems are tested for reliability, secured to the same standard as [Company]'s other systems, and monitored for behavior outside their intended use.

4. Roles and Responsibilities

• Chief Technology Officer (CTO): Is accountable for this policy, chairs the AI Governance Committee, and approves higher-risk uses of AI escalated to that level.
• AI Governance Committee: A standing committee of senior representatives from Engineering, Product, Legal and Compliance, Security, and People, chaired by the CTO. Reviews and approves higher-risk uses of AI, approves the training or fine-tuning of models, maintains oversight of the AI system inventory, and considers escalated incidents and concerns.
• Chief Information Security Officer (CISO) and security team: Assess the security of AI systems, including models run in [Company]'s own cloud environment and services obtained from AI model providers, review provider terms affecting data handling, and lead the response to AI-related security incidents.
• Legal and Compliance function: Advises on the laws and frameworks that apply to each use of AI, reviews contracts with AI providers and customers, and carries out data protection impact assessments where required.
• Product and engineering leads: Own the AI systems and features under their area, ensure testing is carried out before release and after changes, and keep the AI system inventory current for their systems.
• People managers: Ensure a human reviews and can change the outcome of any AI-supported decision about a staff member, and obtain the approval required by Section 5 before using AI in such decisions.
• All employees: Follow this policy when using AI tools, use only approved tools for work purposes, and raise concerns about AI use in accordance with Section 16.

5. Approving New Uses of AI

Every new use of AI at [Company] is approved before it starts, and the level of review scales with the risk it presents. A low-risk use, such as drafting internal text with an already-approved tool, needs only the approval already recorded for that tool. A use that affects customers, staff, or the public, or that involves personal or customer data, needs a short assessment of who could be affected and how, and approval from a more senior role, before it begins.

1. The person proposing the use identifies whether it is low-risk or requires assessment, based on who it affects and what data it uses.
2. For a low-risk use of an already-approved tool, no further approval is needed beyond the existing tool approval.
3. For any other use, the proposer completes a short impact assessment describing who could be affected and how, and submits it, with a recommendation, to the CTO or, for higher-risk uses, to the AI Governance Committee.
4. The CTO or the Committee approves, rejects, or requests changes to the proposed use before it begins.
5. The approved use, its impact assessment, and the approval decision are recorded in [Company]'s AI system inventory, together with any model training or fine-tuning associated with it.

6. Data Governance

[Company] trains its own AI models using data other than customer data, and fine-tunes models using customer data. Training or fine-tuning any model requires the approval described in Section 5 before it starts.

• For each dataset used to train a model, [Company] records where the data came from and the permission it has to use it, such as a license or the contract under which the data was obtained.
• Each training dataset is checked for personal data before use, and any personal data found is handled in line with [Company]'s data protection requirements.
• Customer data is used to fine-tune a model only where the customer's contract allows it.
• A model fine-tuned using one customer's data is used only for that customer, unless that customer's contract allows broader use.
• Fine-tuned or trained models, their datasets, and their documentation are recorded in the AI system inventory alongside the AI system that uses them.

7. Fairness and Bias

[Company] tests AI systems for unfair differences in how they treat different groups of people, both before those systems are used and on an ongoing basis.

• Each AI feature in [Company]'s products is tested for differences in performance across the groups of people it affects, before release and after any significant change, and the results are recorded in the AI system inventory.
• Before AI is used in hiring, performance, promotion, or other decisions about people, [Company] obtains the supplier's bias-testing results or tests the tool itself, and records the result.
• Where testing identifies an unfair difference in outcomes, the affected AI system's owner must address it, or the AI Governance Committee must approve continued use with mitigations, before the system is used further.

8. Human Oversight

AI does not make a decision with legal or similarly significant effects on a person, such as hiring, dismissal, promotion, or a similar decision arising in [Company]'s business, without a person who reviews the case and can change the outcome.

• The reviewing person must have the authority and knowledge to overrule the AI system's output, and must not simply approve it without genuine review.
• Where [Company]'s product includes AI features used by customers, the customer's staff make any such decision about their own people, not [Company] or its AI system.
• [Company] designs its AI features so that a customer's staff can review, question, and override the feature's output before it is acted on.
• Managers and product owners must be able to show, on request, how human review is applied to a given AI-supported decision.

9. Transparency

[Company] tells people when they are dealing with AI and gives them enough information to understand and question an AI-supported decision that affects them.

• Users of [Company]'s products are told when they are interacting with an AI system, unless this is obvious from the context.
• Content generated by AI is labeled where a person could otherwise mistake it for unaided human work.
• Customers receive a description of what each AI feature does, what data it uses, and its known limitations.
• Synthetic audio, images, video, and text that an AI system generates and that is made available to people are marked as AI-generated in a machine-readable format.
• Anyone affected by a decision in which AI played a material role is told that AI was used.
• Material created with AI and sent outside [Company] is not presented as unaided human work where doing so would mislead the recipient.

10. Safety, Security and Reliability

AI systems are secured and tested to the same standard as [Company]'s other production systems, and are monitored for behavior outside their intended use.

• The security team assesses the security risks of an AI system, including any model run in [Company]'s own cloud environment, before it is deployed.
• Models run in [Company]'s own cloud environment are protected by [Company]'s standard access control, encryption, and logging controls, applied to the model, its data, and its logs.
• AI features are tested for reliability and expected performance before release and after any change to the feature or the underlying model.
• AI systems are monitored for output or behavior outside their intended use, and any anomaly is escalated through [Company]'s incident process.
• Where an AI system fails or degrades, a manual or fallback process is available so that the underlying business function can continue.

11. Third-Party AI Services

Where [Company] accesses an AI model through a model provider's own service or API, it checks the provider's terms before use to understand how the provider treats [Company]'s inputs and outputs.

• Before using a provider's service, [Company] checks whether the provider may use its inputs and outputs to train the provider's own models, how long the provider keeps them, and where the provider processes them.
• Customer data and personal data are sent only to AI services whose terms confirm the provider does not train its own models on that data.
• Contracts with AI model providers are reviewed by the Legal and Compliance function before they are signed, and providers are assessed as part of [Company]'s existing vendor risk management process.
• Models run in [Company]'s own cloud environment are subject to the security controls described in Section 10, in addition to any checks on the model's origin and license.

12. Staff Use of AI Tools

Staff use AI tools to support their work, but remain personally responsible for the accuracy and appropriateness of anything they produce with AI assistance.

• Staff use only AI tools [Company] has approved for work purposes.
• Staff check AI-generated output for accuracy before relying on it or sending it outside [Company].
• Staff remain responsible for work they produce with the help of AI, in the same way as for any other work product.
• Customer data and personal data are entered only into AI tools [Company] has approved for that data.
• AI is not used to make a decision about a person, such as hiring, performance, or promotion, without the human review required by Section 8, and, for staff decisions, without the check required by Section 15 on applicable employment laws.

13. Monitoring, Incidents and Records

[Company] keeps a record of every AI system it builds or uses, and treats problems with an AI system as it would any other operational or security incident.

• The AI system inventory records, for each AI system, its purpose, its owner, the model or supplier it uses, the data it uses, its risk rating, its approval, and its test results.
• An AI feature is re-tested when the underlying model changes, including when a provider updates or retires a model version.
• AI incidents, such as harmful or biased output, a data leak through an AI tool, or a system behaving outside its intended use, are handled through [Company]'s incident response process.
• Incidents involving personal data are assessed for breach notification duties under applicable data protection law.
• Records of AI incidents and their resolution are retained alongside other security incident records.

14. Training and Awareness

[Company] provides training on this policy to staff whose work involves building, approving, or using AI, refreshed at least annually and updated when this policy changes materially. [Company] takes measures to support the AI literacy of its staff, and of others who operate or use AI systems on its behalf, suited to their role and to the people the AI affects.

15. Legal and Regulatory Requirements

[Company]'s use of AI is subject to the data protection, consumer protection, and AI-specific laws of the regions in which it operates, and to the security and compliance frameworks it maintains.

• Where [Company] decides how personal data is used, as it does for its own staff and the people it deals with directly, it uses personal data in AI only with a lawful basis and after telling the people concerned, and its impact assessment under Section 5 decides whether a data protection impact assessment is needed, which it is wherever the processing is likely to result in a high risk to people.
• Where [Company] processes personal data on behalf of a customer, it uses that data in AI only as the customer's contract allows, and the customer is responsible for the lawful basis, telling people, and any assessment.
• A person subject to a decision based solely on automated processing that has legal or similarly significant effects on them can obtain human intervention, express their point of view, and contest the decision. Under the EU's General Data Protection Regulation (GDPR), such decisions are permitted only in limited cases.
• Personal data of people in India is used in AI only with their consent or for another use the India Digital Personal Data Protection Act allows.
• Existing US laws on consumer protection, discrimination, and privacy apply to [Company]'s use of AI as they do to any other technology.
• Some US states and cities regulate the use of AI in employment decisions; before AI is used in hiring, performance, or other decisions about staff, [Company] checks which such rules apply.
• Where the California Consumer Privacy Act (CCPA) or other US state privacy laws apply, personal data used with AI is handled as those laws require, including the rights they give people over their data.
• The EU AI Act sets duties according to [Company]'s role and the risk of each AI system. [Company] is a provider of an AI system it develops, or has developed, and places on the market or puts into service under its own name, and a deployer of an AI system it uses under its own authority; it records its role and the risk category of each AI system in its AI system inventory.
• The EU AI Act prohibits certain practices, such as social scoring, and [Company] does not use AI for them.
• The EU AI Act treats AI used in areas such as recruitment and other employment decisions, assessing the creditworthiness of individuals (other than for detecting fraud), and pricing life and health insurance as high-risk; before building or using an AI system in such an area, [Company] confirms that system's obligations with legal counsel.
• [Company]'s ISO 27001 and SOC 2 controls apply to its AI systems and to the AI suppliers it uses, in the same way as they apply to its other systems and suppliers.

16. Raising Concerns

Staff, contractors, customers, and any person affected by [Company]'s use of AI may raise a concern about an AI system, such as unfair, harmful, or inaccurate output, to [AI concerns contact email]. Concerns are acknowledged within 5 business days and are handled under [Company]'s incident process where they relate to an AI incident. A person who raises a concern in good faith is not penalized for doing so.

17. Policy Review and Exceptions

This policy is reviewed at least every 12 months, and whenever a significant change in [Company]'s use of AI or in applicable law requires it. Any exception to this policy must be approved in advance by the CTO or the AI Governance Committee and recorded in the AI system inventory.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Responsible AI Policy

• Version: 1.0
• Owner: Executive Director
• Approved by: Board of Directors
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose

This policy sets out the principles [Company] follows when it evaluates, approves and uses artificial intelligence ("AI"), and the commitments it makes to put those principles into practice. It applies whether AI is used to support internal work, to communicate with donors and beneficiaries, or in any other part of [Company]'s operations.

[Company] currently makes little or no use of AI. This policy exists so that any future use of AI is considered carefully, approved before it starts, and used in a way that protects the people [Company] serves, its donors, its staff and its volunteers.

2. Scope

This policy applies to all staff, volunteers and contractors of [Company], and to any AI system or tool used on [Company]'s behalf, regardless of whether it is built by [Company] or supplied by a third party. It covers:

• General-purpose AI tools, such as tools that generate or summarize text, images or other content.
• AI features embedded in software or platforms [Company] uses, including office and productivity suites.
• Any AI system used, now or in the future, to help make a decision about a donor, beneficiary, staff member, volunteer, or job applicant.
• Any AI system [Company] might build, commission, or have customized for it in the future.

3. Principles

[Company] applies the following principles to every use of AI it approves.

• Fairness. AI must not create or worsen unfair or discriminatory outcomes for the people it affects, including donors, beneficiaries, staff, volunteers and applicants.
• Transparency. People are told when AI has materially affected a decision or communication that concerns them, and AI-generated content is not passed off as unaided human work where that would mislead.
• Human oversight. A person with the authority and knowledge to change the outcome reviews any AI output used in a decision that meaningfully affects a person.
• Accountability. Every use of AI has a named owner within [Company] who is responsible for its approval, its ongoing use and any issues it causes.
• Privacy. Personal data, sensitive personal data and payment card data are used with AI only where this policy and [Company]'s other data protection rules allow.
• Safety and security. AI tools are chosen and used in ways that protect [Company]'s systems, data and the people it serves from harm, error or misuse.

4. Roles and Responsibilities

• Executive Director: owns this policy, is accountable for its implementation, approves any new use of AI that affects donors, beneficiaries, staff or volunteers or that involves personal or payment card data, and approves any exception to this policy.
• Outsourced IT/security provider: supports [Company] by assessing the security of AI tools and services before they are approved, applying [Company]'s technical security controls to any AI system in use, and helping investigate AI-related security incidents.
• Staff and volunteers: use only AI tools approved under this policy, check AI output before relying on it or sharing it, and raise any concern about an AI tool or its output as set out in this policy.

5. Approving New Uses of AI

No AI tool or system is used at [Company] without prior approval, and the level of review depends on the risk involved. A low-risk use, such as an individual staff member drafting internal text with an approved AI tool, needs only the approval of that tool for use at [Company]. Any use of AI that affects donors, beneficiaries, staff, volunteers or the public, or that involves personal, sensitive personal or payment card data, needs a short assessment of who could be affected and how, followed by the approval of the Executive Director.

1. The staff member proposing the use identifies what the AI tool will do, what data it will use, and who it could affect.
2. Where the use is low-risk, the staff member confirms the tool is on [Company]'s list of approved tools, or requests its approval, before use.
3. Where the use affects people or involves personal, sensitive personal or payment card data, the staff member completes a short impact assessment covering who could be affected and how, and submits it to the Executive Director for approval.
4. The assessment and the approval decision are recorded in [Company]'s AI system inventory before the AI tool or system is used.

6. Data Governance

[Company] does not train or fine-tune its own AI models. Training or fine-tuning a model is not undertaken unless it is approved in advance by the Executive Director under Section 5, and this policy is updated to reflect any such use before it begins.

• Personal data, sensitive personal data and payment card data are used with AI only where this policy's requirements are met.
• AI tools and services are used only for the purpose for which they were approved.
• Data given to an AI tool is limited to what the tool needs to perform its approved purpose.
• Access to any AI tool that processes personal or payment card data is limited to staff and volunteers who need it for their role.

7. Fairness and Bias

Before AI is used to help make a decision about a person, such as a hiring, performance, donor engagement or beneficiary services decision, [Company] checks whether the tool is likely to treat people unfairly.

• The supplier's own bias-testing results are obtained and reviewed before such a tool is approved, wherever the supplier can provide them.
• Where such results are not available, [Company] tests the tool itself, at a level proportionate to its size, before approving it for this purpose.
• The result of this review is recorded in [Company]'s AI system inventory.
• Any tool found likely to treat people unfairly is not approved for use in decisions about people.

8. Human Oversight

AI does not make a decision with legal or similarly significant effects on a person, such as a hiring, dismissal, donor or beneficiary services decision, without a person who reviews the case and can change the outcome.

• The reviewer must have the authority and the knowledge needed to overrule the AI's output, not simply approve it.
• The reviewer must consider the individual circumstances of the case, not just the AI's recommendation.
• Decisions that AI has informed are recorded so that they can be explained and reviewed later if needed.

9. Transparency

People are told when AI has been used in a way that affects them, and AI-generated material is not presented as unaided human work where that would be misleading.

• A donor, beneficiary, staff member, volunteer or applicant is told when AI has materially contributed to a decision about them.
• Content created with the help of AI and sent outside [Company], such as communications to donors or the public, is not represented as entirely human-written where doing so would mislead the recipient.
• Staff and volunteers disclose their use of AI tools when asked by a colleague, donor, beneficiary or oversight body.

10. Safety, Security and Reliability

AI tools are chosen and operated in a way that protects [Company]'s systems and data, and their reliability is checked before they are relied upon.

• Only AI tools approved under Section 5 are used for [Company] work.
• The outsourced IT/security provider reviews the security posture of an AI tool before it is approved for use with personal, sensitive personal or payment card data.
• Staff and volunteers report any unexpected, unsafe or unreliable AI behavior to the Executive Director or the outsourced IT/security provider.
• AI tools are kept up to date and reviewed periodically to confirm they still meet [Company]'s security requirements.

11. Third-Party AI Services

[Company] relies on third-party AI services rather than building its own models, so the terms under which it accesses these services are checked before use.

• Before approving an AI service, [Company] checks the provider's terms for whether it may use [Company]'s inputs and outputs to train its own models, how long it retains them, and where it processes them.
• Personal data, sensitive personal data and payment card data are sent only to AI services whose terms confirm the provider does not use that data to train its models.
• Where an AI tool is delivered through a platform [Company] already uses for its productivity or office tools, the same approval and data rules in this policy apply to that AI tool.
• Approval of a third-party AI service is withdrawn if its terms change in a way that no longer meets these requirements.

12. Staff Use of AI Tools

Staff and volunteers may use only AI tools that [Company] has approved for work, and must check AI output for accuracy before relying on it or sharing it outside [Company].

• Staff and volunteers remain responsible for any work they produce with the help of AI, in the same way as for any other work.
• Personal data and sensitive personal data are entered only into AI tools [Company] has approved for that data.
• Payment card numbers and other payment card data are never entered into any AI tool.
• These rules apply to volunteers and contractors in the same way as to staff.

13. Monitoring, Incidents and Records

[Company] maintains an AI system inventory recording every AI tool or system it uses, and treats problems with AI in the same way as other security or operational incidents.

• The inventory records, for each AI system: its purpose, its owner, the model or supplier used, the data it processes, its risk rating, its approval, and the results of any testing carried out under Section 7.
• An AI incident, such as harmful or biased output, a data leak through an AI tool, or a tool behaving outside its approved purpose, is reported and handled through [Company]'s existing incident response process, with support from the outsourced IT/security provider where needed.
• The Executive Director reviews the AI system inventory at least once a year to confirm it remains accurate.

14. Training and Awareness

[Company] makes staff and volunteers aware of this policy, of which AI tools are approved, and of their responsibility to check AI output and protect personal, sensitive personal and payment card data when using AI. This awareness is refreshed at least once a year, and whenever this policy changes materially.

15. Legal and Regulatory Requirements

[Company]'s use of AI, and the personal data it processes with AI, must comply with the laws and frameworks that apply to its operations in the United States.

• Existing US laws on consumer protection, discrimination and privacy apply to [Company]'s use of AI in the same way as to any other technology it uses.
• Some US states and cities regulate the use of AI in employment decisions. [Company] checks which rules apply before using AI in hiring, performance or other decisions about staff.
• Where CCPA or other US state privacy laws apply, personal data used with AI is handled as those laws require, including the rights they give individuals over their data.
• AI systems and AI suppliers fall within the controls [Company] already runs to meet PCI DSS for the payment card data it handles.

16. Raising Concerns

Any staff member, volunteer, contractor, donor or beneficiary may raise a concern about an AI tool or its use, including a suspected incident, unfair outcome, or a use of AI that does not appear to have been approved, by contacting [AI concerns contact email]. Concerns are acknowledged within 5 business days. Anyone who raises a concern in good faith is not penalized for doing so.

17. Policy Review and Exceptions

This policy is reviewed at least once a year by the Executive Director, and updated sooner if [Company]'s use of AI changes. Any exception to this policy must be approved in advance by the Executive Director and recorded.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Responsible AI Policy

• Version: 1.0
• Owner: Chief Technology Officer (CTO)
• Approved by: Chief Executive Officer (CEO)
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose

[Company] builds software products that use large language models, and its staff use AI tools in their day-to-day work. This policy sets out the principles [Company] follows when it builds, buys, fine-tunes and uses artificial intelligence ("AI"), and the practical commitments that put those principles into effect.

The purpose of this policy is to make sure AI is used at [Company] in a way that is fair, transparent, safe and accountable, that protects the personal data [Company] and its customers rely on it to handle, and that meets the legal and contractual obligations that apply to [Company]'s business.

2. Scope

This policy applies to all employees of [Company] and to any contractor or temporary worker who uses AI on [Company]'s behalf. It covers AI that [Company] builds into its products, AI tools staff use internally, and AI services [Company] obtains from third parties. It applies to:

• AI features built into [Company]'s products, including features built on large language models obtained from an AI model provider or a model hosting platform.
• Models [Company] fine-tunes, including where customer data is used for fine-tuning.
• AI tools staff use for internal work, such as drafting, research, coding assistance or data analysis.
• Third-party AI services and AI-enabled features embedded in other software [Company] uses.

3. Principles

[Company] applies the following principles to every AI system it builds or uses.

• Fairness. AI systems are checked for unfair differences in how they perform across groups of people, and are not used in ways that produce discriminatory outcomes.
• Transparency. People are told when they are interacting with AI or when AI has materially contributed to a decision or piece of content that affects them, unless this is already obvious.
• Human oversight. A person with the authority and knowledge to change the outcome reviews any AI-assisted decision that has a legal or similarly significant effect on a person.
• Accountability. Each AI system has a named owner, and its use is approved and recorded before it starts.
• Privacy. Personal data used in or with AI systems is protected in line with [Company]'s data protection obligations and is used only for purposes people would reasonably expect.
• Safety and security. AI systems are tested before release, monitored while in use, and protected by the same security controls [Company] applies to the rest of its technology.

4. Roles and Responsibilities

• Chief Technology Officer (CTO): Owns this policy, maintains [Company]'s AI system inventory, approves AI tools for internal use, and oversees the testing, security and fine-tuning of AI features built into [Company]'s products.
• Chief Executive Officer (CEO): Approves this policy and approves any new use of AI that affects customers, staff or the public, or that involves personal or customer data.
• Employees and contractors: Use only AI tools approved under this policy, check AI output before relying on it, apply human judgment to decisions AI assists with, and report any concern about an AI system's behavior.

5. Approving New Uses of AI

Every new use of AI at [Company], whether an internal tool or a product feature, must be approved before it starts. The level of review scales with the risk the use presents.

1. The person proposing the new use identifies what it will be used for, what data it will process, and who it could affect.
2. Where the use is low-risk, such as drafting internal text with an already-approved tool, the CTO's approval of the tool is sufficient.
3. Where the use affects customers, staff or the public, or involves personal or customer data, the proposer carries out a short assessment of who could be affected and how, and the CEO approves the use before it starts.
4. The use, its assessment (where one was required) and its approval are recorded in [Company]'s AI system inventory before the AI system is used.

6. Data Governance

[Company] does not train AI models from scratch. It fine-tunes existing large language models, including with customer data, and any new fine-tuning project must be approved under Section 5 before it begins.

• Before any dataset is used for fine-tuning, its source, the permission to use it (such as a license or the contract under which it was obtained), and whether it contains personal data are recorded.
• Customer data is used to fine-tune a model only where the relevant customer contract allows it.
• A model fine-tuned on one customer's data is used only for that customer, unless the contract allows broader use.
• Personal data used in any AI system is limited to what is necessary for its purpose and is not kept for longer than needed.
• Data used with AI systems is subject to the same access controls and data handling rules that apply to [Company]'s other systems.

7. Fairness and Bias

[Company] checks that its AI features and AI-assisted decisions do not produce unfair or discriminatory outcomes for the people they affect.

• Each AI feature built into [Company]'s products is tested for differences in how well it performs across the groups of people it is likely to affect, before release and after any significant change, and the results are recorded.
• Before an AI tool is used in hiring, performance review or other decisions about people, [Company] obtains the supplier's bias-testing results or tests the tool itself, and records the outcome.
• Any fairness issue found is reported to the CTO and addressed before the AI system continues in use.

8. Human Oversight

AI does not make a decision that has a legal or similarly significant effect on a person, such as a hiring, promotion, dismissal or similar decision, without a person who reviews the case and can change the outcome. That person must have the authority and knowledge needed to overrule the AI's output and must not simply rubber-stamp it.

• Where [Company]'s customers use its AI features to help make such decisions about their own staff or customers, the decision is made by the customer, not by [Company] or its AI systems.
• [Company] designs its AI features so that a customer's staff can review, question and override the AI's output before it is acted on.
• Employees using AI tools internally remain responsible for reviewing AI output before it informs a decision about a person.

9. Transparency

[Company] tells people, whether staff, customers or the people its customers deal with, when AI is materially involved in something that affects them.

• Where an AI feature interacts directly with a person, [Company] tells that person they are dealing with AI, unless this is already obvious from the context.
• Content generated by AI is labeled as AI-generated, in a machine-readable format where the AI system produces synthetic audio, image, video or text, wherever a person could otherwise mistake it for unaided human work.
• Customers of [Company]'s AI features receive a description of what the feature does, what data it uses, and its known limitations.
• Any person subject to a decision that AI has meaningfully contributed to is told that AI was used.
• Material produced with the help of AI and sent outside [Company] is not presented as unaided human work where doing so would mislead the recipient.

10. Safety, Security and Reliability

AI features are tested before release and after significant changes, and are monitored while in production, to check they behave as intended and remain secure.

• Each AI feature is tested for accuracy, reliability and security before release, and re-tested after any significant change to the feature or the underlying model.
• AI systems, their data and their logs are protected by the same security controls [Company] applies to its other production systems.
• Access to AI systems and to the data they use is limited to staff who need it for their role.
• AI features are monitored for unexpected behavior, degraded performance or misuse, and issues are escalated to the CTO.

11. Third-Party AI Services

[Company] accesses large language models through AI model providers' own services and through a model hosting platform. Before any third-party AI service is used, its terms must be checked.

• Before use, [Company] checks whether the provider may use [Company]'s inputs and outputs to train its own models, how long it retains them, and where it processes them.
• Customer data and personal data are sent only to AI services whose terms do not allow the provider to train its models on that data.
• Before using a model obtained through a hosting platform, [Company] checks that model's license and published documentation to confirm it may be used for the intended purpose.
• Contracts with AI model providers and AI tool suppliers are reviewed by the CTO before signature where the tool will process customer or personal data.

12. Staff Use of AI Tools

Staff may use AI tools for work only where the CTO has approved the tool for that purpose.

• Staff check AI-generated output for accuracy and appropriateness before relying on it or sending it outside [Company], and remain responsible for the work they produce with AI assistance.
• Customer data and personal data are entered only into AI tools the CTO has approved for that type of data.
• These rules apply equally to contractors and temporary workers who use AI on [Company]'s behalf.
• Staff do not use unapproved AI tools to process work data, even where the tool is free or widely used elsewhere.

13. Monitoring, Incidents and Records

[Company] keeps a record of every AI system it builds or uses, so it can track what AI it relies on and how each system is controlled.

• The AI system inventory records each system's purpose, owner, underlying model or supplier, the data it uses, its risk rating, its approval, and its test results.
• AI features are re-tested when the underlying model changes, including when a provider updates or retires the model version [Company] relies on.
• Incidents involving AI, such as harmful or biased output, a data leak through an AI tool, or a system behaving outside its intended use, are handled through [Company]'s existing incident response process.
• Incidents involving AI are logged in the AI system inventory alongside the affected system.

14. Training and Awareness

[Company] gives staff who use, build or operate AI systems on its behalf training suited to their role and to the people its AI affects, so they understand this policy, can recognize AI-related risks, and know how to use AI tools appropriately. This training is refreshed at least once a year and whenever this policy changes significantly.

15. Legal and Regulatory Requirements

[Company] uses AI in a way that meets the legal obligations that apply to its business in the United States and the European Union, and treats AI systems and AI suppliers as part of the controls it already runs under its SOC 2 program.

• Where [Company] decides how personal data is used, as it does for its own staff and the people it deals with directly, it uses personal data in AI only where it has a lawful basis and has told the people concerned, and the impact assessment carried out under Section 5 determines whether a data protection impact assessment is also needed, which it is wherever the processing is likely to result in a high risk to people.
• Where [Company] processes personal data on behalf of a customer, it uses that data in AI only as the customer's contract allows, and the customer remains responsible for the lawful basis, informing people, and any impact assessment required.
• A person subject to a decision based solely on automated processing that has a legal or similarly significant effect on them can request human intervention, express their point of view, and contest the decision; GDPR allows such fully automated decisions only in limited cases.
• Existing US laws on consumer protection, discrimination and privacy apply to [Company]'s use of AI as they do to any other technology.
• Some US states and cities regulate the use of AI in employment decisions; [Company] checks which rules apply before using AI in hiring, performance review or other decisions about staff.
• Under the EU AI Act, [Company] acts as a provider for AI systems it develops and places on the market under its own name, and as a deployer for AI systems it uses under its own authority, and records its role and the risk category of each AI system in its AI system inventory.
• [Company] does not use AI for practices the EU AI Act prohibits, such as social scoring.
• The EU AI Act treats AI used in areas such as recruitment and other employment decisions, assessing the creditworthiness of individuals other than for fraud detection, and pricing life and health insurance as high-risk; before building or using an AI system in any of these areas, [Company] confirms that system's obligations with legal counsel.
• Where [Company]'s AI features interact with people, they are designed so those people are told they are interacting with AI unless this is obvious, and any synthetic audio, image, video or text the features generate is marked as AI-generated in a machine-readable format.

16. Raising Concerns

Any employee, contractor, customer, or person affected by [Company]'s use of AI may raise a concern about an AI system's behavior, fairness, safety or compliance with this policy by contacting [AI concerns contact email]. Concerns are acknowledged within 5 business days. Anyone who raises a concern in good faith is not penalized for doing so.

17. Policy Review and Exceptions

This policy is reviewed at least once a year and whenever [Company]'s use of AI changes significantly. Any exception to this policy must be approved in writing by the CEO.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.