AI Acceptable Use Policy

AI tools can make our work faster and better. They can also expose client data, introduce errors into client-facing work, or create compliance problems if used without boundaries. This policy exists to protect clients, protect the organization, and give staff a clear set of rules they can actually follow.

This is not a prohibition on AI use. It is a framework for using AI responsibly. Staff are encouraged to use approved AI tools as part of their daily work. The goal is to make sure the right guardrails are in place so that AI is an asset, not a liability.

This policy applies to all staff, contractors, and third parties who use AI tools in the course of work for or on behalf of the organization. It covers all AI tools — whether provided by the organization, accessed independently, or used on personal devices for work purposes.

The following uses of approved AI tools are permitted. All approved uses assume the data handling rules in Section 05 are followed — if client PII, credentials, or confidential data are involved, the restrictions in that section apply regardless of the use case.

The following uses are prohibited regardless of which AI tool is used. A single prohibited act — even if accidental — must be reported per Section 09. These rules exist to protect clients, protect the organization, and maintain compliance with contractual and regulatory obligations.

Before putting anything into an AI tool, apply this test: would you be comfortable if this text appeared in a public data breach? If the answer is no — anonymize it first, or describe the situation without pasting the raw data.

The following data types are off-limits for public AI tools under any circumstances:

AI output is a first draft, not a finished product. All AI-generated content that leaves the organization or affects a client environment requires human review before it is used. This is not optional — it is a control requirement mapped to SOC 2 CC2.2 and CC2.3.

No AI tool may be used for work purposes — even for personal productivity tasks that involve work context — until it has completed the organization's AI Tool Approval Process. The approved tools list is maintained by IT / Security and available in the AI Resource Hub.

Shadow AI — unauthorized AI tools running inside the organization or client environments — represents a significant and growing risk. The organization uses SentinelOne Deep Visibility to detect unauthorized local AI models (including Ollama, LM Studio, llama.cpp, and Whisper), rogue GPU usage, and unapproved AI tooling across managed endpoints.

Report any of the following situations immediately. Early reporting limits damage. Delayed reporting makes it worse — and may create additional liability. Reports go to IT / Security and the Risk Owner. For data exposure events, do not notify the client until IT / Security has completed an initial assessment.

Violations of this policy are handled through the organization's standard disciplinary process. The severity of the response is proportional to the nature and impact of the violation. Accidental violations that are promptly reported are treated differently from deliberate or repeated violations.

If you are unsure whether a specific AI use case is permitted under this policy, escalate before proceeding. It is always better to ask first.

All staff must read and acknowledge this policy before using any AI tool for work purposes. Acknowledgement is required annually and whenever a material update is made to this document. Your acknowledgement is logged and constitutes auditable evidence for SOC 2 CC1.1 and CC1.4.