AI usage policy template

This policy explains how people working for [Organization] may use artificial intelligence (AI) tools. It lets us benefit from AI while protecting our customers, staff, information and reputation, and keeping us within the law, including the Data Protection Act, 2020 (the "Act").

This policy applies to:

• all employees, contractors, consultants, interns and volunteers who use AI tools for [Organization] work, on any device, including personal phones and computers;
• all AI tools, including chat assistants (for example ChatGPT, Microsoft Copilot or Google Gemini), writing, image, video and voice tools, meeting transcription and note-taking tools, coding assistants, and AI features built into software we already use, such as email, office, accounting and customer management systems.

• Only use AI tools listed in the Approved AI Tools Register (Appendix A), for the uses and information categories listed there.
• Use the work accounts [Organization] provides. Do not use personal accounts or free consumer versions for [Organization] work unless the register allows it.
• Keep the settings required in the register. Where a tool offers it, the setting that lets the provider use our inputs to train its models must be turned off.
• Do not install AI browser extensions, plug-ins, add-ins or apps that can read your email, documents, calendar or screen without approval.
• To request a new tool or a new use of an approved tool, complete the request form in Appendix B. [Role] will check its security, where it stores data, how the provider uses our information and its contract terms before deciding.

Before entering anything into an AI tool, decide which category it falls into. If you are unsure, treat it as the higher category or ask [role].

Remove names and other identifying details whenever the task does not need them. For example, ask for help with "a customer complaint about a late delivery" rather than pasting in the customer's email.

Used within the rules above, AI tools can help you to:

• draft and edit emails, letters, reports, proposals and social media posts;
• summarize long documents, articles or meeting notes;
• brainstorm ideas, outlines and options;
• research a topic as a starting point, then confirm the facts from reliable sources;
• write or explain spreadsheet formulas, scripts and code, which you test before use;
• translate text or rewrite it in plainer language;
• prepare training material, frequently asked questions and templates;
• [add uses specific to your organization].

You must not use AI tools to:

• process information that section 6 does not allow for that tool;
• make, or effectively make, decisions about hiring, pay, promotion, discipline or dismissal, credit, insurance, pricing for individuals, or medical or legal matters, without a qualified person reviewing the information and making the decision;
• create content that is discriminatory, harassing, offensive, misleading or defamatory;
• impersonate a real person, including creating fake images, video or voice recordings of anyone ("deepfakes");
• give customers professional, legal, financial or medical advice that a qualified person has not reviewed;
• get around security controls, monitoring or other [Organization] policies;
• record, transcribe or summarize meetings or calls without telling the participants, and getting their agreement where required;
• upload material we do not have the right to use, such as copyrighted, licensed or another organization's confidential material.

When AI tools are used with personal data, the Act's data protection standards still apply. In particular:

• Use personal data only for a specific, lawful purpose that the people concerned would expect, and only the minimum needed for the task.
• Keep personal data accurate, keep it no longer than needed, and keep it secure, including within the AI tool and in any saved chats.
• Before using AI with personal data in a new way, ask the Data Protection Officer whether a data protection impact assessment is needed.
• Many AI providers process data outside Jamaica. Personal data may only be transferred overseas where the Act allows it, so the Data Protection Officer must confirm this before a tool is approved for personal data.
• People have rights under the Act, including to see the personal data we hold about them and to object to decisions about them that are made solely by automated means. Do not use AI to make decisions that significantly affect people without human review and the Data Protection Officer's approval.
• Where customer or staff data is processed with AI, make sure our privacy notices say so.

• AI tools can be wrong, out of date or biased, and can invent facts, quotes, references, case law and statistics that look convincing. You are responsible for anything you produce or send with AI's help.
• Check facts, figures, names, dates, calculations and legal or regulatory references against reliable sources before using them.
• Have a second person review AI-assisted work that goes to [customers, regulators, the media or the board] before it is sent.
• Watch for bias or unfair assumptions, especially in content about people, and correct it.
• Test AI-generated code, formulas and automations before using them on live systems or data.

• Tell customers when they are dealing with an AI system, such as a chatbot, rather than a person, and give them an easy way to reach a person.
• Label AI-generated images, audio and video where people could mistake them for real.
• Disclose AI use where it is expected or required, for example in tenders, regulatory submissions or academic work that ask about it.
• Follow [Organization] guidance on labelling AI-generated content in our published material.

• Check the provider's terms for who owns the output and how inputs are used. [Role] records this in the register.
• Before publishing AI output, check that it does not copy someone else's work, and do not ask AI tools to reproduce copyrighted material.
• Client contracts and non-disclosure agreements may forbid sharing client information with third parties, including AI providers. Check before using AI on client work.

• Protect AI tool accounts with a strong, unique password and multi-factor authentication.
• Treat links, files and code that AI tools produce with the same caution as anything else from the internet.
• Be alert to AI-assisted scams, including cloned voices, fake video calls and convincing phishing emails. Confirm any unusual request for payment, passwords or information through a phone number you already know.
• Report a lost device or a suspected compromised account straight away.

Report to [role, email and phone number] straight away if:

• you entered information into an AI tool that this policy does not allow;
• an AI tool shows you someone else's information, behaves unexpectedly or produces harmful content;
• you think someone is misusing AI tools.

Reporting quickly limits the harm, and you will not be penalized for reporting an honest mistake promptly. The Data Protection Officer will decide whether it is a personal data breach. The Act requires certain breaches to be reported to the Information Commissioner within 72 hours of becoming aware of them, so do not wait.

• Everyone covered by this policy completes training on it before using AI tools for work, and a refresher every [12] months.
• Everyone signs the acknowledgement in Appendix C. [Role] keeps the signed copies.

• [Organization] may monitor how AI tools are used on its systems and accounts, in line with the law and our [IT acceptable use or monitoring policy].
• Breaking this policy may lead to loss of access to AI tools and to disciplinary action under our [disciplinary policy]. Serious breaches may also have legal consequences.

[Role] reviews this policy every [12] months, or sooner if the law, guidance from the Information Commissioner, our tools or the way we use them change.

[Delete any that do not apply.] Information Security Policy; Data Protection and Privacy Policy; IT Acceptable Use Policy; Records Retention Policy; Social Media Policy; Disciplinary Policy.