• AI Lead (Director): owns this policy, approves high-risk uses, and maintains the vendor list.
• Project Lead: checks client contracts and records approved use cases.
• Everyone: follow this policy and report issues at once.

High-risk uses (legal effects, profiling, safety impact) need the AI Lead’s written approval.

• No sensitive data in prompts unless a contract and a documented control set allow it. Sensitive data includes special categories, payment data, and credentials.
• For client personal data, the client is the controller. Our DPA applies. Use a provider on our Sub-processor list with the right data location and terms.
• Use zero-data retention modes where available. Do not allow vendors to train on our prompts or outputs unless the AI Lead agrees in writing.
• Mask or minimise inputs. Prefer references (IDs) over raw content.
• Do not paste secrets. Use a vault and short-lived tokens passed by the platform, not by the model.

• Staff remain responsible for outputs. Edit for accuracy, originality, and tone.
• Check licences for any code or text you keep. Keep third-party attributions where required.
• Do not imitate living artists, brands, or individuals in a way that confuses origin or endorsement.
• Do not submit client content to public tools without permission recorded in the project folder.

• Models can produce errors. For facts, add sources or verify with trusted references.
• Use clear prompts that state constraints and required sources.
• Avoid harmful or discriminatory outputs. Re-prompt or remove content that could cause harm.
• Flag medical, legal, or financial content for human expert review before use.

• Assume prompts and outputs may be logged by the tool. Treat them as business records.
• Defend against prompt injection: set system prompts to ignore external instructions; strip HTML/JS from untrusted inputs before passing to a model.
• Limit tools with write access. Approve outbound actions explicitly. Log all actions triggered by AI.
• Follow our Access Control & Password Policy for keys and tokens.

• Use vendors listed at /sub-processors. New vendors need a short review covering terms, data location, retention, and security.
• Record the model family and version used (e.g., “text-model X, 2025-08”).
• Prefer UK/EU processing where the client requires it. Document transfer safeguards if data leaves the UK/EU.

• Keep key prompts, outputs, and decisions for client work with the ticket or repo.
• Retention follows our Data Retention Schedule.
• For customer-facing AI, log confidence notes, fallback use, and any manual overrides.

• Tell clients where AI meaningfully shapes content or decisions, and how to contact a human.
• Mark AI-generated marketing copy for internal review. Remove the flag before publishing once checked.
• For chatbots, show a short notice that an AI assistant is in use and how data is handled (link to the Privacy Policy).

• Bypassing access controls, scraping against a site’s terms, or testing security without written permission.
• Deepfakes, impersonation, or synthetic media of real people without consent and a clear, lawful basis.
• Automated decisions with legal or similar effects on individuals without human oversight.
• Generating malware, exploits, or content that promotes harm.
• Targeting individuals based on protected characteristics.

• Report prompt or data leaks, unsafe outputs, or vendor breaches at once under our Incident Response & Breach Policy.
• Misuse can lead to access removal or contract action. You can also raise concerns under our Whistleblowing Policy.

• AI basics at induction for all staff who may use these tools.
• Quick refreshers after major vendor or legal changes.
• Policy review at least yearly.

Questions about this policy or a new use case?

Technophobia Ltd · Company No. 14898332 · VAT GB 495 7043 58
13B Devonshire Road Industrial Estate, Millom, LA18 4JS, United Kingdom
+44 1229 774591 • hello@technophobia.uk