AI Usage Policy 1. Purpose This policy sets out how artificial intelligence (AI) tools may be used responsibly within the business, ensuring compliance with UK data protection law and safeguarding client, employee, and business information. 2. Scope This policy applies to: • All employees • Contractors • Temporary staff • Any third - party using AI tools on behalf of the business 3. Definition of AI Tools AI Tools include (but are not limited to): • ChatGPT and similar language models • Microsoft Copilot • Google AI tools • AI features in design, CRM, marketing, or analytics software 4. Approved Use AI tools may be used for: • Drafting non - confidential content • Idea generation and brainstorming • Improving grammar or structure • Administrative assistance All AI - generated output must be reviewed by a human before use 5. Prohibited Use The following must never be entered into AI tools: • Personal data (as defined by UK GDPR) • Client confidential information • Financial records • Login credentials • Commercially sensitive information AI tools must not be used to make automated decisions without human oversight. 6. Data Protection & GDPR Staff must ensure: • No personal data is processed via AI tools unless explicitly approved • AI tools are not used as a data storage solution • Outputs are checked for accuracy and bias 7. Accountability Responsibility for AI - generated content remains with the business and the individual using the tool. AI does not replace professional judgment. 8. Training & Awareness All relevant staff must complete AI usage training and understand this policy before using AI tools for work purposes. 9. Breach Reporting Any suspected misuse of AI tools or data breaches must be reported immediately to management. 10. Review & Updates This policy will be reviewed annually or following significant regulatory or technological changes. Disclaimer: This policy demonstrates reasonable steps taken to support responsible AI use. It does not constitute legal advice. The certificate demonstrates reasonable steps taken It shows staff awareness and governance It’s valid for 12 months It’s not legal advice, but evidence of responsible practice