Appendix C. Sample Organisational AI-Use Policy

Purpose: This policy establishes minimum expectations for safe, effective, transparent, and accountable use of AI in the organisation. It should be reviewed by appropriate legal, security, HR, academic, and operational leaders before adoption.

1. Approved use

Staff may use tools listed on the organisation's approved register for permitted tasks. New tools or new uses must be reviewed before confidential information or consequential workflows are involved.

2. Prohibited or restricted use

Users must not enter passwords, authentication secrets, confidential records, or personal data into unapproved tools. AI must not make final high-impact decisions without the required validation, human oversight, and legal approval. Users must not present fabricated AI output as verified fact or falsely attribute generated content to a real person.

3. Human review

The person submitting or acting on an AI-assisted output remains responsible for checking its accuracy, suitability, fairness, and compliance. Consequential decisions require review by an authorised and competent person.

4. Data protection and security

Use the minimum data necessary. Follow access controls, retention rules, confidentiality obligations, consent conditions, and incident procedures. Do not upload data that the organisation has not approved for the relevant service.

5. Transparency and records

Disclose AI assistance where required by law, contract, institutional rules, or publication standards. Maintain records of material AI-supported decisions, sources, approvals, and corrections where appropriate.

6. Incident reporting

Report suspected data exposure, harmful output, discriminatory impact, impersonation, unauthorised action, or significant factual error promptly. The organisation will assess impact, limit harm, preserve necessary records, and revise controls.

7. Roles and review

A designated owner maintains the AI register and policy. System owners monitor performance and changes. Users complete relevant training. The policy is reviewed at least annually and after significant incidents, legal changes, or material technology changes.