Skip to content

Article Intelligence (AI) Security Policy

Document Information
Version {{version}}
Effective Date {{effective_date}}
Document Owner {{document_owner}}
Next Review {{next_review_date}}
Approved By {{approved_by}}

Purpose

This policy is established to guide the responsible, secure, and compliant use of Artificial Intelligence (AI) technologies at {{company_name}}. It aims to ensure that AI systems are utilized effectively to enhance our business operations while managing potential risks. This AI Security Policy sets out management's direction.

AI technologies offer significant opportunities for innovation and efficiency. However, they also introduce unique challenges and risks that must be managed carefully. This policy aims to balance the benefits of AI with the need for security, privacy, and compliance.

{{company_name}} is committed to the secure and responsible use of AI. We recognize the potential of AI to drive innovation and efficiency but also acknowledge the importance of addressing the ethical, privacy, and security challenges associated with these technologies.

Scope

This policy applies to all employees, interns, contractors, and third parties who use, manage, or interact with AI systems at {{company_name}}. It covers all AI technologies and applications used within the organization.

AI Systems Usage and Security

  • Only pre-approved AI tools and systems are to be used.

  • Free, unvetted AI tools are not to be used due to security and compliance risks.

  • Formal approval process for new AI tools managed by the by {{policy_authority}}.

  • Adherence to existing cyber and information security and data privacy policies and procedures.

AI Risk {{management_team}}

All AI-related risks, including data privacy, security vulnerabilities, and ethical concerns, must be identified and assessed regularly by {{it_provider}}. These risks must be recorded in the Cyber and Information security risk register.

Effective strategies must be implemented and documented to mitigate the identified risks. This includes regular updates to AI systems annual reviews of the risks and adherence to cyber and information security policies and produces.

Data Privacy and Protection

AI systems must comply with {{company_name}}\'s Privacy Policy and all relevant data protection laws and regulations. Special care must always be taken to protect sensitive and personal data processed by AI systems.

AI-specific Threats and Response Strategies

Potential AI-related cybersecurity threats, such as data poisoning and model stealing, must be continuously monitored by {{it_provider}}. Data poisoning is a form of attack on machine learning systems where the training data is intentionally manipulated to compromise the performance of the system.

A specific response plan for AI-related cybersecurity incidents must be in place, outlining procedures for containment, eradication, and recovery.

Training and Awareness

All staff must receive regular (at least annually) training on the secure use of AI technologies, focusing on potential risks and best practices for risk mitigation. This is to be organised the by {{it_provider}}.

Vendor {{management_team}}

Third-party AI services must be managed in line with {{company_name}}\'s Third-Party Supplier Security Policy and Third-Party Software Acquisition Policy.

Compliance and Legal Obligations

All AI usage must adhere to legal and regulatory requirements, with particular attention to intellectual property, consumer protection laws and the laws and regulations associated with {{financial_legislation}}.

Staff Responsibilities

Staff (including interns and contractors) are expected to uphold the expected standards of professional conduct and comply with this policy in its entirety.

All staff must read, understand, and comply with all components of this policy, and all laws, and regulations that apply to their role.

  • Staff should speak up when seeing possible violations of the policies, and legal and regulatory requirements.

  • Be truthful, and cooperate fully in any internal investigations, and not conceal or destroy information.

  • Staff should ensure they complete training on the policies, and attest that they are understand and commit to comply with them.

  • Failing to read or attest to the policies does not excuse staff from these responsibilities.

Review

This policy will be reviewed at least annually or as needed based on changes to our business, technology, or regulatory environment.

Enforcement & Waivers

These policies are important to us. Violation may result in disciplinary action, up to and including termination of employment. Only by consent of the {{company_name}}'s board of directors a provision of the policies for a staff member may be waivered.

Implementation Check

  1. Who owns this? {{policy_owner}}
  2. Are we doing it? {{implementation_status}}
  3. When will we check again? {{next_review_date}}