Artificial Intelligence Usage Policy

Purpose

This policy governs the use of artificial intelligence (AI) tools, large language models (LLMs), and machine learning services within Carriyo. It establishes guardrails to ensure that AI usage does not compromise data confidentiality, introduce security vulnerabilities, or create unacceptable legal or reputational risk.

Scope

This policy applies to all Carriyo employees, contractors, and third-party personnel who use AI tools in the course of their work at Carriyo. It covers both AI tools provided by Carriyo (e.g., Claude, GitHub Copilot) and external AI services accessed independently.

Policy Statements

Approved AI Tools

• Carriyo maintains an approved list of AI tools and services that have been evaluated for security, privacy, and compliance. The current approved list is maintained by the security team.
• Employees must only use approved AI tools for work-related tasks. Use of unapproved AI services for processing company data is prohibited.
• Requests to evaluate and approve new AI tools must be submitted to the security team, who will conduct a risk assessment before granting approval.

Data Protection and Confidentiality

• Restricted data (encryption keys, credentials, security configurations) must never be entered into any AI tool, whether approved or otherwise.
• Confidential data (customer data, PII, financial records, proprietary source code) must not be entered into AI tools unless the tool has been explicitly approved for that data classification level and appropriate data processing agreements are in place.
• Internal data may be used with approved AI tools that have been assessed for data handling practices.
• Public data may be used freely with any AI tool.
• Employees must review AI-generated outputs before sharing them externally to ensure no confidential information has been inadvertently included.

AI in Software Development

• AI code generation tools (e.g., GitHub Copilot, Claude Code) may be used to assist with development, subject to the following controls:
  • All AI-generated code must undergo the same peer review and testing process as human-written code.
  • Developers must verify that AI-generated code does not introduce known vulnerabilities, insecure patterns, or licence-incompatible open-source code.
  • AI-generated code must not be blindly accepted; developers remain responsible for understanding and validating all code they commit.
• AI tools must not be granted direct access to production systems or production data without explicit security team approval and appropriate access controls.

AI in Customer-Facing Features

• Any AI feature integrated into the Carriyo platform that processes customer data must undergo a privacy impact assessment and security review before deployment.
• AI features that make automated decisions affecting customers must include appropriate human oversight mechanisms.
• Customers must be informed when AI is used to process their data, in accordance with applicable data protection regulations.

AI Model Training

• Carriyo data must not be used to train third-party AI models unless explicitly authorised by the CISO and covered by appropriate contractual terms.
• When evaluating AI vendors, preference is given to services that do not use customer inputs for model training.

Transparency and Accountability

• AI-generated content used in customer communications, legal documents, or regulatory submissions must be reviewed and approved by a qualified human before use.
• Employees must disclose the use of AI tools when producing work products where such disclosure is required by policy, contract, or regulation.

Roles and Responsibilities

Compliance and Enforcement

Compliance with this policy is assessed through periodic audits of AI tool usage and reviews of data handling practices. Violations may result in revocation of AI tool access and disciplinary action. The security team reviews this policy at least annually to account for the rapidly evolving AI landscape.