### 1. Formal Workplace Policy Statement & Scope of Applicability * **Policy Title:** Acceptable Use of Generative Artificial Intelligence (GenAI) & Machine Learning Tools * **Effective Date:** Immediate upon publication | **Applies To:** All full-time employees, part-time staff, contractors, and third-party consultants. * **Purpose & Objective:** This policy governs the ethical, secure, and compliant utilization of Generative AI tools (including, but not limited to, OpenAI ChatGPT, Anthropic Claude, GitHub Copilot, and Midjourney). The organization actively encourages technological innovation while enforcing strict controls to protect customer Personally Identifiable Information (PII), proprietary intellectual property, and adherence to SOC 2 Type II and GDPR standards. * **Scope of Authority:** Generative AI tools may only be utilized to assist with research, drafting, and boilerplate coding within approved enterprise sandbox accounts. --- ### 2. Step-by-Step Standard Operating Procedure (SOP) & Compliance Guardrails * **Approved Tools & Workspaces:** * Employees must only access AI tools using company-provisioned enterprise accounts configured with data-retention and model-training opt-out agreements. * The use of personal AI subscriptions or unverified browser extensions on corporate hardware is strictly prohibited. * **Data Classification & Prohibited Inputs:** * **Zero-Ingestion Tier (Strictly Prohibited):** Customer PII, customer operational data, unreleased proprietary source code, cryptographic keys, internal financial metrics, and executive meeting recordings. * **Permissible Input Tier (Allowed with Review):** Anonymized code refactoring, generic marketing frameworks, public technical documentation searches, and grammar polishing. * **Mandatory Output Verification SOP:** * All AI-generated code must undergo standard pull-request (PR) peer review and automated security static analysis before merging into production repositories. * Staff are directly accountable for the accuracy, factual validity, and IP non-infringement of all submitted work outputs. --- ### 3. Progressive Violation, Investigation & Disciplinary Framework Any suspected unauthorized data exposure through unapproved AI tools will trigger an immediate review by the Security and People Operations teams. | Violation Tier | Example Infraction | Remediation & Disciplinary Action | | :--- | :--- | :--- | | **Tier 1: Minor / Non-Confidential** | Using an unapproved personal AI tool for non-confidential text drafting | Written warning, mandatory re-training on AI policy within 48 hours. | | **Tier 2: Moderate / Code Ingestion** | Pasting non-PII internal code snippets into an unverified public AI tool | Revocation of AI tool access, formal performance reprimand on file. | | **Tier 3: Severe / Data Compromise** | Ingesting customer PII or confidential client credentials into public LLMs | Immediate suspension pending SOC 2 breach audit, termination for cause, and potential legal action. | * **Incident Reporting Requirement:** Employees who inadvertently paste protected data into an unapproved AI system must report the incident to `security@company.com` within 2 hours to limit exposure. --- ### 4. Legally Enforceable Employee Acknowledgment & Signature Clause ```text I acknowledge that I have received, read, and understand the Company's Generative AI & Proprietary Data Usage Policy. I understand that I am prohibited from entering customer PII, confidential company financial information, or proprietary source code into unapproved public AI tools. I acknowledge that all intellectual property generated during my employment remains the exclusive property of the Company and that violation of this policy may result in disciplinary action up to and including immediate termination of employment for cause. Employee Printed Name: _____________________________________________ Employee Signature: _____________________________________________ Date: _____________________________________________