AI TOOL USAGE POLICY BrightTech Solutions Pvt Ltd Mumbai Maharashtra India Effective Date: June 1 2026 Version 1.0 Responsible Leader: Priya Shah, Head of HR 1. PURPOSE AND INTENT 1.1 This policy helps every employee at BrightTech Solutions understand how to use AI tools responsibly, productively, and securely in their day-to-day work. 1.2 It exists to protect our organization's data, our clients, and our stakeholders, and to ensure that AI tools support rather than replace the judgment and accountability of the people who use them. 2. SCOPE 2.1 This policy applies to all employees of BrightTech Solutions regardless of role or seniority, and to all contractors and consultants who work on organizational projects. 2.2 It applies in our Mumbai office, in remote work settings, on personal devices used for work purposes, and on any cloud- based platform accessed using organizational credentials. 3. DEFINITIONS 3.1 AI Tool: Any software or application that uses artificial intelligence to generate, suggest, or process content, code, or information. 3.2 Generative AI: An AI system that creates new content such as text, code, or summaries in response to a user prompt. 3.3 Approved AI Tool: An AI tool that has been reviewed and approved by the IT and HR teams for use in connection with organizational work. 3.4 Unapproved AI Tool: Any AI tool not on the current approved list that employees must not use for work purposes. 3.5 Confidential Data: Any information classified as internal or confidential under the organization's data classification policy. 3.6 Personally Identifiable Information (PII): Any data that could be used to identify a specific individual such as name, contact details, or financial records. 3.7 AI-Generated Output: Any text, code, summary, or other content produced by an AI tool in response to a user input. 3.8 Human Review: The process of a qualified employee checking, verifying, and approving AI-generated output before it is used in any work product. 3.9 Data Incident: Any actual or suspected unauthorized input of confidential or personal data into an AI tool. 3.10 Effective Date: June 1 2026. 4. THE ORGANIZATION'S APPROACH TO AI 4.1 BrightTech Solutions recognizes the genuine productivity and creative potential of AI tools and is committed to embracing them in a way that is responsible, ethical, and aligned with our values. 4.2 We expect every team member to bring informed judgment and critical thinking to their use of AI tools rather than uncritical reliance on AI-generated output. 5. APPROVED AI TOOLS 5.1 The following AI tools are approved for use at BrightTech Solutions: (a) ChatGPT: Approved for all employees for drafting internal communications, brainstorming, and summarizing publicly available research. (b) GitHub Copilot: Approved for the Development team for code suggestions and assistance, subject to mandatory human code review before deployment. 5.2 To request approval for a new AI tool, employees must submit a written request to the IT team and Head of HR describing the tool, its intended use, and the data it would process. 5.3 No AI tool may be used for work purposes without appearing on the approved list. 6. UNAPPROVED AI TOOLS 6.1 Employees must not use any AI tool not on the approved list in connection with any work task, on any organizational system, or when handling any organizational data. 6.2 Unapproved tools may share your inputs with third-party AI providers, retain data in ways we cannot control, lack security certification, or produce unreliable outputs. 6.3 Using an unapproved AI tool for work purposes is a policy violation subject to the consequences in Section 20. 7. PERMITTED USES OF APPROVED AI TOOLS 7.1 Employees may use approved AI tools for: 1. Drafting internal emails, memos, and communications for human review before sending. 2. Summarizing publicly available research or information. 3. Generating code suggestions for review and approval by a qualified developer before deployment. 4. Brainstorming ideas and creating initial outlines for documents. 5. Assisting with analysis of non- confidential and non-personal datasets. 7.2 All AI-generated output must be reviewed, verified, and approved by a qualified human before use in any final work product, client deliverable, or official communication. 8. RESTRICTED AND PROHIBITED USES 8.1 Employees must not: 1. Enter any confidential, personal, financial, health-related, or client- specific data into any AI tool without explicit written approval from the IT team and relevant data owner. 2. Use AI-generated output as a final work product without meaningful human review and verification. 3. Use AI tools to make or automate decisions affecting individuals such as hiring or performance assessment without appropriate human oversight. 4. Bypass any data classification protocol by using AI tools to process restricted data. 5. Present AI-generated content as original human work in any context where authenticity and source matter. 9. DATA CLASSIFICATION AND AI TOOL USE 9.1 BrightTech Solutions classifies data as Public, Internal, or Confidential. 9.2 Public data may be used with approved AI tools. 9.3 Internal data may be used with approved AI tools with care and only for the approved business purpose. 9.4 Confidential data must never be entered into any AI tool without specific written approval from the IT team and the relevant data owner confirming the tool is certified for that data category. 9.5 If you are unsure of the classification of data, ask your manager or the IT team before proceeding. 10. DATA INCIDENT REPORTING 10.1 If you believe you have accidentally entered confidential or personal data into any AI tool, report it immediately to the IT security team and your direct manager. 10.2 Document the tool used, the data entered, and the date and time of the incident. 10.3 Reports must be made on the same day the incident is discovered. 10.4 Employees who report incidents in good faith will be treated with appropriate consideration. Failure to report a known incident is a serious violation of this policy. 11. HUMAN REVIEW AND ACCOUNTABILITY 11.1 All employees are responsible for the accuracy, appropriateness, and quality of any work they submit or share, regardless of whether AI tools were used in its preparation. 11.2 AI tools are support instruments. They must not replace your professional judgment, verification, and accountability. 12. TRAINING AND AWARENESS 12.1 All new employees must complete mandatory AI tool usage training as part of the BrightTech onboarding program. 12.2 Annual refresher training will be provided to all employees. 12.3 Resources and guidance are available from the IT team at any time. 13. POLICY VIOLATIONS AND CONSEQUENCES 13.1 Violations of this policy will be handled through the organization's standard disciplinary process. 13.2 Consequences range from a formal written warning and mandatory retraining for minor violations to suspension or termination for serious violations involving deliberate data breaches or repeated non-compliance. 14. REGULATORY ALIGNMENT 14.1 This policy is designed to support BrightTech Solutions' broader commitment to responsible data handling in alignment with the Digital Personal Data Protection Act (DPDPA) and other applicable Indian data protection obligations. 14.2 This policy does not itself constitute a compliance program. BrightTech works with qualified legal and compliance professionals to ensure its broader regulatory obligations are met. EMPLOYEE ACKNOWLEDGMENT I confirm that I have received, read, and understood the contents of this AI Tool Usage Policy and commit to complying with it throughout my employment with BrightTech Solutions. Employee: ________________ Date: ____________________ DISCLAIMER: This AI Tool Usage Policy was generated by an AI drafting tool as a structured preparation and documentation aid only. It does not constitute legal advice, regulatory compliance certification, data protection guidance, or IT security assessment, and is not a substitute for professional review by qualified attorneys, data protection officers, and IT security professionals. Always have this document reviewed by the appropriate qualified professionals in your applicable jurisdiction before distributing it to any employee.