Artificial Intelligence Acceptable Use Policy

2025.1

Reviewed: 2/26/2025
Updated: 2/26/2025

Purpose and Scope:

1. The intent of this Policy is to provide general guidance on the use of Large Language Models (LLMs) and Generative AI (GAI), Machine Learning (ML) and other Artificial Intelligence solutions based on capability, functionality, applications and techniques, (hereinafter referred to as "AI") at IMPLAN. The priority for using any AI is to improve the efficiency and reliability of daily business operations and product solutions, in which IMPLAN must continue to meet legal obligations, customer expectations, and adhere to company values of community, respect, and stewardship.
2. This policy applies to all users of information systems within IMPLAN. This typically includes employees and contractors, as well as any external parties that come into contact with systems and information controlled by IMPLAN (hereinafter referred to as "users"). This policy must be made readily available to all users.
3. This Policy is not intended to address every use of AI at IMPLAN by a user. There are certain business departments and functions at IMPLAN that bear more considerations and potential risks. Also, please see Prohibited Uses in Section 3 below for situations in which AI may not be used at IMPLAN.

Background:

1. The use of AI as business and productivity aids is increasing in all industries. As such, there is risk involved in implementing new technology into business workflows and as a result, there have already been security incidents with AI involved.

Controls and Procedures

Acceptable Use of Artificial Intelligence:

1. Before using any AI at IMPLAN, whether for personal business tasks such as writing an email or more complex business processes such as analyzing datasets, the AI should be evaluated for compliance with this policy.

2. General use guidelines for all IMPLAN users.
   a. Lawful: The use of AI must comply with all applicable laws and regulations, as well as any contractual obligations, limitations, or restrictions.
   b. Ethical: The use of AI systems must adhere to ethical principles, be fair, and avoid bias.
   c. Transparent: There must be clear objectives for the use of an AI and documented oversight of such use, which is recorded and captured for institutional knowledge. Disclosures of the use of AI in any AI-assisted content generation must be made when required by law or contract, or when required by the IMPLAN.
   d. Necessary: The use of AI systems must be for a valid business purpose to improve IMPLAN's business efficiencies and support the organization's mission. The use of AI is not a substitute for human critical thinking or expertise and should not require IMPLAN to incur an unnecessary expense without any true benefit.

3. Prohibited Uses
   a. Entering IMPLAN processes, source code, underlying data, model information, sales data, confidential customer or employee information, and, in extension, personal data about any individual into a public AI system.

   • A public AI system refers to any system that is not procured by IMPLAN for its business purposes and one that does not guarantee that entered data will not be reviewed by either the AI provider's employees or accessible to the general public.

   b. Entering any sensitive information about an individual into any AI system. "Sensitive information" includes medical, financial, political affiliation, racial or ethnic origin, religious beliefs, gender, sexual orientation, disability status, or any other part of a person's life someone would want to keep private.

   • "Sensitive information" includes medical, financial, political affiliation, racial or ethnic origin, religious beliefs, gender, sexual orientation, disability status, or any other part of a person's life someone would want to keep private.

   c. Creating intellectual property that IMPLAN desires to register and/or holds significant value to the organization.
   d. Using an AI system to obtain legal advice, including, but not limited to, creating policies for internal use or to provide to third parties.
   e. Entering misinformation or information that impersonates another individual or organization.
   f. Inputting text that introduces malicious code such as malware, keyloggers and other harmful software.
   g. Using AI to generate content contrary to what is deemed acceptable in our Employee Handbook and the general Acceptable Use Policy.

4. Guidelines for use of generated information
   a. AI is not a substitute for human judgment and creativity.
   b. AI is prone to fabrications, commonly referred to as hallucinations, false answers and information, or outdated information, and therefore responses must always be carefully verified by the user or other IMPLAN employee.
   c. Verify that any response from an AI tool is accurate, appropriate, not biased, not a violation of any other individual or entity's intellectual property or privacy, and consistent with IMPLAN policies and applicable laws.

5. Reporting Non-Compliance
   a. IMPLAN directors, managers, employees, and agents aware of any conduct that may violate this Policy have a responsibility to report it. Individuals are encouraged to make reports through normal reporting relationships beginning with their manager. All reports of suspected misconduct or non-compliance will be investigated by the security team, Legal Counsel, Human Resources, or other appropriate parties.
   b. If IMPLAN determines that a user has failed to comply with this Policy after an investigation concludes, then the user will be subject to disciplinary action, up to and including termination.