Artificial Intelligence (AI) is becoming an established feature in many aspects of everyday life including the workplace. AI can offer significant advantages for employees and employers including reduced administration time, operational efficiency and enhanced decision making. Many employees are reportedly using AI tools in some capacity. A recent KPMG study of more than 48,000 adults from 47 countries found that 58% of participants regularly used AI at work. Despite this widespread adoption many organisations have not yet implemented clear AI policies and training to govern and educate staff usage which places organisations at risk.
Encourage confident and responsible use
Research published by Cornerstone OnDemand found that 81% of employees using AI did not inform their manager or colleagues. The data suggests that many employees fear judgement when using AI. An effective policy helps to empower employees to feel confident about using the tools within boundaries set by the employer and ensures that employers have a clear understanding of how AI is being used by their staff.
A clear AI policy also encourages employees to use AI responsibly. Without such guidance they may rely on AI as a shortcut instead of a support tool. Unstructured usage can lead to compliance risks and poor-quality work. A well-defined policy helps to establish standards for responsible use. By setting these standards it empowers employees to use AI with confidence in a safe and ethical way.
Ensure legal compliance
The landscape in relation to AI regulation is constantly developing. The UK does not have specific AI legislation in place, however proper use is addressed across multiple areas of law including data protection, intellectual property rights and consumer rights and is governed by several regulators. A proactive AI policy helps organisations comply with legal requirements by defining how staff are permitted to use these tools.
Mitigate the risk of data breaches
Although AI can be extremely beneficial in a work environment it can also present significant risks to data protection and confidentiality if clear boundaries are not established. There is a risk of data breaches occurring where confidential, proprietary or personal data is inappropriately shared with public or free AI tools. Under ChatGPT’s privacy policy, unless users actively opt out, all data inputs can be used to train its models, and data is difficult if not impossible to safeguard once it has been entered into the algorithm. There is also a risk that a user in another organisation could see that data as an output. If a data breach occurs it could result in serious fines for the responsible organisation, claims by affected data subjects and reputational damage. The ICO has made clear that AI is a focus area for the regulator and putting in place an AI policy alongside training will be seen as the minimum expected security measure to prevent breaches.
Features of an AI policy
The ICO has published guidance on what businesses should include in an effective AI policy from a data protection perspective. Most importantly it should address:
- The type of data that can be input into an AI tool. This guidance should also make clear what information would be inappropriate to input. Organisations can also provide training to ensure that employees understand what may constitute personal or commercially sensitive information.
- What types of AI are appropriate to use. The policy should include a list of tools that have been vetted to ensure compliance with the organisation's aims.
- Where necessary, how this policy links to other relevant organisational policies and signposts wider requirements around the use of AI systems that fall outside the policy’s scope.
It is important that organisations continue to raise awareness of the policy beyond implementation. Organisations should take measures to ensure that employees understand the expectations under the policy by implementing regular training, guidance and opportunities to ask questions.
Key takeaways
In summary AI can be an effective tool when used responsibly and with clear guidance. Having an AI policy is critical regardless of whether an organisation plans to implement AI throughout the business. A clear policy helps ensure that AI is being used efficiently without placing the organisation at risk of legal or reputational repercussions. It also creates clear boundaries for employees so they understand the context and circumstances in which AI usage is appropriate.
We regularly assist clients in creating practical and effective AI frameworks that provide certainty and protection. Our team can work with you to develop a tailored AI policy that reflects your organisation's needs and ensures that staff use AI in a safe and responsible way. Please contact us if you would like guidance on implementing an AI policy that supports your business and reduces risk.
This article was co-authored by Eve Gunson, Trainee Solicitor in our Commercial team.
