AI Usage & Governance Policy

Last updated: 26 July 2026

This policy governs the responsible use of AI tools and systems at Scott Labz. It applies to Scott Labz and any contractors using AI on its behalf.

1. Purpose & Scope

This policy establishes standards for secure, accountable, and legally compliant deployment of artificial intelligence tools across organizational operations.

2. Definitions

AI System: Any software that uses machine learning or generative AI to process inputs and produce outputs, recommendations, or decisions.
Generative AI: AI capable of producing text, images, code, or other content (e.g., ChatGPT, Claude, Gemini).
Sensitive Data: Any data classified as confidential, personal, financial, health-related, or legally protected.
Approved AI Tool: An AI service that has passed Scott Labz's review process and appears on the approved tools list.

3. Permitted & Forbidden Uses

Permitted Uses:

Customer support (chatbots, ticket handling).
Content creation (writing, marketing, social media).
Code generation or software development.
Data analysis and reporting.
Document processing and summarization.
Financial analysis or credit scoring.
Product recommendations.
Internal knowledge management.

Forbidden Uses:

Entering sensitive personal data into unauthorized models.
Generating misleading content.
Using unapproved AI tools for core workflows.
Using AI for unauthorized automated decisions.

4. Data Handling & Privacy

Do not enter general business information (non-sensitive) into external AI tools without clearance. AI outputs containing sensitive information must be treated as confidential. Use only anonymized or non-sensitive data in AI prompts unless explicitly authorized.

5. Access Control & Authentication

Only Scott Labz and contractors with a business need may access its AI tools, using company credentials.

6. Logging & Monitoring

AI tool usage must be logged centrally, including user, tool, date, and general purpose. Logs are reviewed periodically for policy compliance.

7. Incident Response

Report any AI-related security or privacy incident immediately. Follow the standard Scott Labz incident response process.

8. Human Oversight & Accountability

AI recommendations in sensitive areas require human review before action is taken. The Founder is directly responsible for overseeing AI governance at Scott Labz.

9. Training & Awareness

Anyone using AI tools on behalf of Scott Labz, including contractors, completes AI safety and policy training before access is granted, with an annual refresher.

10. Compliance & Policy Review

This policy will be reviewed annually or when significant regulatory changes occur. Violations may result in disciplinary action.

GLBA / Financial Services Compliance

Scott Labz is subject to the Gramm-Leach-Bliley Act (GLBA) and must protect customer financial information:

AI-generated financial analysis must be reviewed by a qualified professional before client use.
Customer financial data must not be used to train external AI models without explicit consent.
Adverse action notices based on AI scoring must provide human-reviewable reasons.
AI vendors processing financial data must demonstrate appropriate safeguards and sign data protection agreements.

Third-Party AI Vendor Management

Use of external AI tools introduces vendor risk. Scott Labz requires:

Pre-Approval: All third-party AI tools must be reviewed and approved directly before use. Contractors must not sign up for AI services independently using company data.
Assessment Criteria: Vendors are evaluated on data residency and storage location, security certifications (SOC 2, ISO 27001), terms of service regarding data training, encryption standards, breach notification commitments, and right to audit.
Contractual Protections: Approved vendors must have appropriate data processing terms in place. If a vendor's terms allow training on customer data, Scott Labz must opt out where possible.
Ongoing Review: Approved tool status is reviewed annually or upon significant vendor policy changes.
Unapproved Tools: Using unapproved AI tools with company data is a policy violation subject to disciplinary action.

Feedback & Assistance

If you have questions regarding this AI policy, please contact us.

Response Time: We strive to respond to policy inquiries within 2 business days.