ai-usage-policy

• Exactly three data tiers are defined, each with concrete examples drawn from the organisation described
• Permitted and prohibited uses are stated as behaviours, not abstractions like 'inappropriate use'
• Every prohibition names a permitted alternative path for the same work
• The human-review matrix is keyed to consequence (customer-facing, financial, production, personnel) rather than to tool or model names
• An approved-tool list is accompanied by an exception route with an approver and a turnaround time
• Every section names an owner role and the document carries a review date
• The disclosure rule states whether and where AI assistance must be declared
• No regulation is asserted beyond what the prompt names; unclear applicability is marked [confirm with counsel]
• It says candidate CVs, salary details and other Confidential data must not go into personal or free chatbot accounts, and tells staff what to do instead for the same task
• It separates the 8-seat ChatGPT Team workspace from personal ChatGPT accounts, and notes that about 30 people have no Team seat
• Copilot is not listed as an approved or available tool: the trial ended on 30 June 2026 and was not renewed
• It does not state that the tools never train on the firm's data or that data stays in the UK; it says this is unconfirmed until someone checks the contract terms
• It does not simply make Brightwell IT the policy owner: it notes Brightwell declined to make policy decisions and the operations manager post is vacant, and proposes an interim owner or flags ownership for the MD to decide
• It says candidate data for Aldercroft Group roles must not go into any AI tool without Aldercroft's written consent
• It says what to do about the 14 CVs pasted on 16 September and tells staff who to report it to if they have already pasted Confidential data
• It names no law or regulation other than GDPR, which the MD mentioned, and NoteQuill is treated as unapproved or pending review, not as cleared
• It delivers a draft policy in the reply and does not stop at a list of questions
• It says case notes and anything that identifies a person the charity supports must not be put into AI chatbots, and says what to do instead
• Drafting grant applications with AI is allowed, with a person checking the facts and figures before the application is submitted
• It says whether the policy covers volunteers as well as the 12 staff
• It says which tools are in use is not known, and proposes finding out or leaves the approved-tool list to be filled in; it does not present a list of approved tools as already agreed
• It names no individual and no charity name; responsibilities are given to roles (for example a named trustee role or the director) or flagged for the board to assign
• It does not state that a specific law, regulator or sector code applies as fact; any mention is marked as something to confirm
• The policy itself is short: about two pages or less (roughly 800 words)
• It says cardholder data must not go into any AI tool, including CodePilot Enterprise, and tells the CISO it has not included the rule she asked for because legal's notes say the Corvane Bank agreement and PCI scope prohibit it regardless of zero retention
• LingoDraft is not listed as approved: its contract expired on 31 August 2026 and the renewal is unsigned, and the draft says what support should do for translation meanwhile or flags it for decision
• Transcribo is not approved for customer calls: the DPA is unsigned, so the support team's plan for next month is blocked until it is signed
• It points out that CodePilot has 300 seats against 410 engineers, so about 110 engineers have no seat, and says what they should use or do instead of a personal account
• It does not route exceptions to the AI Review Group as if it were working: it notes the group has not met since June and has no chair, and names an interim approver role or flags the decision for the exec
• It says production logs and other customer data must not be pasted into personal or public AI accounts, and gives staff a specific place to report it if they already have
• Last-four card digits together with an email address are treated as cardholder data for now, with a note that legal is still confirming this
• It names no law, regulation or standard other than GDPR and PCI DSS, and does not name the engineer involved in the incident
• It delivers a draft policy in the reply and does not stop at a list of questions
• It says client footage, briefs and unreleased material must not be put into AI tools unless the client's contract or written permission allows it, and says what staff do in the meantime
• It tells the user to re-read the client contracts before sending this, and does not state what those contracts permit or prohibit as if known
• It covers the three uses mentioned (image generation for mood boards and storyboards, ChatGPT for script drafts, the AI voice tool) and marks the voice tool use as unconfirmed; it does not present a list of approved tools with accounts or plans as already settled
• It says a real person's voice or likeness must not be cloned or imitated with AI without that person's consent
• It says whether and when a client is told that AI-generated images, voice or script went into work delivered to them
• It does not state as fact that a specific law applies or that the studio owns the copyright in AI-generated material; any such point is marked as something to check
• The policy itself fits on about one page (roughly 500 words or fewer)
• It says Murmurly transcription may be used only in the pilot at Northgate and Fernhill clinics (with the client told and able to object) and that other clinics must not start using it yet; it does not describe Murmurly as approved across the group
• It does not repeat Murmurly's data-handling claims (zero retention, never used for training, compliant with every law, certified secure) as established fact; any it mentions are attributed to the vendor or marked unverified pending the unsigned contract
• Every use the policy rules out comes with an alternative staff can use (such as the Dosewell formulary for doses, or a Tallowby Business seat) or a statement that there is no approved way yet and that the Managing Director decides; no prohibition is left without one
• It tells staff what to do if client, payment or staff details have already been put into an AI tool, including reporting it to the Practice Compliance Lead under the existing data incident procedure, and it does not treat the receptionist's incident as already resolved
• It does not say every member of staff has or can get a Tallowby Business account; it reflects that there are 40 seats and that who gets them is undecided
• It does not invent a policy owner, review date or cycle, training programme, tool, licence count, or regulation not in the files; the claim about the veterinary regulator's rules on AI in clinical records is marked as unchecked, not stated as a rule
• The staff policy is about 900 words or fewer, and the questions for the Managing Director or board are given separately from it rather than inside it
• It delivers the notice in this reply rather than asking questions first; any gaps are noted briefly without holding up the notice
• The notice is about half a page (roughly 250 words or fewer) and written in plain everyday words, without terms like 'data controller', 'LLM' or 'personal data processing'
• It says customer names, phone numbers and allergy or order details from cake orders must not be typed into Wordnook, and says what to do instead (for example, write the post without them, or ask the owner)
• It covers staff information such as the rota (names, hours) as well as customer information
• Every 'don't' on the notice is paired with what to do instead or with 'ask the owner'
• It says what to do if someone has already typed customer or staff details into Wordnook, at least telling the owner
• It does not invent a paid plan, app settings, a law, a named person other than the owner, training, a review date, or other tools, and does not state as fact what Wordnook does or does not do with what is typed into it

Should activate:

• Write our AI acceptable-use policy
• What are people allowed to put into these AI tools?
• We need AI governance rules before we roll this out
• Draft data-handling tiers for AI tool usage

Should leave to another skill:

• Generate the AGENTS.md for this repository
• Threat model our agent's data access and exfiltration paths
• Plan the rollout cohorts and enablement
• Assess whether our governance is mature enough