Responsible AI Use Policy
ITSA permits carefully controlled use of artificial intelligence to assist technology delivery, administration, security and analysis. People remain accountable for its use and outcomes. This policy covers generative AI, coding assistants, AI-enabled cybersecurity tools, automated agents and AI functions included in third-party services. It does not claim that ITSA develops or certifies every model it uses.
1 Accountability and approval
The Managing Member owns this policy and appoints a business owner for each material AI use. The Technical Lead assesses security, access and operational controls. Before business use, record the tool, purpose, owner, data categories, provider and processing location, permissions, users, risk level and approval. A personal subscription is not approval to process ITSA or customer information.
Low-risk assistance using public or appropriately de-identified information still requires an approved tool and human review. Use involving confidential or personal information, customer systems, security response or production changes requires a documented assessment and the relevant customer authority. Uses affecting employment, legal rights, essential access, biometrics or safety require heightened assessment and express approval before deployment.
2 Permitted assistance and prohibited use
Approved assistance may include drafting non-sensitive text, explaining technical material, preparing test code, summarising authorised records or prioritising security alerts. The responsible person must verify accuracy, suitability and any rights in the output before use. An AI feature included in a purchased product must still be assessed for the way it is configured and used.
Do not use AI for fraud, impersonation, harassment, unlawful discrimination, unauthorised surveillance, prohibited cyber activity or fabrication of evidence or qualifications. Do not use unchecked output as the sole basis for hiring, dismissal, disciplinary findings, legal determinations, denial of essential access or safety-critical decisions. Do not create deceptive synthetic media or present generated material as verified human testimony.
3 Information confidentiality and provider terms
Do not enter passwords, private keys, access tokens, payment-card details, customer datasets, email contents, personal records, biometric data, confidential diagrams or security vulnerabilities into an unapproved AI service. Use the minimum necessary information and prefer redaction, aggregation or safe test data. Pseudonymisation may still leave information identifiable and does not remove confidentiality duties.
Before an approved restricted-data use, review provider retention, training and reuse, subprocessors, location, deletion, access controls and relevant data processing terms. Disable provider training or reuse where the chosen business arrangement requires it and verify the control rather than relying on a product label. Obtain any necessary customer permission and lawful basis. ITSA must not train or fine-tune a model on customer-controlled data without separate express authorisation and an appropriate lawful basis.
4 Human judgement accuracy and fairness
A competent person must check factual claims, calculations, sources, code, configurations and material recommendations. AI may invent facts, omit context, misunderstand a legal requirement or produce insecure instructions. Verify current laws, product terms and security guidance from reliable sources before relying on them. Do not invent source citations or approvals.
Assess bias and unjustified differences in outputs, especially for people-related decisions. Test against realistic cases and consider language, local context and groups who may be disadvantaged. Provide a route for affected people to question a material AI-assisted outcome and obtain human review. Record the human decision and reasons where significant rights or risks are involved.
5 Security and automated agents
Treat retrieved webpages, files, messages and model output as untrusted input. Prompt injection may try to redirect an assistant, disclose information or trigger an unauthorised action. Keep secrets out of prompts, separate instructions from external content, restrict tool permissions and require suitable validation of outputs before execution. Validate external dependencies and protect logs from unnecessary sensitive data.
Use least privilege, separate service identities, restricted credentials, spending and action limits, audit records and a practical stop mechanism for agents. An AI tool must not gain broader access merely because it can request it. Material payments, messages, destructive operations, production changes and customer disclosures require the applicable human authority before execution. Approval of a general goal does not justify actions outside its scope.
6 Development deployment and customer services
Before production deployment, document purpose, data flows, foreseeable misuse, failure effects and controls proportionate to the use. Test security, privacy, accuracy and recovery in a suitable environment. For code or configurations, review licensing, secrets, vulnerabilities and compatibility and verify backups and rollback before a material change. Use controlled releases and a named person able to disable the function.
For customer work, explain material AI involvement, limitations and responsibilities where it affects the service or the customer's decision. A quotation or SLA must define any automated response authority. Security tools may assist detection or containment, but high-impact actions must stay within approved playbooks and escalation rules. Do not claim guaranteed protection, model ownership, certification or regulatory approval without evidence.
7 Monitoring incidents and improvement
Monitor material uses for errors, drift, biased outcomes, unexpected costs, unauthorised access and changes in provider terms or features. Reassess when the model, connected tools, data, purpose or risk changes. Maintain records of material approvals, tests, incidents and corrective actions without unnecessarily retaining sensitive prompts.
Report suspected data leakage, harmful output, prompt injection, unauthorised action or material error promptly to the Technical Lead or [email protected]. Stop or restrict the affected use where safe, preserve necessary evidence and coordinate security, privacy and customer notification duties. Do not conceal an AI-related error or allow the system to investigate itself without human oversight.
8 Training rights and review
Users must understand tool limits, secure data handling, review duties and when approval is needed. Respect copyright, software licences, confidentiality and third-party marks; generated output may not be unique and may require rights review. Do not assume an output is lawful simply because a tool produced it.
The Managing Member and Technical Lead must review the AI register and this policy at least annually and after a material incident or legal change. Apply Namibian constitutional privacy, employment and other relevant laws, contractual duties and foreign requirements where their scope is met. A draft AI or data-protection law must not be represented as an enacted universal obligation. The Privacy Policy, SHEQ Policy, Third Party Code and Whistleblower Policy provide related safeguards and reporting routes.