AI Policy (INTERNAL)

(Last updated September 2025)

1 Introduction

1.1 Donovan Training Associates Limited (“Company” or “we”) recognises the potential of artificial intelligence (“AI”) to transform, support and improve the way we work and the services we provide.

1.2 We are committed to ensuring we use AI tools in a secure and responsible way, respecting confidentiality and third party rights. This includes any AI tools used by third parties, such as consultants or sub-contractors, on our behalf.

1.3 This policy applies to all employees, workers, temporary and agency workers, contractors, interns, volunteers and apprentices (referred to as “staff” in this policy) including “you”.

1.4 This policy provides guidance on your use of AI in the course of your work, the circumstances in which we will monitor use of AI, and the action we will take if this policy is breached. It should be read in conjunction with other policies that are relevant to the use of AI in the workplace.

1.5 We will review and update this AI policy regularly to take account of changes in technology, legal and/or regulatory obligations and best practice. Compliance with this policy forms part of each staff member’s terms and conditions and each individual is responsible for reading, knowing and abiding by its contents. We will circulate any new or modified policy to staff when it is adopted.

2 What is AI?

2.1 AI tools can learn, problem-solve, make decisions and understand language. This can be contrasted with non-AI pre-programmed tools, which generally apply the same set of rules each time unless a human intervenes to update the rules. An AI tool can learn and adapt with minimal human intervention.

2.2 There are several types of AI, including agentic, generative, predictive and extractive:

3 Responsible AI principles

3.1 Our responsible AI approach means that we:

3.1.1 consider the real-world impact of any AI that we may use;

3.1.2 take action to avoid the creation or reinforcement of bias;

3.1.3 can explain how the AI we use works;

3.1.4 create accountability through audit, governance and human oversight; and

3.1.5 respect privacy and champion robust data governance.

4  Potential benefits of using AI in the workplace

AI has the potential to improve productivity, personalise the client experience and accelerate product/service developments. It may be capable of completing repetitive, manual high-volume tasks, freeing you up for more interesting value-added work.

5 Potential risks of using AI in the workplace

5.1 AI is trained on large banks of existing content from various sources called datasets. They learn to identify patterns in those datasets. The more advanced AI tools are able to identify those patterns without human intervention or supervision. Some AI tools will then use additional input or prompt data and feedback from users to continue to self-train. A prompt is a question or request you write for the AI tool to answer or solve.

5.2 This raises several questions including:

5.2.1 can the AI tool reuse, recycle or republish information we input (“AI Input”) and make that information available for other users, directly or indirectly?

5.2.2 do we have the right or permission to put the AI Input into the AI tool? If the AI Input contains information belonging to someone else do we have permission or rights to put the information into the AI tool? Will we be breaching confidentiality, intellectual property rights or data protection rights?

5.2.3 who owns the intellectual property rights in the content produced by the AI tool (“AI Output”)?

5.2.4 can we rely on the accuracy of the AI Output?

5.2.5 are there any other risks, eg biases in the data that the AI tool was trained on that might cause it to discriminate?

5.2.6 In the case of Agentic AI, are you aware of all interactions by the AI tool and any resulting liabilities on you and/or the Company?

5.3 Some of these AI risks are overlapping and the following sections expand on the main themes.

Privacy and confidentiality risks

5.4 Data protection law requires that we must have a lawful ground for collecting and using personal data. However, the lawful ground on which we originally collected personal data may not cover us for using that personal data in an AI tool. Unless additional consent is obtained, entering that personal data into an AI tool could constitute a data protection breach, particularly if the AI tool is publicly accessible.

5.5 Likewise, using publicly accessible AI tools runs the risk of exposing confidential information.

Intellectual property (“IP”) and trade secrets

5.6 AI tools can increase the risk that our IP and trade secrets will be made accessible to third parties. Some AI tools don’t guarantee the AI Inputs will not be used to train the AI model. This means our IP (or the IP of our clients or suppliers if included in our AI Input) could be reproduced or made available to other users in some form.

5.7 AI Outputs may also infringe third party IP. We could be at risk of a third party IP infringement claim if we utilise an AI Output that contains third party IP without licence or other permission.

Hallucinations and Inaccuracies

5.8 Where AI does not have the information to provide the information you have requested, it may still attempt to provide you with an output. It could do this by simply making things up (a “Hallucination”).

5.9 Relying on an AI Output without checking could have a range of negative outcomes, including damage to our reputation, inaccurate information or services to our clients or even contract breach claims where we have committed to a reasonable standards of services to our clients.

5.10 Whilst not a Hallucination, an AI Output can still be inaccurate. Generally speaking, accuracy in AI refers to how often the AI system guesses the correct answer, measured against correctly labelled test data. This is known as statistical accuracy not factual accuracy.

Bias

5.11 Another concern with AI is the potential for bias to be embedded within the AI tool. This bias can then be perpetuated as the AI tool operates and develops, inadvertently leading to the creation of discriminatory content or decisions. This is not necessarily deliberate; the AI tool may simply be reflecting the unconscious bias of its creators or other users.

5.12 There are two main potential sources of bias—the data itself and the algorithm applied to the data by the AI tool:

5.12.1 if the data used to train the AI tool is biased (e.g. towards a particular race or gender), the AI tool is likely to produce biased content; whereas

5.12.2 if bias is embedded into the AI algorithm (the coded instructions that tells the AI tool how to function), the AI Output is likely to be biased even if the data itself is not biased.

6 Guidelines for staff on using AI tools and platforms

6.1 If you use AI to carry out Company work you must notify the Company of what AI you are using, the type of licence you have and how you are using AI in the course of carrying out Company work. The Company may request reasonable additional information about such AI use, including without limitation, visibility of the AI licence. Only Company approved AI, as set out in the Schedule to this AI Policy, may be used for work purposes. If you wish to use an AI tool which is not listed in the Schedule, you should contact Anthony Donovan to ask whether the AI tool can be added to the Schedule and/or whether you can be given authority to use it.

6.2 When using AI to carry out Company work, you must always use your work email address to create and log in to the AI account.

6.3 You must not share your access credentials or allow others to use AI tools on your behalf. You must protect your login credentials and ensure any AI accounts that you hold are not accessible to unauthorised third parties. The use of multi-factor authentication is advised in respect of any AI tools and technologies used.

6.4 You must not:

6.4.1 use AI to create illegal content or for illegal purposes or in any way that could be considered discriminatory, or could give rise to defamation, harassment, intimidation or bullying or in any way that could harm the reputation of another;

6.4.2 use offensive, obscene or abusive language, graphics or imagery when inputting content into AI and must not attempt to create content which is offensive, obscene or abusive through your use of AI tools;

6.4.3 use AI licensed for the Company for your own personal use.

6.5 Unless specifically authorised to do so, you must not input into a publicly accessible AI tool:

6.5.1 Company proprietary information, including Company training materials;

6.5.2 client or supplier materials, information or data;

6.5.3 trade secrets, confidential or valuable information belonging or relating to the Company, clients or suppliers;

6.5.4 usernames, passwords (other than for the AI tool itself), and security tokens; or

6.5.5 personal data including personal data relating to employees, customers, suppliers and unconnected third parties.

6.6 Your use of AI in the workplace must be limited to business-related purposes and should, at all times, be in accordance with all applicable laws (including data protection and privacy laws) and relevant policies.

6.7 You are responsible for reviewing and verifying AI Outputs to ensure such AI Outputs:

6.7.1 are accurate, not misleading, free from bias and hallucinations, non-discriminatory and non-offensive;

6.7.2 do not disclose confidential or proprietary Company information;

6.7.3 do not reveal personal data about any individual without their consent;

6.7.4 does not breach the intellectual property rights of a third-party.

6.8 Where appropriate, you must let the client, supplier or other third parties know you are using AI to support the services you provide to them, this includes notifying call or online meeting attendees at the time of booking the call or online meeting that an AI tool will be will be on the call or online meeting for the purposes of note-taking, recording and/or transcribing.

6.9 You must comply with the terms and conditions of the AI tool that you use. If such terms and conditions are in conflict with or contradict our policies or your terms of employment or service, you should inform Anthony Donovan.

6.10 You must attend any and all training courses on the use of AI required by the Company. Such training is mandatory and failure to complete any such training may be treated as a breach of this policy.

6.11 To ensure compliant use of AI, you must document and record all your uses of AI tools for work purposes. The Company reserves the right to monitor AI use both within our organisation and by our suppliers and customers and such monitoring may include requesting copies of your records of AI use for review.

7 Responsibility for compliance

7.1 All staff are responsible for ensuring their own use of AI for business purposes is in accordance with this policy, and must, in particular, make themselves aware of, and comply with, their responsibilities, as outlined in this policy, to protect confidential and sensitive information when using AI.

8 Breaches of this policy

8.1 Failure to comply with any requirement of it may lead to disciplinary action, which may lead to dismissal for gross misconduct. If you are not an employee, breach of this policy may result in termination of your contract with immediate effect and without prejudice to any other claims for damages under such contract.

8.2 You should note in particular that inputting Company materials, data or information, including commercially sensitive or confidential information, into AI tools may amount to misconduct even if it takes place:

8.2.1 on a personal account with appropriate privacy settings;

8.2.2 outside normal working hours; and/or

8.2.3 without using the Company’s computers, systems and networks.

8.3 If, in the course of your employment or service, you become aware of any misconduct or wrongdoing by any employee, officer, worker or agent of the Company in breach of this or related policies, you must report it to Anthony Donovan.

8.4 You must also make a report to Anthony Donovan if you become aware that:

8.4.1 a client or supplier has input confidential or proprietary Company information or personal data relating to any of our staff into a publicly accessible AI tool;

8.4.2 a publicly accessible AI tool has otherwise produced output that includes confidential or proprietary Company information or personal data relating to any of our staff; or

8.4.3 we may have used an AI tool in a way that infringes IP owned by third parties or infringes the data protection rights of a third-party, whether deliberately or inadvertently.