Generative AI is a field of artificial intelligence that specializes in creating algorithms that can generate new data based on patterns learned from already existing data. The most well-known examples of generative AI tools that most of us have encountered (or have at least heard about) are ChatGPT, Bard, and Dall-E.

Generative AI tools are widely adopted by businesses due to their ability to create virtually any kind of content. Examples include writing email responses to clients and implementing chatbots for customer support, creating artistic works in a specific style, and even writing code for a computer program.

Despite all the useful potential of generative AI for business, it can, in particular, pose serious risks to data protection. Examples of how generative AI tools may cause harm if users don’t follow certain rules include:

• data breaches
• inadequate anonymization
• unauthorized data sharing
• biases
• discrimination
• lack of consent and transparency
• inadequate data retention and deletion practices

What is a Generative AI Company Use Policy?

A Generative AI Company Use Policy–we’ll just refer to it as a ‘Policy’ going forward–is an internal company document that sets guidelines and principles for the proper and responsible use of generative AI within the company’s business operations. Its aim is to provide employees with instructions on how to safely utilise generative AI tools while performing work tasks. The Policy can cover not only data privacy matters but also intellectual property (‘IP’), confidentiality of information, and data security.

Why companies need a Generative AI Company Use Policy

A Generative AI Company Use Policy has become one more must-have policy in addition to already common documents, such as a Privacy Policy or Data Protection Policy, for companies that actively apply generative AI as a helpful work tool. Some big companies including Samsung have already started drafting such policies, and Wired even published theirs online.

A Generative AI Company Use Policy is important for several reasons including:

• Ethical and responsible use: the Policy helps ensure that generative AI tools are not used in a way for creating content that can be misused for malicious purposes.
• Legal and compliance: the use of generative AI may have legal implications, especially when it comes to IP, copyright, and data privacy. The Policy can ensure that the company adheres to relevant laws and regulations and minimises legal risks.
• Privacy and data security: generative AI often uses datasets for its own training. The Policy can establish instructions on how to not allow generative AI tools to use data for such purposes and which data should not be shared with the tool for privacy and security reasons.
• Transparency and accountability: companies using generative AI should be transparent about its use. The Policy can set forth, e.g., an obligation to mark the AI-generated content.
• Brand reputation: misuse of generative AI can lead to the creation of content that contradicts the company’s values or damages its reputation. The Policy helps to protect the company’s brand by setting boundaries on what kind of content employees are allowed to generate with the help of generative AI. 

What should be included in the Policy?

A well-prepared Policy should explain its purpose and scope, including to whom it applies (e.g., employees, contractors) and what generative AI tools it covers specifically. It must set forth the principles for generative AI use that the company respects and requires its team members to employ.

Probably the most important part of the Policy is guidelines for generative AI use. The guidelines can establish rules for acceptable use that must be followed by everyone at the company, including restrictions and prohibitions, as well as the list of approved generative AI use tools.

Last but not least in the Policy is the enforcement clause and implementation and monitoring clause. These clauses provide information about which bodies within the company ensure compliance with the Policy and are responsible for overseeing generative AI development and deployment. The company can designate a Generative AI Officer who will periodically review generative AI use and identify risks.

How to implement the Policy

In order to implement the Policy within the company, all employees to whom the Policy may concern must acknowledge that they have read and agree to comply with the Policy instructions by signing it in a dedicated section in the Policy.

Also, two more optional elements can be put into action:

1. establishment of the Generative AI Governance Board, which will supervise the responsible development of Generative AI
2. appointment of a Generative AI Officer, who will take charge of overseeing the Policy’s execution within the company.

The duties of a Generative AI Officer can be performed by a DPO (Data Protection Officer) or CISO (Chief Information Security Officer) in the absence of a separate position in the company.

Free Generative AI Company Use Policy template

To help you get started with the creation of your company’s own Policy, you can download a free Generative AI Company Use Policy template from Legal Nodes. Simply complete the form to download your free copy.

It is recommended to seek advice from a privacy or legal professional to refine the generic Generative AI Company Use Policy template in accordance with your company’s specific needs. If you require help with your business’ privacy concerns, feel free to reach out to the Legal Nodes team at hello@legalnodes.com. 

Why you can trust the Legal Nodes template

You can trust Legal Nodes’ Generative AI Company Use Policy template because we have in-house privacy specialists with certifications (CIPP/E) and years of experience consulting tech businesses on privacy and data protection. We have already assisted several clients in preparing their own Generative AI Company Use Policies and are helping more and more businesses to navigate the new world of AI privacy and compliance matters.

Disclaimer: the details presented in this article are intended solely for informational purposes. It is important not to interpret such information as advice related to legal, tax, investment, trading, financial, or any other matters.

The free Legal Nodes template is not to be treated as legal or any other type of advice. Always do your own research and consult a legal or privacy professional when using legal and privacy documents for your business.