English working draft · Company review required

Responsible AI at Work

AV Labs employee policy template

Discussion draft • 31 October 2026 • Prepared by David Lamond, M.Ed. / AV Labs

Adapted from the principles in David's September 2026 *Classroom AI Policy for Ontario Schools*. This is a proposed workplace template, not an adopted company policy, certification or statement of legal compliance. Each organisation must assign owners and confirm its tools, contracts and applicable requirements before adoption.

1. Purpose

Use AI to improve communication, learning and productivity while protecting company information and retaining human responsibility. AI supports employees; employees remain accountable for what they send, publish, decide and deliver. An AI subscription or access to a tool does not by itself authorise its business use.

2. Start with approved tools and approved tasks

Use only the tools, account types and features listed in the company's approved-tool register. An approval should specify permitted tasks and information, the responsible owner, access controls, retention settings and a review date. Personal accounts, browser extensions, meeting bots, integrations and AI agents require approval before work use. Enterprise or paid branding alone is not proof that a service is suitable.

3. Protect company and personal information

Default: do not put confidential company information or personal information into an AI service. Use public, fictional or carefully redacted material in training.

Do not enter passwords, API keys, authentication codes, financial account details or other access secrets. Do not upload customer or employee records, private correspondence, contracts, proprietary code, internal strategy, unreleased products, pricing negotiations or confidential financial information unless that exact information category and use case have been explicitly approved through the company's controlled process.

Removing a person's name may not make a record anonymous. Screenshots, file metadata, meeting transcripts and combinations of details can still expose information. Ask the designated information owner when unsure. Do not connect company drives, inboxes or databases merely because a tool offers the option.

4. Check before using or sharing

Review AI output for factual accuracy, invented sources, tone, language quality, confidentiality and suitability for the intended audience. Verify important claims against authoritative source material. Check calculations independently. For translation and English writing, make sure the final wording expresses the employee's intended meaning. Employees should be able to explain the work they submit.

5. Keep people in control

During the initial pilot, AI may draft and suggest; it must not independently send messages, publish content, alter business records, make purchases or run changes in company systems. Any later automation requires a defined scope, an accountable owner, appropriate permissions, logging and a practical stop or recovery procedure.

Do not use AI alone to make employment, disciplinary, financial, legal, safety or other consequential decisions about people or the business. Such uses need a separately approved process and qualified human review.

6. Respect people and intellectual property

Do not use AI to impersonate others, clone identifiable voices or faces without an approved basis, manufacture evidence, harass, discriminate or mislead customers. Use materials the company is entitled to use. Review ownership and licensing questions before distributing generated material; do not assume generated output is original or automatically cleared for commercial use.

7. Be transparent and keep a useful record

Follow the company's disclosure rules for customer-facing and internal work. For material work, record the tool, the task, the employee's review and any sources used to verify important claims. Record only what is needed; do not create a new repository of sensitive prompts or personal data. Use company-approved storage and retention rules.

8. Report mistakes promptly

If information is entered into the wrong tool, an unexpected action occurs or harmful output appears: stop the task, disconnect further automation where safe, and notify the designated company contact immediately. Preserve the minimum relevant details through an approved channel. Do not conceal the incident, circulate exposed information or assume deleting a chat removes all provider copies. The designated owner coordinates containment, provider contact and any required notifications.

9. Learn, evaluate and improve

Begin with a limited pilot using low-risk tasks. Train staff, provide a non-AI way to complete essential work, and review both output quality and independent understanding. Evaluate the pilot after 30 days and review the policy after significant tool or business changes. Speed matters only alongside accuracy, confidentiality and usefulness.

Employee check before every task

1. Is this tool, account and task approved?

2. Is the input public or fictional, or explicitly permitted for this use?

3. Have I removed secrets and unnecessary personal or confidential information?

4. Can I verify and explain the result?

5. Have I reviewed it before sending, publishing or acting?

6. Do I know where to report a mistake?

Company setup sheet , complete before adoption

Integration with AI + English Studio

Introduce the employee checklist before the first session. Use fictional or approved examples throughout the course. Practice checking emails, role-playing meetings and evaluating claims in English. In the final session, employees demonstrate a useful workflow and explain the safeguards they applied. The company-approved policy remains the governing document; this course does not certify regulatory compliance.

Decision: Company entry

Policy owner and approver: To be assigned

Information/privacy/security contact: To be assigned

Incident reporting channel and backup: To be assigned

Approved tools, accounts and features: To be listed

Permitted tasks and information categories: To be listed

Restricted or prohibited uses: To be confirmed

Disclosure, record retention and deletion rules: To be confirmed

Training and access requirements: To be confirmed

Pilot scope, success measures and review date: To be agreed