AI Ethics Policy

1. Purpose

This policy establishes ethical, legal, and operational guidelines for the responsible use of generative AI within HEED SAI. It ensures that AI supports, but never replaces, professional judgment, client trust, confidentiality, and integrity.

2. Scope

• All HEED SAI employees, contractors, and partners
• Implementation partners, subcontractors, and forward-deployed engineers, who are bound to this policy through the HEED SAI confidentiality agreement before receiving client information
• All use of generative AI tools, whether internal or external
• All client-related and business operations

3. Core principles

• Transparency. AI use must be disclosed when it materially influences deliverables or decisions.
• Integrity. AI outputs must be reviewed and validated by a human professional.
• Confidentiality. Client data must be protected at all times.
• Accountability. Humans remain fully responsible for outcomes.
• Simplicity. AI should reduce complexity, not introduce hidden risks.

4. Acceptable use

• Drafting documents, including letters, summaries, and templates
• Research support and information synthesis
• Data structuring and analysis assistance
• Internal productivity improvements

All outputs must be human-reviewed before use.

5. Prohibited use

• Providing unsupervised legal, financial, or regulatory advice
• Generating misleading, deceptive, or fabricated content
• Uploading confidential client data into unapproved tools
• Making autonomous decisions affecting clients
• Running an agent with standing access to a client production system, or with credentials broader than the task requires

6. Human oversight, agents, and tool access

• AI outputs are advisory only.
• A qualified professional must review all client-facing content.
• Critical analysis must be independently validated.
• Agents run with least-privilege credentials scoped to a single task, and access is withdrawn when the task ends.
• No agent takes an irreversible action, including sending, publishing, paying, filing, or deleting, without a human approving that specific action.
• Every agent action on client data is logged, with an audit trail retrievable for at least thirty days.
• Each agent has a named owner who can stop it, and a documented way to stop it.
• Anything an agent reads is data to be summarized and never an instruction to be followed. Web form fields, inbound email, support tickets, CRM records and documents supplied by a third party are treated as untrusted text, whatever they appear to ask the agent to do.
• No agent runs unattended on client work, and no standing or always-allow approval is granted for a tool that can write to a filesystem, run a shell command, or publish.

7. Transparency and disclosure

• Disclose AI-assisted processes when relevant to client work
• Avoid presenting AI-generated content as purely human-authored
• Clearly distinguish human analysis from automated support where needed
• Anything HEED SAI publishes on a matter of public interest, including the Weekly Signal, passes human review and editorial control before publication. That review, and the record of it, is how we meet the labeling duty in Article 50 of the EU AI Act, which applies from August 2, 2026. Where we build or operate a generative system that produces content for a client, the marking and detection duties in the same Article are part of the build, and a system already on the market has until December 2, 2026 to carry them.

8. Intellectual property and copyright

• Respect copyrights, licenses, and usage restrictions
• Avoid reproducing protected content without authorization
• Treat AI outputs as subject to human originality review
• Do not assume AI outputs are automatically free of IP constraints

9. Privacy and user consent

• Obtain appropriate client consent for AI-assisted workflows
• Limit AI use involving personal or sensitive data
• Comply with applicable privacy regulations
• Minimize data exposure
• Client data is never used to train or fine-tune a vendor model. We use tools whose terms exclude training on customer content, and we confirm that setting per tool before the tool touches client data.

10. Data handling and security

• Use only approved AI tools and vendors
• Avoid entering sensitive data unless contractually secured
• Apply encryption and access controls
• Follow least-privilege data practices

11. Accuracy and verification

• Fact-checking of AI-generated information
• Validation of financial and legal interpretations
• Explicit confirmation of critical data

AI hallucinations must be treated as a known risk.

12. Bias and fairness

• AI outputs must be assessed for bias or distortion
• Decisions must not rely solely on automated inference
• Human judgment prevails

13. Client protection

• Prioritize client interests over efficiency gains
• Prevent AI from introducing confidentiality or accuracy risks
• Maintain professional duty of care

14. Vendor and tool selection

• Data security assurances
• Clear privacy terms
• Auditability and logging
• Enterprise-grade controls, when applicable
• A named publisher for every agent extension, connector and Model Context Protocol server, established before it reaches client data, together with where its endpoint resolves. An endpoint we cannot attribute, or one that no longer resolves, is not approved.

15. Recordkeeping and auditability

• Document AI involvement in material analyses
• Retain version histories for critical deliverables
• Support traceability
• Records of AI involvement are kept with the engagement file for the term of the contract plus four years, which also covers the four-year retention that California requires of employers for automated-decision system data.

16. Incident response

• Immediately halt use
• Assess scope and impact within twenty-four hours, under a named owner.
• Notify the affected client without undue delay, and within seventy-two hours where personal data may be involved
• Implement corrective controls and record what changed

17. Training and awareness

• AI risks and limitations
• Verification responsibilities
• Confidentiality safeguards

18. Governance and updates

• This policy is reviewed at least every three months, against the regulatory and security developments of that quarter.
• It will be adjusted as technology and regulation evolve, and the review date on this page is updated at each review.
• Ethical standards take precedence over convenience.

HEED SAI uses generative AI strictly as a supporting tool to enhance clarity, efficiency, and insight, never to replace expertise, professional judgment, or ethical responsibility.