Generative AI Acceptable Use Policy

[Company name] [(Registration no.)]

1. Purpose

This policy sets out how [Company name] ("the Company") staff may use generative artificial intelligence (AI) tools, so that we gain their benefits while protecting personal data, confidential information, our customers and our reputation, and complying with the Personal Data Protection Act 2010 (as amended) and other applicable laws.

2. Scope

This policy applies to all employees, contractors, interns and [other groups] who use any generative AI tool for Company work, on any device, including:

• chatbots and assistants (for example [ChatGPT, Microsoft Copilot, Gemini]);
• AI features built into office, email, design, coding or business software;
• image, audio, video and voice generators;
• AI agents and automations that can act on systems, files or messages.

3. Principles

We use AI in line with the National Guidelines on AI Governance and Ethics (MOSTI, 2024): fairness; reliability, safety and control; privacy and security; inclusiveness; transparency; accountability; and pursuit of human benefit and happiness. In practice: people stay accountable, data stays protected, and outputs are checked before they are relied on.

4. Approved tools

1. Use only AI tools on the Approved AI Tools List, with Company-provided accounts. The list is kept at [intranet link / location].
2. Do not use personal or free consumer accounts for Company work unless the List expressly allows it for public information.
3. To request a new tool, submit [form / ticket type] to [IT / Information Security]. Approval considers data storage location and cross-border transfer, use of inputs for model training, retention, security controls, contract terms and the data classes the tool may handle. The Data Protection Officer is consulted where personal data is involved.

5. Data rules

1. Only enter information into an AI tool if the tool is approved for that data class in Section 4.
2. Never enter the following into any AI tool unless [the AI policy owner and the DPO] have approved that specific use in writing:
   • personal data of customers, employees or others, and especially sensitive personal data (for example health, religious belief, criminal records);
   • passwords, access keys, tokens or security configurations;
   • information classified [Restricted / Secret], unreleased financial results, price-sensitive information, or trade secrets;
   • third-party information we are contractually bound to keep confidential.
3. Use the minimum data needed. Remove names and identifiers where possible.
4. Treat AI outputs that contain personal or confidential data with the same classification as the input.
5. Do not use AI to make or recommend decisions about individuals (for example recruitment, performance, credit, discipline) unless the use has been assessed and approved by [AI Governance Committee] and a human makes the final decision.

6. Acceptable and prohibited use

Acceptable, using approved tools

• Drafting and editing emails, reports and presentations from your own notes.
• Summarising, comparing or extracting information from documents the tool is approved to handle.
• Brainstorming, outlining, checklists and first-draft translations.
• Explaining concepts, formulas and code; drafting code for review.
• [Other approved uses specific to your organisation]

Prohibited

• Breaking the data rules in Section 5.
• Presenting AI output as fact, advice or analysis without checking it.
• Creating content that impersonates a real person, or synthetic audio, images or video that could be mistaken for real, except for an approved purpose and clearly labelled.
• Generating harassing, discriminatory, defamatory, misleading or unlawful content.
• Allowing an AI agent or automation to send messages, make payments, delete data or change records without human approval.
• Uploading material you do not have the right to use, or trying to get around a tool's safety controls.
• [Other prohibited uses, e.g. sector-specific rules from your regulator]

7. Human review and accountability

You are responsible for any work you produce with AI assistance. Check facts, figures, names, dates, citations and code before use. Review levels:

8. Disclosure and labelling

• Disclose AI use when AI generated a substantial part of content shared outside the Company, when a customer, regulator or partner would reasonably expect to know, or when required by contract or law.
• Label AI-generated images, audio and video, for example ["Created with AI assistance"].
• Tell your manager or reviewer when a deliverable relied significantly on AI.

9. Intellectual property

• Work created with AI tools in the course of employment belongs to the Company in line with [employment contract / IP policy].
• Check outputs for third-party material before publishing; do not ask a tool to reproduce copyrighted works or competitors' materials.
• AI-generated code must pass the same review, licence and security checks as any other code.

10. Incidents and reporting

Report immediately to [IT Service Desk / security email / hotline] and, where personal data may be involved, the Data Protection Officer at [DPO contact], if you:

• entered prohibited data into an AI tool, or suspect a tool exposed Company data;
• receive a suspected deepfake call, voice note or video, or an AI-assisted phishing attempt;
• see an AI tool or agent produce harmful, biased or unexpected actions.

The DPO will assess whether a personal data breach must be notified to the Personal Data Protection Commissioner and affected individuals under the PDPA.

11. Training and monitoring

• All staff in scope complete AI awareness training [before receiving access to approved tools / within 30 days of joining] and a refresher every [12 months].
• Staff in [roles, e.g. managers, developers, HR, data teams] complete additional role-based training.
• The Company may monitor use of Company AI accounts in line with [IT Acceptable Use Policy / employee privacy notice].

12. Breaches of this policy

Breaches may lead to withdrawal of access and disciplinary action under [Code of Conduct / Disciplinary Procedure]. Reporting your own mistake promptly will be taken into account.

13. Review

The policy owner reviews this policy at least every 12 months, and sooner when approved tools, the PDPA or its guidelines, Malaysian AI legislation or regulator guidance change.

Acknowledgement

I have read and understood the Generative AI Acceptable Use Policy and agree to follow it.