AI & ML Policy

Distribution	Employees, Contractors, In-Scope Personnel; Clients upon request
Version	1.0
Approved	2026-03-21
Approved by	Ben Smith

Framework Mapping

Provider - Framework	Version	Mapped Controls
Motion Pictures Association - Content Security Best Practices (TPN)	5.3.1	OR-1.1, OR-1.4, OR-3.4, OR-5.0, TS-1.12, TS-7.0, TS-7.1
ISO IEC 27001	2022	5.1, 5.2, 5.3, 5.10, 5.12, 5.13, 5.14, 5.15, 5.31, 5.33, 5.34, 5.36, 5.37, 8.34
BSI - ISO 42001	2023	4.1, 4.2, 5.2, 6.1.2, 7.3, 7.4

Overview and Scope

Technologies known as 'Artificial Intelligence' and 'Machine Learning' are developing rapidly, and can provide potential opportunities to businesses of all kinds.

In this document the term AI/ML will be used throughout to reference such technologies.

Use of AI/ML technologies also introduces risks which must be considered before authorising use on company managed data and/or systems.

This policy covers FooEngine's approach to AI and ML technologies during procurement, experimentation and development, personnel training, deployment, continued operational and production usage, and monitoring and maintenance of such toolsets.

Governance

This policy document contains the governance framework and reference related documents which work to support the use of AI/ML technologies at FooEngine Ltd.

This policy and related materials will be reviewed annually at minimum to ensure they remain relevant and effective.

The policy and related implementations are intended to adhere to relevant laws, regulations and client requirements in the territories in which FooEngine Ltd. and its subsidiaries operate.

Variations and exceptions may be implemented according to specific scenarios and territories; and will be recorded within the company management systems.

Organisational Roles

The Board of Directors are responsible for AI/ML governance, and shall develop and implement policies and procedures to identify and enable opportunities, and identify and manage risks.

AI/ML Policy

Tenets

The company shall operate a research and development program to evaluate the capabilities of AI/ML technologies, and define, document and implement processes to move successful pilot projects into production (e.g. upon production data).

Risks associated with the potential or actual use of AI/ML shall be recorded, considered and managed according to the company's risk management program.

Fundamental tenets of the company approach are as follows:

• Company use of AI/ML shall not inflict harm to humans or animals.
• Data subjects and data owners shall consent to data being inputted into AI/ML systems under company control.
• Bias in AI/ML system output shall be evaluated during the development process.
• Third-party risk considerations shall apply to AI/ML services as per any subcontracted data processing service.
• AI/ML usage shall be continually monitored to maintain compliance with this policy.

Data and AI/ML Service Classification Mapping

The company shall create and document mappings detailing which categories and classifications of data assets are authorised for use with specific AI/ML tool and services, e.g.

• Some data categories may be appropriate to be inputted into certain AI/ML services, though not others.
• Some confidentiality classifications of data may never be authorised to be used with AI/ML services.
• Some classifications may mandate processing only within systems managed by the company.

The mapping documentation will be made available to interested parties in scope of this document.

Acceptable Use

• The classification and tool mappings shall inform the acceptable use of AI/ML within the company and on company managed data.
• Authorised AI/ML tools and methods of usage shall be made clearly available to personnel.
• Authorised use of AI/ML shall be detailed in appropriate Acceptable Use Policies / contractual documents for interested parties within scope of this policy, and signed off on.
• As per any classified activities at the company, public disclosure of company AI/ML development activities is prohibited in any form, without prior written approval from the Managing Director / CTO.

Model Training

Internally Hosted / Developed Services

• When training internal models, training data sources and integrity must be validated according to the sensitivity of the use case.

Third Party Services

• Third party AI/ML services are only to be used with explicit authorisation.

Experimental Programs and Development Environments

Segmentation of Development Environments

• While evaluating AI/ML services (either externally or internally hosted), applications / services being evaluated shall be segregated from production environment(s) as follows:

  • Logical / physical separation of networks and environments
  • Use of approved test data in non-production environments e.g.
    • No client data (without explicit approval)
    • No personally identifiable information
    • No real financial data
  • Using different user/service accounts from those in production environments

• When using tools to assist with development e.g. Claude Code, OpenAI Codex:

  • Care must be taken not to send system credentials or other sensitive data to the remote agents control servers.
  • A strict line must be maintained between development augmentation and data processing of classified data.
  • Consider developing protocol prompt files to add to any development projects to remind the LLMs of their security requirements.

• Exceptions may be authorised - and shall be recorded and managed via the company risk management system.

Technical Evaluation

If available, application configuration guidelines provided by the AI/ML solution provider must be used and applied to host and guest operating system as applicable.

Application-level encryption and access control must be applied for sensitive data according to the relevant classification scheme and AI/ML tool mapping.

Bringing AI/ML Models Into Company Environments

• Pre-trained LLMs, datasets and models from external sources shall be scanned before import into company managed environments.

Deployment to Production

Secure development practices must be maintained, with appropriate considerations given when deploying functionality from development to production environments.

Production Environment

Use of AI/ML in operational and active environments is subject to the following parameters:

• Only authorised AI/ML tools are to be used in production.
• Access to authorised AI/ML tools must be governed according to company authentication and authorisation policies.
• Technical and organisational controls must be used to restrict access to unauthorised AI/ML tools from production network environments, devices and users.
• Clients must provide explicit approval before their data is processed by company managed internal or third-party AI/ML services.
  • Clarity must be provided to client in advance of usage on whether client data is to be used for:
    • Supporting service delivery by implementation into workflows
    • Direct processing and manipulation of client's production data
    • Service delivery alone
    • Model training
    • Future model training (by retention of client data, derived data or metadata); this may be on a per project basis.
• Logs shall be kept of all AI/ML usage, including:
  • Which models and services are used
  • Which data assets are accessed and processed
  • Lineage and inheritance of any derived assets and their origin assets, systems or configurations
• Timestamped logs of AI/ML activity shall be retained according to the company audit log retention policy.
• Real-time monitoring of any AI/ML functionality deviations shall be implemented, and fed into appropriate management systems.

Unacceptable Use

• Unauthorised AI/ML tools must not be used to process company data, or from company systems.
• Users shall not enter classified company data into any AI/ML system without explicit authorisation.

Training and Awareness

In-scope personnel will be provided AI/ML training according to this policy, and tailored to their role within the organisation.

Possible examples of topics:

• Authorised and non-authorised tools
• Authorised data classifications for use with AI/ML models
• Effective and responsible prompt creation
• Validation methods for returned content

Participants and topics covered in the training shall be logged with timestamps in the company management system.

Policy Violations and Consequences

Any breach of this policy will be treated seriously and may result in disciplinary action. The severity of the response will reflect the nature, intent, and impact of the breach.

Minor or first-time violations may result in a formal warning and mandatory remedial training. However, certain breaches will be considered acts of gross misconduct and may result in summary dismissal without notice or payment in lieu of notice, in accordance with the employee's contract of employment and the provisions of the Employment Rights Act 1996.

Breaches likely to constitute gross misconduct include, but are not limited to:

• Deliberately inputting confidential, commercially sensitive, or personal data into unauthorised AI systems or third-party AI tools in contravention of this policy and applicable data protection obligations under the UK GDPR and the Data Protection Act 2018;
• Using AI systems to generate, distribute, or facilitate the creation of harmful, discriminatory, fraudulent, or unlawful content;
• Intentionally circumventing or attempting to bypass AI system controls, access restrictions, or audit mechanisms;
• Using AI tools to assist in, enable, or conceal unauthorised access to systems, data exfiltration, or any other activity constituting a criminal offence.

Where a breach is suspected to involve criminal activity - including but not limited to offences under the Computer Misuse Act 1990, the Fraud Act 2006, or data protection legislation - the organisation reserves the right to report the matter to the relevant authorities, including the police and/or the Information Commissioner's Office (ICO), without prior notice to the individual concerned.

These provisions apply equally to employees, contractors, consultants, agency workers, and any other individuals engaged by the organisation who are granted access to its systems or infrastructure. Contractors and third-party suppliers may additionally have their engagement terminated with immediate effect and relevant provisions of any applicable contract or service agreement enforced.

The organisation will investigate all suspected violations in a fair and timely manner. Employees retain the right to be accompanied at any formal disciplinary hearing in accordance with the ACAS Code of Practice on Disciplinary and Grievance Procedures.