AI Governance Policy
Effective Date: September 14, 2026
This AI Governance Policy establishes legal, compliance, security, privacy, and responsible-use requirements for artificial intelligence capabilities developed, integrated, procured, or used in connection with Efferent.
1. Purpose
This AI Governance Policy establishes legal, compliance, security, privacy, and responsible-use requirements for artificial intelligence capabilities developed, integrated, procured, or used in connection with Efferent.
2. Scope
This Policy applies to employees, contractors, product teams, administrators, and service providers involved in AI-assisted content, response suggestions, summarization, classification, sentiment or engagement analysis, workflow recommendations, automation, analytics, and other machine-assisted functionality.
3. Governance Principles
Efferent AI will be governed according to lawful use, human accountability, proportionality, privacy by design, data minimization, security, transparency, reliability, non-discrimination, and documented risk management.
4. AI Inventory and Ownership
Material AI systems and external model providers used by Efferent should be inventoried with a designated business or technical owner, intended purpose, data categories, integration points, known limitations, and risk classification.
5. Risk Classification
AI use cases should be evaluated based on potential impact on individuals, customers, legal rights, financial interests, safety, privacy, security, and reputation. Higher-risk uses require enhanced review, testing, approvals, monitoring, and human oversight.
6. Prohibited Uses
Efferent personnel may not intentionally configure AI to facilitate unlawful discrimination, fraud, harassment, malware, unauthorized surveillance, deceptive impersonation, unlawful data collection, or other activity prohibited by law or Efferent policy.
7. Human Oversight
AI outputs are assistive unless expressly approved for autonomous operation. Appropriate human review must be maintained for consequential customer communications, legal or compliance decisions, material account actions, sensitive classifications, or other higher-risk uses.
8. Transparency
Where appropriate to the context and required by law, Efferent will disclose material use of AI, explain that outputs may contain errors, and provide customers with information reasonably necessary to understand relevant AI-assisted functionality.
9. Data Governance
AI processing must comply with the Efferent Privacy Policy, DPA, contractual restrictions, third-party platform rules, retention requirements, and data minimization principles. Sensitive or regulated information may not be used with an AI provider unless approved controls and contractual terms support that processing.
10. Model and Vendor Due Diligence
External AI providers should undergo risk-based diligence addressing security, privacy, data use, retention, model training practices, confidentiality, subprocessors, incident response, availability, intellectual property, and contractual allocation of risk.
11. Customer Data and Model Training
Customer Data will not be used to train a general-purpose AI model except where expressly authorized by contract or otherwise lawfully permitted and appropriately disclosed. Product teams must document any model-improvement use of customer-derived data.
12. Testing and Validation
Material AI features should be tested for accuracy, robustness, unsafe outputs, prompt injection or manipulation risks where relevant, privacy leakage, bias, and performance within the intended use case before production release and after material changes.
13. Intellectual Property
Teams must consider copyright, trademark, licensing, provenance, and third-party rights when designing AI features. AI-generated outputs must not be represented as guaranteed non-infringing, unique, or legally protectable.
14. Security
AI integrations must use approved credentials, access controls, logging, secrets management, rate controls, input/output safeguards, and secure development practices. Model endpoints and automation capabilities must not create unauthorized pathways into Efferent systems or Customer Data.
15. Monitoring and Incident Management
Material AI incidents, including harmful outputs, data leakage, unauthorized autonomous actions, security compromise, or significant model degradation, must be reported through Efferent's incident management process and evaluated for customer or regulatory notification obligations.
16. Change Management
Material changes to models, providers, prompts, retrieval sources, autonomous capabilities, data flows, or intended uses require risk-based review before release.
17. Documentation and Auditability
Teams should maintain records proportionate to risk, including purpose, model/provider, approvals, testing, data sources, safeguards, known limitations, incidents, and material changes.
18. Training
Personnel responsible for AI development, procurement, deployment, administration, or review should receive periodic training appropriate to their role.
19. Enforcement
Violations may result in removal of access, suspension of a feature, corrective action, contractual remedies, or other measures appropriate to the circumstances.
20. Review
ELCO, Information Security, Product, and Engineering should review this Policy at least annually and when material legal, regulatory, technological, or product changes occur.