Do I need an AI policy? Partner Catherine Wilson shares some thoughts

In August I wrote a blog about the use of AI in HR.  My personal enthusiasm for AI remains unbounded however irrespective of my own views, it has become clear to  me that AI will increase in importance in the workplace and, love it or loathe it, then it is here to stay .  At the same time, employees are increasingly using AI in the work place, with or without their employer’s knowledge and the workplace is beginning to resemble a 21^st Century Wild West in which, in the absence of any form of policy or guidance, employers are already exposed to significant risk of abuse and litigation.

Some years ago it became increasingly fashionable to pooh pooh having formal policies in the work place. Unloved and unread, they lay in distant parts of the intranet or, even worse, dusty cupboards. “If you don’t trust them (employees) then don’t employ them” became the prevailing mantra. Employment lawyers and HR teams were encouraged to get all employment provisions down to a single sheet of A4. There may still be some benefits in this approach however formal policies do retain some importance and AI remains one of those areas where the guidance contained in a formal policy is extremely useful to employers and employees alike.

Drafting an effective policy

So how do you draft an effective AI policy? This is not an area where a download from the internet will necessarily cut it.  The start point must be the review of all those areas in a particular organisation where Artificial Intelligence already has significance.  Once the scale of current and indeed potential future usage has been established then the aims of the policy can be clearly identified and used to draft the policy. These aims usually include ensuring legal compliance, data privacy and copyright protection whilst also maintaining security, preventing bias and discrimination and establishing employee accountability and liability notwithstanding personal AI usage. Ethical considerations surrounding the use of AI should also not be ignored.

Aside from the key aims of any policy, employees should be aware of the scope and range of AI usage within the workplace. This should define the types of AI systems which are authorised for usage and those which are not. The use of unauthorised AI systems or the misuse of authorised AI systems are both capable of being disciplinary offences and this also needs to be reflected in any updated disciplinary policy. This may appear unduly prescriptive, however it is critical that employees are clear as to which AI policies are permitted in the workplace.

Effective policies should go beyond the list of specific do’s and don'ts and should provide a framework for how AI can be integrated into a range of work procedures and properly adopted to maximise innovation. The endorsement of AI as a positive development can also provide reassurance and encouragement for employees. 

High risk areas

It will however be  clear that there are some areas which are particularly high risk.  Breach of copyright, plagiarism and the inclusion of incorrect information or errors in company documentation create potential issues for both employer and employee. Using AI does not provide an excuse for inaccuracy or a defence to a claim for illegal usage; employees need to be aware of the risks involved and crucially, their own responsibilities and liabilities. The unauthorised use of material produced by third parties and used without their express consent has proved a specific problem for employers in practice.

Final thoughts and next steps

A couple of final points.  A policy which is not regularly updated and a policy which is not accompanied  by thorough training is best understood as cheese. It goes off in the fridge and becomes inedible  or, in the case of an AI policy, unusable.  Having a policy on its own without any effort to bring it to the attention of affected employees is  probably, regrettably. a waste of time!

The focus of this piece is about the benefits of having a clear internal AI policy but organisations also need to focus on other linked areas such as recruitment and DBS checking.  What arrangements do you have with agencies over their use of AI? How do they use AI for their vetting and selection processes?  Are these processes potentially discriminatory?  Do they respect data protection and privacy rights. Crucially do your commercial contracts provide you with adequate protection against the risks of litigation and damages? A thought for another day?     

Catherine Wilson is a partner at Constantine Law.