The purpose of this policy is to ensure that Artificial Intelligence (AI) systems, tools and services used by Core GRC are used responsibly, securely and with appropriate human judgement and oversight.

AI is an important business capability that can improve productivity, analysis, decision support, professional services and the quality of our work. Its use must protect information, support reliable and explainable outcomes, and maintain clear human accountability.

This policy complements the Core GRC Information Security Policy and extends its principles to AI-enabled systems and AI-assisted activities.

This policy applies to all AI systems, models and tools used by Core GRC, whether internally developed, provided by third parties or embedded within other business platforms.

It applies to all employees, associates, contractors and partners acting on behalf of Core GRC and to information processed through AI-enabled activities, including prompts, outputs and decision artefacts.

This includes generative and agentic AI, AI-assisted analytics and decision support, automation, and AI capabilities embedded within SaaS, cloud and enterprise platforms.

Core GRC applies the following principles when using AI:

Human accountability - AI supports human capability and judgement but does not remove human accountability. People remain responsible for the work, decisions and professional conclusions for which they have authority.

Responsible information handling - Information provided to AI systems will be handled appropriately according to its sensitivity, confidentiality and purpose.

Human judgement and oversight - AI outputs will be appropriately reviewed, challenged and validated before being relied upon for material professional or business purposes.

Accuracy and reliability - Users must recognise that AI outputs can be incomplete, inaccurate or misleading and apply appropriate verification.

Security and privacy - AI will be used in a manner consistent with Core GRC's information-security, confidentiality and data-protection obligations.

Transparency and explainability - Where AI materially contributes to a decision or professional outcome, its role should be capable of being understood and explained where appropriate.

Proportionality - The level of oversight and assurance applied to AI use should reflect the risk, impact and significance of the activity.

AI may be used across Core GRC activities including research, analysis, drafting, summarisation, document review, automation, decision support and professional-service delivery.

AI may also be used when working with business, client or engagement information where this is appropriate to the work being undertaken and consistent with applicable confidentiality, contractual, information-security and data-protection obligations.

Users must exercise professional judgement when determining what information is appropriate to process through an AI system and should minimise unnecessary disclosure of sensitive information.

AI must not be used to circumvent established legal, contractual, professional, security or governance obligations.

AI-generated or AI-assisted outputs must be appropriately reviewed before being relied upon for material decisions, advice, reports, assessments or other professional outputs.

The person responsible for the work remains accountable for its accuracy, appropriateness and conclusions.

Where AI assists with audit or assurance activities, the responsible auditor or assessor retains responsibility for evaluating evidence, determining findings, reaching conclusions and approving the final output.

AI may assist professional judgement; it does not assume professional accountability.

Users must take reasonable steps to protect personal, confidential, commercially sensitive and client information when using AI.

Only information reasonably required for the intended activity should be processed.

AI prompts, outputs and associated records containing sensitive or decision-critical information should be handled according to the same information-security principles that would apply to equivalent information processed using other business technologies.

Credentials, API keys, integrations and access to AI-enabled systems must be appropriately protected.

Users must consider the limitations of AI and apply an appropriate level of verification to its outputs.

The degree of checking should be proportionate to the significance and potential consequences of the output. Material professional, contractual, regulatory or assurance conclusions must remain subject to competent human review.

Users should challenge, correct or disregard AI output where it is unsupported, inaccurate, inappropriate or inconsistent with available evidence.

AI-related risks will be considered through Core GRC's existing risk-management and information-security arrangements rather than through a separate approval process.

Suspected AI-related information-security, privacy or other material incidents will be managed through the relevant Core GRC incident-management arrangements.

AI use and associated controls may be reviewed as part of Core GRC's normal ISMS, governance and continual-improvement activities.

People using AI on behalf of Core GRC should understand the capabilities and limitations of the systems they use and have sufficient competence to review and take responsibility for the resulting work.

Training and awareness will be proportionate to role, use and risk.

Failure to comply with this policy may expose Core GRC, its clients or other stakeholders to information-security, privacy, contractual, regulatory, professional or reputational risk.

Material non-compliance will be addressed through the appropriate Core GRC governance processes.

This policy will be reviewed at least annually and when significant changes occur in Core GRC's operations, technology, regulatory environment or risk profile.

Policy Owner: Managing Director
Effective Date: September 2026
Next Review: September 2027
Version: 2.0