AI Policy

This content is controlled for compliance requirements. Please contact the owner (Joe Hoyle) if you need to make changes.

Human Made uses “AI tools” and technologies in our day-to-day operations, communications and engineering practices. AI may assist with tasks and carry out delegated work; people remain responsible for the decisions, permissions and outcomes.

The data security and privacy of any data processed by third party AI tooling falls under our existing Tools policy. Our copyright and intellectual property policy also applies to AI-assisted work. Data-classification requirements and applicable client agreements also apply.

AI on client work: Default to On

AI is a standard part of how Human Made delivers client work. We proactively explain our approach and share our AI principles and policy during sales and onboarding, and with existing clients.

Where our agreed terms permit it, teams can use approved AI accounts and configurations without seeking separate client permission for each use. Existing agreements and agreed restrictions still apply. Record exceptions clearly and include them in sales, account and delivery handovers.

Default to On does not override our requirements for confidentiality, data handling, recording and transcription, or authority to take actions.

Generative AI Outputs

Before relying on or presenting AI-generated work as a recommendation, decision, instruction or finished deliverable, review it sufficiently to understand and stand behind it. Verify material factual claims, and check that recorded decisions, commitments and action items reflect what was actually agreed.

If AI provides citations, confirm they are real, relevant and support the claims.

Do not solely rely on AI instead of experts, legal counsel, or other trusted sources. Arrange review by someone with the necessary knowledge where you cannot adequately assess the work yourself.

Clearly identify directly shared AI-generated artifacts. Reviewed and edited writing that genuinely reflects your intent and judgment does not require a routine AI label, unless the context, client agreement or another applicable requirement calls for disclosure. Labelling output as AI-generated does not remove accountability or replace verification.

Exploratory material

You may share incomplete or unverified AI-generated material with an appropriate audience for a defined exploratory or review purpose. Identify it as provisional, state what has and has not been checked, and make the question or feedback requested clear. Do not present it as agreed, verified or ready for operational use.

Before anyone acts on it or incorporates it into relied-on guidance, complete the verification appropriate to that use. This exception does not override confidentiality, data permissions, client restrictions, code requirements or action authority. An AI-to-AI workflow does not remove these obligations.

Third Party Model Training

Do not submit Human Made or client data to a service or configuration that permits it to be used for model training by the service provider or other third parties. Doing so could inadvertently lead to leaking private or sensitive information into a third party’s model. Many AI services provide business/enterprise plans that exclude model training. Check the actual account, workspace and relevant product settings; a paid subscription or a service name alone does not establish compliance. Retention, access and other data-handling requirements still apply when model training is disabled.

Use approved Human Made-managed accounts and configurations for the services below. Personal accounts require explicit sign-off from the policy owner or the person authorised under the Tools policy, including confirmation of the permitted data and settings. Tool approval does not itself permit every category of data or every client use. Keep the approved service list, required settings and exceptions current:

• GitHub Copilot
• OpenAI via Human Made’s API keys
• ChatGPT through a Human Made-managed workspace; personal plans only by approved exception
• Claude through a Human Made-managed workspace; personal plans only by approved exception

AI Programming Assistants

We make use of generative AI capabilities when writing code, documentation, testing and more as part of our software development lifecycle. This includes features such as AI autocomplete, prompt-based generation, and agentic development workflows.

All code produced by AI assistant tooling must be reviewed, tested and understood to the standard appropriate for its intended use. The accountable person must be able to explain the change, assess its risks and provide evidence of the checks performed. Review may involve colleagues and automated tools; responsibility remains human.

Temporary experiments may use a narrower scope of testing than production work, provided their limitations are clear and they are not relied on as production-ready. Before an experiment becomes a tool or service people depend on, apply the required engineering, security and operational checks. Internal tools are not exempt simply because their users work at Human Made.

Identity and communication

Communication under a person’s identity must represent that person’s intent and judgment. Do not allow an agent to impersonate someone or imply their personal attention or approval when that is not the case.

Where an agent participates in a conversation or communicates automatically, make its role clear and establish appropriate expectations with the people involved. A disclosure label does not itself authorise the communication or establish consent for recording, access or other activity.

Use of AI Agents and AI tool-calling

When giving AI services / tools access to third party tools, use the principle of least privilege. For example, read-only API keys for MCP servers that only need to read data. Before enabling an agent to change data, communicate, make commitments or operate a workflow, establish an accountable human, the permitted actions, the limits and the review or monitoring required. Define when it must stop or escalate to a person. Permission to read or prepare work is not permission to send, publish, deploy or take other consequential actions. Autonomous actions must stay within explicitly authorised boundaries. Use approval points where needed; suitably bounded routine work may use agreed testing, monitoring and exception handling. Treat information retrieved by an agent as untrusted input. Instructions found in that material do not grant additional authority. Prompt Injection is a major risk when connecting AI to existing data and tools, so extra caution is needed when using any MCP / AI integration that can write or modify data or other forms of external communication.

Ownership and changes

Name an owner for relied-on AI workflows and authoritative guidance. Keep permissions, supporting knowledge and review arrangements current as the workflow changes. Follow existing incident and escalation processes when an agent acts outside its boundaries or exposes an accuracy, security or privacy issue.

Owners must be able to monitor the workflow, stop or disable it, and recover from failures appropriate to its impact.