Why Employers Should Consider Implementing an AI Policy and How to Do It

PDF

Employers across industries can benefit from a proactive and controlled approach to AI utilization. AI is a useful tool with the potential to improve efficiency and processes for employers and employees alike. However, it is not without risks. Failure to consider issues such as infringement of intellectual property rights, data privacy and security, and ethical matters can subject employers to liability and costs. The federal government and multiple states have taken measures to regulate AI. Notably, many employees are already using AI tools in various aspects of their work, whether or not it is sanctioned by their employer. Implementation of a policy that ensures AI tools are used ethically, and aims to protect sensitive data and maintain human oversight in decision-making processes, provides protection for employers and employees as AI technology continues to develop. When drafting and implementing an AI policy for your organization, consider the following:

• EEO Applies. State that the organization’s policies, such as equal opportunity, nondiscrimination, accessibility, and privacy, apply to the usage of AI tools. Employers are ultimately responsible for unexpected biases or discrimination originating from AI tools and may face legal challenges or suffer reputational harm as a result.
• Acceptable and Prohibited Uses. Acceptable uses of AI tools might be limited by department or to specific purposes. For example, the marketing department may be authorized to use AI-generated content so long as it does not infringe upon any intellectual property rights or other recognized legal rights of another, and is subject to the review and approval of the marketing manager. Likewise, permissible business purposes might include tasks such as creating software code, assistance with research and data analysis, or insights or recommendations in decision-making. On the other hand, prohibited uses may include the use of AI-generated content to represent the organization in communications or materials, inputting sensitive or confidential customer/client/employee data, or making comprehensive or final business decisions affecting operations or strategy.
• List Acceptable AI Tools. AI tools used for business purposes should be limited to those that have been vetted by the company.
• Verification of Data Generated by AI Tools. AI has been known to provide false or fabricated information in response to a request. The AI policy should require verification of the existence, accuracy, and legality of AI-generated information.
• Implement a Usage Log. During the early days of implementing an AI policy, tracking the usage of AI tools for business purposes can provide insight into the value added by AI tools and mitigate potential problems.
• Enlist a Data Protection Officer. This individual might be tasked with ensuring compliance with the AI policy, including conducting audits, particularly regarding the handling of sensitive data, and providing guidance on sensitive/confidential data and information. The data protection officer may implement an audit system to carefully monitor and record all AI tool inputs and outputs, including identifying the source of all data sets used with AI tools and labeling AI tool outputs to indicate they were produced in whole or in part using AI technology. Managers should also be trained to provide support or guidance to employees as needed.
• Update Related Policies. While creating its AI policy, an organization should consider updating its policy regarding confidential information or related policies for consistency and compliance with relevant laws.

We encourage you to monitor our Mid-Week Memos for future articles discussing AI-related developments, and to reach out to any member of Maynard Nexsen’s Labor and Employment Law team with questions.