1. Purpose

The purpose of these Terms of Use is to enable the responsible use of Generative AI technologies while protecting the Company’s information, systems, clients, employees, and reputation. Generative AI can improve productivity, research, drafting, and ideation, but it also creates material risks relating to confidentiality, privacy, legal compliance, cybersecurity, accuracy, and bias.


2. Scope

This policy defines the acceptable use of Artificial Intelligence (AI) tools within Larco Group of Companies. The policy applies to all employees, contractors, consultants, temporary employees, and other workers, including all personnel affiliated with third parties.

This policy applies to standalone AI tools, AI features embedded within otherwise-approved platforms (for example, Microsoft 365 Copilot), and AI capabilities delivered through third-party vendors and service providers. It covers company-owned and personally-owned devices when used for company business.

Violations of this policy may result in revocation of access and/or disciplinary action up to and including termination.


3. Approval Required Before Use

No employee, contractor, or other authorized user may use any Generative AI tool or service for Company business unless that tool has first been requested and approved by IT.

Only approved vendors and tools may be used for business purposes. Approved vendors have been vetted to confirm they meet Company requirements for privacy, security, legal, and data protection controls. 

Use of an unapproved AI vendor or service may result in disciplinary action, particularly where such use creates a risk of data leakage, privacy breach, contractual breach, or security incidents.

Link: Approved Vendor List

Any employee who wishes to use a new AI tool must submit a request to [email protected] for review and approval before use. Personnel requesting a new AI tool must submit a request to IT with the intended use case and the type of data to be used, and receive formal approval before accessing or using the tool. Only AI tools that meet the following requirements will be approved:

  • Integration with company Single Sign-On (SSO).
  • Ability to enforce company security and access controls.
  • Compliance with company data-protection and regulatory requirements.
  • A written commitment that company data will not be used to train the provider’s models, with acceptable data-residency, retention, and deletion terms.



4. Prohibition on Unapproved AI Use

The following activities are prohibited unless expressly approved in writing by IT Management:


  • Using personal or free AI accounts for company-related work.
  • Entering, uploading, or sharing confidential or sensitive information into non-approved AI tools, including but not limited to guest data, financial information, employee records, internal reports, and security configurations.
  • Entering cardholder data, biometric data, or Bank Secrecy Act / Anti-Money Laundering records into any AI tool, whether approved or not, absent explicit Compliance authorization.
  • Purchasing or subscribing to AI tools without IT approval.
  • Circumventing security controls or attempting to bypass AI restrictions.
  • Using AI tools in any manner that violates company policies, laws, or regulations.
  •  Using AI to make final decisions affecting a person’s employment, guest privileges, credit, or exclusion without documented human review.
  •  Inputting third-party intellectual property, copyrighted, or licensed material into AI tools without the necessary rights.
  • Using any AI tool that has not been approved by the IT Department, regardless of whether company data is entered.
  • No personal AI usage is permitted using company provided tools (like Microsoft Copilot) and no personal AI usage, queries, searches, prompts on company owned equipment (computers/phones).
  • Connecting any AI tool to Company systems, applications, storage locations, email, documents, or data repositories
  • Using browser extensions, plugins, desktop tools, SaaS integrations, or APIs that invoke unapproved AI services
  • Circumventing technical restrictions, security controls, or licensing requirements related to AI use


5. No Access to Company Data or Systems Without Explicit Permission

Generative AI tools must not be granted access to Company data, Company systems, customer information, employee information, financial information, operational records, leases, contracts, maintenance records, email, internal documents, or any other business information unless explicit prior approval is granted by Management.


Where AI access is exceptionally approved, only the minimum data required for the approved purpose may be used. The data must be structured, minimized, and sanitized so that, if disclosed, intercepted, or retained by a third party, the disclosure would not reasonably cause harm to the Company, its customers, tenants, employees, contractors, vendors, or other stakeholders.

Under no circumstances may users submit the following into any AI tool unless expressly authorized and technically protected through an approved arrangement:

  • Confidential or proprietary business information
  • Client, tenant, employee, or applicant personal information
  • Financial, payroll, banking, or tax information
  • Legal advice, privileged documents, or litigation materials
  • Security configurations, credentials, keys, or system architecture details
  • Lease data, payment histories, complaint records, or incident records
  • Any information classified by the Company as confidential, restricted, or sensitive


6. Data and System Security Requirements

If a Generative AI solution is approved to process Company data, the following controls are mandatory before use:

  1. The dataset must be reviewed by the business owner and IT.
  2. The dataset must be minimized and anonymized or pseudonymized where possible.
  3. A security and privacy review must be completed before implementation.
  4. A documented Privacy Impact Assessment must be completed where required by law, regulation, contract, or Company policy, including GDPR-related assessment requirements where applicable.
  5. The AI use case must be classified according to Company data classification and risk management standards.
  6. The use of the AI application, including approved purpose, dataset, owner, and retention requirements, must be logged centrally.
  7. Access must be limited to authorized users on a least-privilege basis.
  8. Output handling, retention, and deletion requirements must be defined in advance.
  9. IT Management may require additional controls including legal review, vendor due diligence, contract review, security testing, audit logging, or data processing terms.


7. Human Oversight and Accountability

All AI-generated outputs must be reviewed by a responsible employee before being relied upon, actioned, published, shared, or incorporated into business decisions, documents, reports, code, communications, or customer-facing materials. Employees remain fully accountable for the accuracy, appropriateness, legality, and quality of any work product that includes or is informed by AI output. AI may assist with drafting or analysis, but it must not replace human judgment.


At a minimum, the reviewer must confirm:

  • factual accuracy
  • completeness
  • absence of bias or discriminatory content
  • compliance with Company policies
  • appropriateness for the intended audience
  • no inclusion of confidential or sensitive information
  • that the output does not create legal, regulatory, reputational, or operational risk


8. Transparency and Disclosure

Where AI-generated content is used internally or externally, the responsible employee must ensure appropriate transparency.

All AI-generated content, or content materially assisted by AI, must include a disclaimer stating that all or part of the content was generated with the assistance of AI, unless IT Management, Legal, or Communications has approved an exception for a specific internal use case.


Sample disclaimer:
“This document includes content generated with the assistance of artificial intelligence and has been reviewed by [Company/Employee Name] prior to use.”

For external or client-facing use, additional approval requirements may apply.


9. Ethical Use

Generative AI must be used in a manner consistent with the Company’s ethical standards and professional responsibilities.

Users must not use AI to:

  • mislead, deceive, or impersonate others
  • discriminate against individuals or groups
  • invade privacy
  • produce harmful, offensive, harassing, or defamatory content
  • create false records or misleading business communications
  • generate content that violates intellectual property, contractual, or legal obligations
  • make significant decisions about individuals without proper human review and lawful authority

AI use must respect privacy, fairness, accountability, transparency, and the interests of clients, tenants, employees, and the public.


10. Compliance With Laws, Regulations, and Internal Policy

All AI use must comply with applicable laws, regulations, contractual obligations, and internal Company policies, including those related to privacy, data protection, records retention, cybersecurity, confidentiality, acceptable use, intellectual property, and vendor management.


Approval to use an AI tool does not remove or reduce any employee’s obligations under Company policy or applicable law.


11. Monitoring, Logging, and Audit

The Company may monitor, log, review, restrict, suspend, or revoke access to AI tools and related usage where necessary to protect Company interests, investigate misuse, maintain compliance, or respond to security or privacy concerns.


Approved AI use cases may be subject to audit at any time.


12. Incident Reporting

Any suspected or actual:

  • unauthorized AI use
  • submission of sensitive information into an AI tool
  • data leakage
  • inaccurate or harmful AI output
  • privacy breach
  • security event
  • contractual non-compliance must be reported immediately to IT Management and, where applicable, the Privacy Officer or Legal.