Trust, Security & Data Protection

Responsible AI Use Policy

1. Purpose

This policy outlines the principles, safeguards and responsibilities governing the use of Artificial Intelligence (AI) technologies by nVisionIT when delivering services to clients. The goal is to ensure that AI is used responsibly, ethically, securely and transparently, following industry-standard Responsible AI frameworks and aligning with applicable privacy regulations such as POPIA.

2. Scope

This policy applies to all AI systems, tools and models used in client engagements (including Generative AI, classification systems, Copilot-based tooling and automated analysis tools), and to all nVisionIT staff, contractors and partners involved in consulting, development, testing, data handling or solution delivery.

3. Responsible AI principles

• Accountability: nVisionIT maintains full accountability for any AI system used in a client environment. Humans remain responsible for reviewing, verifying and approving all AI-generated outputs.
• Fairness & bias mitigation: structured processes minimise bias during model selection, prompt design, data handling and output evaluation.
• Data privacy & POPIA alignment: all AI activities respect data minimisation, purpose specificity, consent requirements, secure processing and avoidance of confidential-data exposure.
• Transparency: we give clients clear visibility into how AI systems function, how outputs are generated and how content is validated.
• Security & safety: AI-enabled processes must be resilient, governed and protected from misuse, manipulation or leakage.
• Validity & reliability: all AI-generated material undergoes quality checks, testing and verification for accuracy, correctness and business relevance.

4. Acceptable use of AI in client environments

Permitted use: code scaffolding, automated testing, secure deployment analysis and regression analysis; document generation (BRDs, SADs, specs) and internal productivity; security-focused enhancements such as anomaly detection; and classification of data under POPIA and other regulatory frameworks. All outputs must be validated before inclusion in deliverables.

Prohibited use: employees must not provide any client, citizen, confidential or third-party data to public Generative AI tools without explicit approval; use AI tools to generate full systems or deploy unvalidated code; use AI in a way that violates laws, contracts, privacy requirements or industry standards; or generate deceptive, fraudulent or misleading content.

5. Data protection & confidentiality controls

Zero-exposure rule: no confidential, regulated, personal or client-owned data may be submitted to external AI platforms unless a contractual agreement exists, the platform meets client-specific security requirements, and explicit written approval is obtained.

Secure processing: AI systems used in client engagements must follow data classification, access controls, encryption standards and secure prompt-handling guidelines. A risk-based approach may assist with risk scoring, compliance tagging and identifying sensitive information under POPIA.

6. Client transparency & reporting

nVisionIT commits to disclosing where and how AI is used in deliverables, outlining validation steps and safeguards, and documenting governance and human-review processes. Clients may request model-usage details, data-handling procedures, security or audit assurances, and AI risk assessments.

7. Governance & oversight

Only approved AI technologies may be used for client projects, assessed on security posture, licensing, cost management and governance review. AI assists, humans own: all AI-generated artefacts must be reviewed, version-controlled and tracked in repositories. Internal governance teams periodically review model performance, security threats, compliance requirements and the effectiveness of controls.

8. Regulatory compliance commitment

nVisionIT commits to compliance with POPIA, client-specific data-protection terms, industry standards for responsible AI and global frameworks where applicable. Where AI is classified as “high risk”, appropriate controls, documentation and validation mechanisms are implemented.

9. Incident management & reporting

Any suspected or confirmed AI-related incident, including data leakage, incorrect outputs, harmful content or unauthorised access, must be escalated immediately to info@nvisionit.co.za or the Account Manager for containment and client notification where required. This policy is reviewed annually, or sooner if regulatory environments change or new AI capabilities introduce new risk considerations.