TEG AI Governance Policy

AI Governance & Responsible-Use Policy

Version 1.0

14 June 2025 • Next formal review: June 2026 or sooner if legislation changes

1 Purpose

This policy sets out how TEG Learning & Development (TEG) adopts and governs artificial-intelligence (AI) technologies so that they strengthen, not compromise our mission to design and deliver world-class learning solutions.

It gives every employee, associate, trainer and consultant clear guard-rails for using AI lawfully, ethically and securely, and demonstrates to clients, partners and regulators that we uphold the highest standards of data protection and professional conduct.

2 Scope

Applies to:

all TEG employees (permanent, fixed-term and part-time);
all associates, trainers, consultants and sub-contractors engaged by TEG;
all AI systems: commercial, open-source, or developed in-house, used to create or support email management, speech-to-text, document drafting, presentation design, contract drafting, imagery and film production, recruitment processes, training-module generation, simulation development, agentic workflows and any other facet of our business operations.

This policy covers work undertaken in the United Kingdom and any overseas activities carried out for UK-based clients. Future expansion into the EU or US will trigger additional jurisdictional reviews.

3 Principles

Our AI use must be:

Principle	Meaning for TEG
Lawful	Comply with UK GDPR, the Data Protection Act 2018, forthcoming Data (Use and Access) Bill reforms and sector guidance from the ICO. ico.org.uk and dpocentre.com
Fair & Transparent	Explain when and how AI is used in client-facing outputs; disclose any significant limitations or uncertainties in AI-generated content.
Secure & Confidential	Never expose sensitive information to public AI services unless (a) it has been irreversibly anonymised or (b) an approved data-processing agreement is in place.
Human-Centred	Maintain “human-in-the-loop” review for every client deliverable. AI augments our expertise; it never replaces professional judgement.
Accountable	Keep auditable records of significant AI-assisted decisions and model outputs, in line with ISO/IEC 42001 guidance on AI Management Systems. iso.org
Proportionate	Match the stringency of controls to the risk level identified in the EU AI Act classifications (prohibited, high-risk, limited-risk, minimal-risk). eur-lex.europa.eu and investopedia.com

4 Classes of Information and Data-Handling Rules

Data Category	Examples	AI Handling Rule

Highly Sensitive

OFFICIAL-SENSITIVE government material, special-category personal data (health, ethnicity), live tender content, draft IP

❌ Must not be submitted to any externally hosted AI platform. Use on-prem or private-cloud models only, with encryption and access controls.

Confidential

Client names, emails, purchase data, schedules

✅ Permitted if the data is pseudonymised before transmission and the AI vendor contractually guarantees no retention or re-use.

Public / Non-sensitive

Published articles, royalty-free media, anonymised learning analytics

✅ Free to process in any vetted AI service, subject to licence terms.

5 Permitted Uses

Employees and associates may leverage AI to:

draft outlines, storyboards, presentations and policy documents;
transcribe and summarise recorded workshops;
generate imagery or video prototypes for instructional design;
build simulations and agentic learning scenarios;
automate administrative tasks (e.g., inbox triage, meeting scheduling).

All outputs must be reviewed by a competent human before external release.

6 Prohibited and Restricted Uses

Deploying generative AI to create final-form legal contracts without legal counsel review.
Allowing autonomous AI agents to send emails, publish content or enter into agreements on TEG’s behalf.
Using AI tools that lack a verifiable audit trail, security documentation or right-to-use licence.
Feeding any Highly Sensitive data (section 4) into public-facing, consumer AI models (including free API tiers).
Attempting to de-anonymise datasets or generate personal profiles from AI-derived insights.

7 Human Oversight

A qualified subject-matter expert must:

1. Verify factual accuracy and relevance;

2. Assess potential bias or discriminatory impact;

3. Ensure the style is consistent with client requirements and brand;

4. Approve the content for distribution or internal use.

Automated deployment pipelines must pause for human sign-off.

8 Vendor and Tool Selection

Before procuring any AI solution, the requesting manager must:

complete the TEG AI Risk & Procurement Checklist aligned to the Crown Commercial Service “Guidelines for AI Procurement” and PPN 017 (2025). crowncommercial.gov.uk and gov.uk
confirm the vendor meets UK-GDPR processor obligations, including data-processing-agreement clauses on retention, sub-processing, location and security.
obtain sign-off from the Data Protection Officer (DPO) and Group MD.

9 Roles and Responsibilities

Role	Key Duties
Group Managing Director – Keith McMean	Policy owner; provides resources and strategic oversight.
Data Protection Officer – Jo Blackburn (office@teguk.co.uk)	Advises on lawful bases, DPIAs, vendor contracts; maintains risk register; leads incident response.
Line Managers and Project Leads	Enforce policy in their teams; approve AI use-cases; log exceptions.
All Employees and Associates	Complete annual AI-ethics training; report breaches or concerns promptly.

10 Training and Awareness

Mandatory induction module plus annual refresher, covering: ICO guidance on AI & data protection, AI bias, prompt engineering dos and don’ts, and secure-handling techniques. Attendance is recorded in the Learning Management System.

11 Incident Management

Suspected or actual breaches e.g., disclosure of sensitive data to an unauthorised AI service, must be reported to the DPO within 24 hours. The DPO will assess notifiability under UK-GDPR, coordinate containment, and document corrective actions.

12 Monitoring and Audit

The AI Governance Lead (appointed by the CEO) will conduct quarterly spot-checks of AI logs, prompts and outputs. Findings feed into the ISO/IEC 42001-aligned continuous-improvement cycle and the organisation-wide risk register. iso.org

13 Review and Revision

This policy is reviewed:

annually (by 30 June each year);
immediately after major regulatory changes e.g., full applicability of Regulation (EU) 2024/1689 (AI Act) in August 2026, or enactment of the UK Data (Use and Access) Bill. (Ref. links point 3 above.)
Updates are approved by the CEO and communicated to all staff and associates within 30 days of issue.

14 References (selected)

ICO, Guidance on AI and Data Protection (updated 15 March 2023). ico.org.uk
ISO/IEC 42001:2023, Artificial Intelligence Management System. iso.org
Regulation (EU) 2024/1689, Artificial Intelligence Act. eur-lex.europa.eu
CCS & Cabinet Office, Guidelines for AI Procurement and PPN 017 (2025). crowncommercial.gov.uk and gov.uk
UK Data (Use and Access) Bill – legislative progress update (May 2025). arnoldporter.com

Date signed: 14 June 2025
Signed by: Keith McMean, Group Managing Director

Document uncontrolled when printed. The online version on the TEG website is the authoritative copy.