1. Introduction

Saksoft understands the importance of securing its information assets and recognizes that the availability, confidentiality and integrity of data are fundamental aspects for the protection of systems and information.
With the increasing adoption of Artificial Intelligence (AI) technologies across business operations, Saksoft shall establish clear controls for the secure, ethical and acceptable use of AI tools and services.

This policy provides a mechanism to carry out AI usage in a structured and consistent manner in accordance with industry standard practice and in alignment with Saksoft Information Security Policy, Cyber Security Policy and related information security standards. It also ensures that the AI security and acceptable use process is in
compliance with auditing requirements for ISO 27001 certification.

2. Purpose

The purpose of this document is to set out the policy and controls to implement and maintain a sound Artificial Intelligence Security and Acceptable Use program that covers the assessment, approval, deployment and ongoing use of AI technologies within Saksoft, with the objective of proactively mitigating security, privacy, legal and operational risks associated with it.

This policy provides a consistent outline throughout the organization of the principles and procedures necessary for implementing a comprehensive and integrated approach to AI usage covering employees, contractors, consultants and other authorized users, to maintain appropriate levels of security and responsible use.

The primary goals of this policy are to:

  • Protect Saksoft information assets, client data and intellectual property from unauthorized disclosure or misuse through AI systems.
  • Define acceptable and prohibited uses of AI tools for business and personal productivity purposes.
  • Ensure human accountability and oversight for decisions and outputs that are assisted or generated by AI.
  • Establish requirements for approved AI tools, vendor due diligence and continuous risk management.
  • Support compliance with applicable legal, regulatory and contractual obligations.

3. Scope

This policy applies to all employees, contractors, consultants, vendors and other third parties who access, use or manage Saksoft systems, information or client data, and who make use of Artificial Intelligence tools, platforms, models or services in connection with Saksoft work.

The scope includes, but is not limited to:

  • Generative AI tools (for example text, code, image, audio and video generation assistants).
  • AI features embedded within enterprise applications, productivity suites and development tools.
  • Machine learning models, automation agents and decision-support systems hosted on-premises, in cloud or as Software-as-a-Service (SaaS).
  • Custom or fine-tuned models developed or deployed by Saksoft or on behalf of Saksoft.
  • AI tools accessed from Saksoft-managed devices, personal devices used for official work, and remote or client environments where Saksoft personnel perform services.

This policy shall be read in conjunction with the Saksoft Information Security Policy, Cyber Security Policy, IT Access Control Policy, Incident Management Policy, Vulnerability Management Policy, Risk Management Policy and Hardening Standards.

4. Definitions

Artificial Intelligence (AI)

A system or service that performs tasks commonly associated with human intelligence, including learning, reasoning, prediction, content generation and decision support, whether rule-based, statistical or based on machine learning models.

Generative AI

AI systems that create new content such as text, code, images, audio or video in response to prompts or other inputs.

Approved AI Tool

An AI application, platform or service that has been reviewed and expressly authorized by the Information Security Team and relevant business stakeholders for use within Saksoft.

Shadow AI

The use of AI tools or services that have not been approved by Saksoft, including personal accounts and unauthorized SaaS applications used for official work.

Prompt

Any input, instruction, query or data provided by a user to an AI system to generate an output.

Confidential Information

Information classified as confidential or restricted under Saksoft information classification standards, including client data, personal data, source code, credentials, financial data, strategic plans and proprietary intellectual property.

Human Oversight

The requirement that a responsible individual reviews, validates and remains accountable for AI-assisted outputs before they are relied upon for business decisions, client deliverables or production changes.

5. Policy Statement

Saksoft will establish specific requirements and controls for protecting all information and information systems against unauthorized access, disclosure, modification or misuse arising from the use of Artificial Intelligence technologies.

Saksoft will effectively communicate the need for secure and acceptable use of AI tools and will permit the use of AI only where such use is lawful, ethical, business-justified and aligned with this policy and related information security standards.

All users of AI tools in connection with Saksoft work shall protect the confidentiality, integrity and availability of Saksoft and client information always and shall not place confidential information into unapproved AI systems.

6. Acceptable Use of Artificial Intelligence

AI tools may be used to support productivity and business outcomes when the following conditions are met:

  • Only Approved AI Tools are used for official Saksoft work, unless a documented exception has been granted by the Information Security Team.
  • Users authenticate using Saksoft-managed corporate accounts wherever available and do not use personal email addresses for official AI usage.
  • Prompts and inputs do not contain Confidential Information, personal data, client-identifiable information, credentials, access keys, or source code that is not expressly permitted for the approved tool.
  • AI-generated outputs are reviewed by a competent human before use in client deliverables, production systems, formal communications, contracts or decision-making.
  • Users clearly identify AI-assisted content where required by client agreements, professional standards or Saksoft procedures.
  • Use of AI remains consistent with applicable laws, client contractual terms, intellectual property rights and Saksoft code of conduct.

    Permitted examples

    Subject to the conditions above, the following uses are generally permitted:

  • Drafting internal notes, meeting summaries and non-confidential documentation.
  • Brainstorming ideas, outlining structures and improving clarity of non-sensitive writing.
  • Assisting with code suggestions on non-sensitive or approved development environments, subject to
    secure coding and peer review practices.
  • Researching publicly available information and summarizing open-source materials.
  • Creating training materials that do not include confidential or client-specific data.

7. Prohibited Use

The following activities are strictly prohibited:

  • Uploading, pasting or otherwise submitting Confidential Information, client data, personal data, credentials, encryption keys, security configurations or proprietary source code into unapproved or public AI tools.
  • Using Shadow AI for official Saksoft work without prior written approval from the Information Security Team.
  • Relying solely on AI outputs for legal advice, financial commitments, security decisions, production changes or client deliverables without competent human review.
  • Using AI to generate or distribute malware, exploit code, phishing content, social engineering material or any content intended to harm systems, people or organizations.
  • Using AI to bypass security controls, access controls, monitoring systems or licensing restrictions.
  • Creating deepfakes, impersonations or misleading content involving Saksoft personnel, clients or partners without explicit authorization.
  • Using AI in a manner that discriminates unlawfully, violates privacy rights, or breaches client confidentiality agreements.
  • Disabling, circumventing or interfering with logging, monitoring or data loss prevention controls related to AI usage.
  • Representing AI-generated work as fully human-authored where disclosure is required, or removing required attribution and licensing notices.

8. Data Protection and Confidentiality

Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of Saksoft which must be managed and controlled securely. All information has a value to the business; however, not all of this information has an equal value or requires the same level of protection.

When using AI tools, users shall apply the same information classification and handling requirements defined in the Saksoft Information Security Policy. Formal procedures control how access to information is granted and how such access is changed. AI usage shall not weaken these controls.


Data handling requirements

  • Do not enter data classified as Confidential or Restricted into AI tools unless the tool is approved for that classification and appropriate contractual and technical controls are in place.
  • Minimize data shared with AI systems. Use anonymized, masked or synthetic data wherever practicable.
  • Do not use AI tools to store Saksoft records as a system of record. Business records must remain in approved repositories.
  • Personal data shall be processed only for legitimate business purposes and in accordance with applicable privacy laws and client requirements.
  • Outputs that may contain residual sensitive content shall be handled according to their classification and shall not be forwarded to unauthorized recipients.

9. Approved AI Tools and Shadow AI

Saksoft shall maintain a register of Approved AI Tools. Only tools listed in the approved register, or covered by an approved exception, may be used for official work.

Approval process

Requests for new AI tools shall be submitted to the Information Security Team and shall include:

  • Business justification and intended use cases.
  • Data types that will be processed, including whether client or personal data is involved.
  • Vendor security documentation, data residency, retention and subprocessors.
  • Authentication, access control, encryption and logging capabilities.
  • Licensing, intellectual property and contractual terms relevant to Saksoft and client obligations.

The Information Security Team, in consultation with Legal / Compliance and relevant business owners as required, shall assess residual risk and approve, conditionally approve, or reject the request.

Shadow AI

Shadow AI introduces uncontrolled risk to confidentiality, intellectual property and compliance. Discovery of unauthorized AI usage may result in access removal, investigation and disciplinary action in accordance with Saksoft policies. Users who identify a business need for an AI capability shall request formal approval rather
than adopting unapproved tools.

10. Security Controls and Risk Management

Saksoft shall adopt and follow plans and procedures as per industry standards to ensure that risks associated with AI technologies are identified and managed. Controls shall be proportionate to the sensitivity of data processed and the criticality of the business process supported.

Technical and administrative controls

  • Access to Approved AI Tools shall follow least privilege and need-to-know principles as defined in the IT Access Control Policy.
  • Corporate identity, multi-factor authentication and, where available, single sign-on shall be used.
  • Network, endpoint and cloud security controls, including hardening standards, shall apply to systems hosting or integrating AI components.
  • Logging and monitoring of AI usage shall be enabled where technically feasible to support audit, investigation and continuous improvement.
  • Vulnerability management, secure configuration and patching requirements apply to AI platforms and integrations in line with the Vulnerability Management Policy and Hardening Standards.
  • AI-related risks shall be assessed and treated under the Saksoft Risk Management Policy, with periodic review of residual risk.
  • Data loss prevention, web filtering and related controls may be used to restrict access to unapproved AI services.

    Secure development and integration

    Where Saksoft develops, fine-tunes or integrates AI models into products or internal systems, teams shall apply secure software development practices, including threat modeling, input validation, output filtering, secrets management, model and dataset inventory, and separation of development, test and production environments.

11. Intellectual Property and Output Ownership

Work product created by employees and contractors in the course of Saksoft engagements remains subject to employment, contractor and client agreements. Use of AI does not alter ownership of Saksoft or client intellectual property.

  • Users shall not submit proprietary Saksoft or client materials into AI tools in a manner that grants the vendor unintended rights to train models or reuse content, unless the approved tool and contract expressly permit such processing under acceptable terms.
  • Users shall respect third-party copyrights, trademarks, open-source licenses and other intellectual property rights when using AI-generated content.
  • Code or content generated with AI assistance shall be reviewed for license conflicts, insecure patterns and originality concerns before incorporation into deliverables.
  • Client-owned data and artifacts shall not be used to train shared or public models without explicit client authorization and Information Security approval.

12. Human Oversight and Accountability

AI tools are decision-support and productivity aids. They do not replace professional judgment, accountability or management responsibility. Every user remains responsible for the accuracy, appropriateness and consequences of content and actions taken based on AI outputs.

  • Validate facts, calculations, citations, code behavior and recommendations before reliance.
  • Do not use AI outputs as the sole basis for employment decisions, client advice, security exemptions or financial commitments without appropriate human review and approval.
  • Escalate uncertain, high-impact or anomalous AI behavior to supervisors and the Information Security Team as appropriate.
  • Maintain sufficient documentation of material AI-assisted decisions where required for audit or client assurance.

13. Third-Party and Vendor AI Services

Engagement of third-party AI vendors and services shall follow Saksoft vendor risk and procurement practices. Contracts shall address confidentiality, data protection, security incident notification, subprocessors, data residency, model training restrictions, audit rights and exit arrangements as applicable.

Vendors processing Saksoft or client data through AI capabilities shall be assessed for security posture prior to onboarding and periodically thereafter. Material changes to vendor AI features, data use practices or subprocessors shall trigger re-assessment.

14. Incident Reporting

Prompt response to suspected or actual security incidents is a critical part of Saksoft’s ability to protect its Information Assets. All employees / contractors are required to immediately report suspected AI-related security incidents or violations of this policy to the Information Security Team either directly, or via the email Hot Line: “IT-Security_Team@saksoft.com”.

Examples of AI-related incidents include, but are not limited to:

  • Accidental disclosure of Confidential Information or client data into an AI tool.
  • Unauthorized use of Shadow AI for official work involving sensitive data.
  • Suspected model poisoning, prompt injection, data exfiltration or account compromise involving AI services.
  • Discovery of malicious or manipulated AI-generated content targeting Saksoft or clients.
  • Loss of access credentials used for AI platforms.

The Information Security Team shall initiate an investigation and/or involve the appropriate support organizations to correct the problem or address the situation. All security incidents must be logged either before or after the incident is reported depending on the urgency of the incident, in accordance with the Incident Management Policy.

Employees / Contractors should not attempt to correct security incidents themselves where doing so may destroy information needed to identify or prosecute the person(s) responsible for the incident, or understand how or if a security breach has occurred.

Employees / Contractors must not report computer security incidents, problems and/or violations to any outside parties except as directed by authorized personnel. Information Security Head and/or the Compliance officer is responsible for contacting law enforcement, regulatory bodies and any other necessary external contacts including clients in the event of a data incident.

15. Roles and Responsibilities

All Employees / Contractors
Comply with this policy; use only Approved AI Tools for official work; protect Confidential Information; review AI outputs before use; and report incidents or suspected violations promptly.

Managers / Project Leaders
Ensure team members understand acceptable AI use for their engagements; enforce client-specific restrictions; and escalate approval requests and exceptions to the Information Security Team.

Information Security Team
Maintain the Approved AI Tool register; assess AI-related risks; define security controls; investigate incidents; and provide guidance and awareness related to this policy.

IT / Infrastructure Teams
Implement technical controls for access, monitoring, hardening and integration of approved AI platforms in line with Saksoft standards.

Legal / Compliance
Advise on contractual, regulatory and intellectual property implications of AI usage and vendor engagements as required.

Senior Management
Provide sponsorship for responsible AI adoption, allocate resources for control implementation, and approve material exceptions where required.

16. Policy Compliance

Compliance with this policy is mandatory. Saksoft may monitor use of AI tools on corporate systems and networks to the extent permitted by law and applicable policies, for the purpose of protecting information assets and verifying adherence to this policy.

Any exception to this policy must be approved in writing by the Information Security Team and, where appropriate, by Senior Management. Exceptions shall be time-bound, documented and subject to review.

Failure to comply with this policy may result in disciplinary action up to and including termination of employment or contract, and may also lead to legal or regulatory action where applicable. Access to systems and AI services may be suspended pending investigation.

17. Policy Governance

This policy shall be reviewed at least annually, or earlier when significant changes occur in technology, business operations, legal requirements or the threat landscape. Reviews shall consider lessons learned from incidents, audit findings and changes to related Saksoft policies.

Ownership of this policy rests with the Information Security / IT function. Proposed amendments shall follow the standard approval and amendment history process used for Saksoft information security policies.

Training and awareness on secure and acceptable AI use shall be provided periodically. The continuous improvement of AI security and acceptable use processes implies that those processes are periodically reviewed, tested and translated into recommendations.

For queries related to this policy, contact the Information Security Team at IT-Security_Team@saksoft.com