AI Policy

This policy explains how THISISITUK LTD, trading as “this is IT” (“we”, “us” and “our”), uses AI when running its business and providing managed IT services. It explains the uses we permit, how we protect information and who remains responsible for the work.

1. Purpose and Scope

AI can support our work, but it must be used carefully. This policy explains the standards we apply when using AI for business activities and client services.

This is a public policy for clients, prospective clients and website visitors. Its standards apply to employees, contractors and anyone else using AI on our behalf.

Read it alongside our Privacy Policy, Terms and Conditions and, where we process personal data for a client, the applicable Data Processing Agreement. Agreed client-specific requirements also apply. The Data Processing Agreement takes priority for personal-data processing.

A note on terminology

This policy uses AI, short for artificial intelligence. The term Super Intelligence (SI) is coming into use for the same technology. We may use AI and SI interchangeably from time to time. Where we do, they mean the same thing in this policy. If the wording settles on one term, we will update this policy and our website to match.

2. Our Principles

We use these principles when choosing and using AI tools:

• Safety and security: AI tools remain subject to our access, information-security and change-control arrangements.
• Transparency: We tell a client when AI has materially shaped a recommendation, system design decision, risk assessment, written report or cost model they will rely on. We record this on the deliverable itself. Routine drafting, formatting and internal summaries do not require a separate disclosure.
• Fairness: We do not use AI to profile, score or rank individuals or to make decisions about them.
• Accountability: A person remains responsible for work delivered to a client and for actions taken on a client system.
• Questions and corrections: If a client raises a concern about AI-assisted work, a person will review it and respond. Where appropriate, we will correct the work or take other reasonable action.

3. Where We Use AI

We may use approved AI tools to assist with:

• drafting and reviewing scripts, configurations and code;
• researching technical issues and preparing service documentation;
• summarising support information and helping to organise work;
• analysing relevant logs or diagnostic information where it can be handled safely;
• drafting business or website content; and
• formatting information and preparing reports through approved automated processes.

AI supports our work but does not replace professional judgement. A person reviews material AI-assisted work before it is sent to a client or used to make a change to a client system.

4. Tools and Providers We Use

We use AI tools that have been reviewed and approved for business use. Our current tools and general uses are:

IT Glue also includes a separate password-strength tool. This is not part of its AI integration.

We assess new AI tools and features before using them for client work. The information used with each tool is limited according to the task, the applicable client arrangements and the safeguards in this policy.

5. Model Training: Off by Default

We do not permit client information to be used to train or fine-tune general AI models. We use approved business accounts whose terms provide that inputs and outputs are not used for model training by default and we do not opt in to training or feedback sharing. We do not train our own models on client information.

An AI provider may retain prompts and outputs to operate its service, maintain security or detect misuse. Retention is separate from model training and varies by provider, product and settings. We review the arrangements when an approved provider, plan or relevant setting changes.

6. Client Separation and Context Guards

We keep client work in separate approved projects or sessions. We do not use one client’s documents, configurations or incident history as context for another client’s work.

We restrict AI memory and history to the relevant client where the tool supports those controls. Some separation also depends on how our team uses the tool, so employees and contractors must keep client information in the correct project or session.

We provide only the information needed for an approved task. We remove or reduce names, personal data and unrelated details where this can be done without affecting the work. We do not enter passwords, API keys, MFA recovery information, credential exports, backup encryption keys, complete backups or large client data sets into general-purpose AI tools.

Where a control is organisational rather than technically enforced, we say so.

7. How We Use AI Responsibly

AI supports our work, but it does not replace professional judgement. We remain responsible for the services and work we deliver, including work created with AI assistance. The account manager assigned to each client oversees AI-assisted work for that client. A named team member is responsible for each AI-assisted deliverable and any action taken on the client’s systems.

We apply these safeguards:

Human review: A suitably qualified person reviews material AI-assisted work before it is used or shared with a client.

Testing and approval: AI-assisted scripts, commands and proposed system changes are checked and tested before use. A suitably qualified team member approves any AI-assisted change before it is made to a client system. The usual client approval and change-control processes still apply.

Controlled access: AI tools are not given unattended access to make changes to client production systems.

Accuracy: We check technical guidance against appropriate sources and, where relevant, test it safely before use.

External information: We check material facts, prices and licensing terms against their original sources before publishing or relying on them.

Communications: A person reviews and edits AI-assisted content before it is sent to a client or published.

Decisions about people: We do not use AI to monitor, profile, score or rank client staff or to make decisions about individuals that have legal or similarly significant effects.

Client information: We do not sell client information or make it available for AI model training.

Security and professional advice: We do not use AI to bypass security controls or conduct security testing outside an agreed scope. We do not present AI output as professional legal, financial or regulatory advice.

8. Automated Processes and System Connections

Some AI tools can connect to other business systems or run repeatable tasks. We approve these uses before they are introduced. Where a process produces material for a client or could change a client system, the human review and approval requirements in How We Use AI Responsibly apply.

9. Data Protection and International Transfers

We avoid putting personal data into AI tools where it is not needed. Where an approved task requires it, we use only the information needed for that task.

When we process personal data on a client’s instructions, the Data Processing Agreement and that client’s DPA Execution Sheet govern the processing, including sub-processors and any applicable international transfers.

Our Privacy Policy explains how we handle personal data relating to our website, enquiries, job applications and business relationships. Before introducing a new AI use involving personal data, we consider the privacy risks and whether a formal assessment is needed. Our use of AI does not reduce anyone’s data-protection rights.

10. Security

We apply appropriate security controls when using approved AI tools, as part of our wider information-security arrangements.

AI tools are accessed through business accounts protected by multi-factor authentication. Access is limited to people who need it for their work and removed when it is no longer needed.

Passwords, API keys and other credentials are managed securely and must not be entered into AI prompts. AI-assisted changes to client systems remain subject to the human review and approval described in this policy.

We review the security of an AI tool before approving it for client work and when its features or our use of it materially change.

Security concerns about our services or use of AI can be reported to security@thisisit.uk.

11. Client Requests Concerning AI Use

Clients may ask us to restrict or exclude AI use in delivering their services. We will discuss whether the request can be accommodated and explain any effect on the services, timing or fees.

Any restriction we agree will be recorded in the Client’s DPA Execution Sheet and will apply from the date agreed in writing. Clients can contact ai@thisisit.uk to discuss a request.

12. AI and our Website

We may use AI to help prepare website content. A person reviews and edits that content before it is published.

Our website does not currently offer a visitor-facing AI chatbot or assistant. Information you send through the website is handled as explained in our Privacy Policy.

13. Questions, Corrections and Complaints

If you have a question or complaint about our use of AI or believe AI-assisted work concerning your systems or information is inaccurate, contact ai@thisisit.uk. A person will review your concern and respond. Where appropriate, we will correct the work or take other reasonable action.

To report a security concern, contact security@thisisit.uk. For a complaint about how we have handled your personal data, contact info@thisisit.uk. You can also complain to the Information Commissioner’s Office about how your personal data has been handled.

14. Review and Updates

We review this policy at least once a year and sooner if our AI tools, their terms, our services or relevant legal requirements materially change.

We publish the current version on our website. Changes that affect agreed client services are handled under the Changes to Services / Terms section of our Terms and Conditions. Changes to AI providers acting as sub-processors are handled under the Sub-Processors section of our Data Processing Agreement.

15. Document Control