Build a Responsible AI Policy

Part 4: Our Commitment to Comply with Legislation and Regulations

We are committed to the ethical, lawful and responsible development, deployment, procurement and use of AI. We will operate in accordance with the most comprehensive legislative and regulatory frameworks which are locally applicable.

We will align all relevant AI workstreams and processes with industry best practices and adhere to applicable laws and regulations. We will ensure that our AI -related activities comply with:

• UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, particularly relating to data processing, profiling, automated decision-making, and data subjects.

• Equality legislation, including but not limited to the Equality Act 2010 and the Northern Ireland Act 1998, ensuring that the use of AI and AI systems do not result in discriminatory outcomes based on protected characteristics (e.g., age, gender, religion, political opinion, disability, race, or sexual orientation).

• The Human Rights Act 1998 and the principles of the European Convention on Human Rights, particularly regarding the right to privacy, freedom from discriminations, and protections against decisions made without a clear, consistent, or justifiable rationale.

• The EU AI Act provisions, where applicable due to cross-border activities, services to EU-based clients, or data involving EU citizens.

• The Information Commissioner’s Office (ICO) guidance on AI, data ethics, and explainability.

AI Legislation

We recognised the unique position of Northern Ireland which is influenced by the United Kingdom principles for AI, and by the Windsor Framework which maintains the applicability of certain EU law in specific contexts. As such, we will ensure our AI systems development, AI adoption, or AI use will be reviewed for compliance with EU AI legislations.

We will not engage in, support, or permit any AI use cases that are prohibited under recognised AI legislation, including but not limited to the EU AI Act. In accordance with this, we will not use:

• AI systems that use subliminal techniques or purposefully manipulative methods to distort human behaviour and impair decision-making, resulting in significant harm.

• AI systems that exploit vulnerabilities due to age, disability, or specific social or economic situations to cause significant harm.

• AI systems that evaluate or classify individuals based on their social behaviour or personal characteristics, leading to unjustified or disproportionate treatment.

• AI systems used solely for predicting criminal offences based on profiling or assessing personality traits.

• AI systems that create or expand facial recognitions databases through untargeted scraping of images from the internet or CCTV footage.

• AI systems designed to infer emotions in workplaces and education settings, unless used for medical or safety reasons.

• AI systems that categorise individuals based on biometric data to infer sensitive characteristics such as race, political opinions, or sexual orientation.

• AI systems that use real-time biometric identification systems.

GDPR and Data Protection

The UK GDPR and the Data Protection Act 2018 set out the legal framework for processing personal data, ensuring that individuals’ rights are respected and protected.

We will uphold the principles and obligations of the UK GDPR and the Data Protection Act 2018 across all systems and processes. We will:

• Establish a lawful basis for processing: Ensure that all personal data processed by AI systems is supported by a lawful basis under Article 6 (e.g., consent, contract, legitimate interest), and, where applicable, a condition under Article 9 for special category data.

• Conduct Data Protection Impact Assessment (DPIAs): Where appropriate we will identify and assess risks associated with AI use, especially where processing is likely to result in a high risk to individuals (e.g., automated profiling, larger data processing operations). DPIAs will be completed before any high-risk AI deployment.

• Ensure data minimisation and purpose limitation: Use only data necessary to achieve clearly defined and legitimate objectives. Data must not be repurposed in a way that conflicts with the original purpose without a valid lawful basis.

• Provide meaningful transparency: Inform individuals about how and why AI system processes their data, particularly when AI is used for profiling or automated decision-making. Explanation must be concise, understandable and accessible.

• Enable data subject rights: Implement mechanisms for individuals to exercise their rights, including:

• The right to be informed about the use of AI.

• The right of access to their data and processing logic.

• The right to object to profiling or automated decisions.

• The right to human intervention and to contest decisions made solely by automated means.

• Record and demonstrate compliance: Maintain internal documentation of processing activities, lawful bases, and technical safeguards in line with accountability principles.

Equality Legislation & Human Rights

We recognise that AI has the potential to impact people’s lives. It is essential that AI is designed and deployed in ways that respect human dignity, uphold individual rights and prevent discriminatory or unjust outcomes.

We acknowledge our obligations under Equality and Human Rights legislation, and will embed equality, human rights and fairness into the core of our AI use and governance model by committing to the following actions:

• Design and using AI for non-discrimination: Ensure that AI systems are used and designed to avoid discriminatory outcomes or the reinforcement of social, racial, gender, or economic biases. This includes:

• Using diverse and representative datasets.

• Avoiding proxies that may indirectly encode bias (e.g., postcode as proxy for ethnicity or socio-economic status).

• Ensure explainability and contestability: AI decisions and processes must be:

• Transparent: Capable of being explained in human-understandable terms.

• Reviewable: Open to appeal or human challenge.

• Documented: With clear audit trails that record how decisions were made and on what basis.

• Monitor for disparate impact: We will proactively monitor for disparate impact regarding our use of AI (i.e., outcomes where one group is disproportionately disadvantaged) and take corrective actions where such effects are identified.

• Enable human oversight: All AI systems with the potential to affect rights or protected groups will be subject to human oversight throughout their lifecycle. Where appropriate this may include decision-making authority, redress mechanisms, and system audits.

We are committed to collecting and using only the data necessary for legitimate, clearly defined purposes. Data will not be used for unrelated objectives unless there are lawful grounds and appropriate consents.

• We commit to defining our reasons for using AI and for using any specific data which we use in or for our AI use cases. We commit to being able to explain these reasons and our data requirements in plain and accessible language.

• As we create an AI registry, we will commit to keeping this information stored alongside respective entries.

• We will maintain clear data governance frameworks within projects to document purposes, data flows, and retention periods, in line with data protection principles.

Data anonymisation and de-identification

• Where practical, personal data should be anonymised, pseudonymised, or de-identified before further processing or sharing. These techniques help reduce the risk of identifications while maintaining utility for AI development.

• Responsibility for data provisioning will typically rest with the data originator or any collaborating partner. Where internal teams perform data anonymisation, recognised methods will be used, and their effectiveness will be periodically evaluated considering emerging technologies such as AI-driven re-identification risks.

• We encourage the adoption of different privacy or synthetic data generation where anonymisation alone is insufficient for risk mitigation.

Personal data and designated safe spaces

Where personal data must be accessed or used by team members during AI development or use, this will occur within a clearly defined ‘safe space’.

• A safe space refers to an isolated or controlled environment in which the data is not used for model training, inference, or unintended secondary purpose beyond the agreed scope of use.

• This includes safeguards to prevent inadvertent data leakage, retention beyond necessity, or integration into broader datasets.

Our process of anonymisation is supported by risk assessment and documented evaluations of re-identification likelihood, particularly when data is to be shared externally or used for model training.

• For a table which outlines our standard scale for assessing the potential for re-identification from datasets, please refer to Appendix 2.

Retention periods may vary depending on several key factors, including:

• User expectations and consent: Where possible, we consider data subjects’ preferences regarding the duration of data retention, particularly where explicit consent has been provided for continued use or early deletion has been requested.

• Sensitivity of the data: Highly sensitive data, such as personal, confidential, or commercially critical information, may be subject to shorter retention periods and stricter deletion or access protocols.

• Availability of controls: Where technically feasible, we implement automated or manual data retention controls to ensure information is not retained longer than necessary.

• Legal and contractual obligations: Data may need to be retained to comply with applicable legislation, industry regulations, or contractual commitments with third parties.

• Business and operational requirements: Data may also be retained for a defined period if needed to maintain system integrity, support audits, ensure reproducibility of results and systems, or maintain business continuity.

We commit to review the data we hold to ensure that it remains accurate, relevant, and necessary. When data is no longer required, we will securely delete, anonymise, or otherwise dispose of it using methods that maintain confidentiality and prevent unauthorised access.

We do not retain data beyond the lifespan of the organisation, unless required by law, If the organisation ceases operations or is dissolved, all retained data will be securely and permanently deleted, unless a legal obligation requires otherwise.

In cases where the organisation merges with or is succeeded by another entity, data may be transferred to the successor only if:

• Our successor continues the original purposes for which the data was collected; and

• Our successor agrees to uphold equivalent or stronger data protection standards; and

• Affected individuals or organisations are informed of the transfer, and their data rights are respected.

Where data has been anonymised or aggregated such that it can no longer be linked to an individual or specific project, it may be retained indefinitely for purposes such as research, analysis, system improvement, and commercialisation.

For a table which outlines standard data retention periods, please refer to Appendix 1.

The data usage and retention provisions are intended to supplement existing organisational policies that govern the use of data with AI, data protection, and information governance. It does not replace or override any current frameworks already in effect.

• In the event of any conflict or inconsistency between this policy and other applicable organisational policies and procedures on the governance framework that offers the highest level of protection for the responsible and ethical use of AI shall take the precedence.

• This approach ensures alignment with the organisation’s commitment to accountability, transparency, and the protection of individuals, systems, and data in the deployment and use of AI technologies.

• In the event of any conflict or inconsistency between this policy and other applicable organisational policies and procedures on the governance framework that offers the highest level of protection for the responsible and ethical use of AI shall take the precedence.

• This approach ensures alignment with the organisation’s commitment to accountability, transparency, and the protection of individuals, systems, and data in the deployment and use of AI technologies.

Part 9: Our lines of responsibility for AI

We commit to creating and maintaining clear lines of responsibility for using AI. This helps us work responsibly and ethically. Each person or group involved in a project will understand their role, what they are responsible for, and who to contact when/if an issue arises.

We will organise our lines of responsibility into the following structure:

Level 1 – Primary points of contact

This is the main team working directly with AI on a particular use case or project. They will manage the day-to-day work with AI and are the first people to speak to about a project or use case.

We will make sure that people at this level:

• Are responsible for carrying out AI tasks

• Communicate regularly with teams, partners or users (where appropriate)

• Are available to solve common or routine problems

• Help support the AI operations every day

Level 2 – Escalation points of contact

A designated senior contact for cases where problems cannot be handled by the core team. This person will have the authority to make important or strategic decisions.

This point of escalation contact will:

• Address more serious or complex challenges

• Help resolve disagreements or risks that could affect the project

• Support alignment with the wider organisation and users

If you would like to add other contacts to your accountability structures, consider adding the following wording to your policy:

Level 1.5 – Other primary points of contact - supervisor

This level provides additional supervision and support to the main point of contact. This is used where there are multiple persons who may be looking after a project. Thie role must be assigned to check that the project is on the right path.

We will make sure that this person:

• Makes sure the project follows ethical, legal, and technical rules

• Supports where challenges are raised

• Ensures the project matches organisation AI values and AI purposes

Level 2 – Escalation points of contact

A designated senior contact for cases where problems cannot be handled by the core team. This person will have the authority to make important or strategic decisions.

This point of escalation contact will:

• Address more serious or complex challenges

• Help resolve disagreements or risks that could affect the project

• Support alignment with the wider organisation and users