Artificial Intelligence (AI) Usage Policy

Xirgo uses AI to support legitimate business operations, improve productivity, and raise the quality of the services we deliver to customers. Use of AI here is governed by clear principles: security, privacy, transparency, accountability, and human oversight. The tenets below set out what those principles mean in practice.

Human Accountability

People own the decisions, not the AI. A qualified employee reviews and signs off on AI-assisted work before it is used, submitted, or shared. AI output is never treated as final or authoritative on its own. This means customers can rely on the fact that AI does not make decisions about their service, contracts, or data unsupervised.

Protection of customer data and confidential information

We do not permit customer data, personal data, trade secrets, and third-party intellectual property to be entered into AI tools that are not contractually secured. Where we use AI tools, vendor terms ensure that data is not used to train the models. A data-classification framework governs what may be entered into which tool.

Approved tools and controlled access

Business AI use is limited to approved tools and environments. Each tool is reviewed for security, privacy, and suitability before use, and runs through a vendor-risk process. Personal and free-tier AI accounts are not permitted for business work. So, there is no shadow AI handling customer information.

Security aligned to recognized standards

Our AI controls are built on externally verifiable standards: ISO/IEC 27001:2022, ISO/IEC 42001:2023, and NCSC and CISA guidance. We apply appropriate technical and organisational controls to reduce data leakage, unauthorised access, and misuse, and we adapt them as threats change.

No AI-only decisions on material matters

Xirgo does not rely solely on AI for material business, financial, legal, or customer-impacting decisions. Those require human judgment, accountability, and sign-off.

Ethical, fair, and lawful use

AI must be used lawfully, fairly, and ethically. We prohibit uses that are misleading, discriminatory, harmful, or unlawful, and we work to minimise bias and avoid discriminatory outcomes.

Restrictions on malicious use

Xirgo prohibits using AI for malicious, deceptive, or security-compromising activity. That includes malware, phishing, impersonation, deepfakes, and unauthorised access attempts.

Legal and regulatory compliance

AI use complies with applicable law, including UK GDPR and the GDPR, reflects awareness of the EU AI Act, and takes account of the evolving U.S. legislative landscape, where AI is increasingly governed through state-level laws on issues such as transparency, privacy, and discrimination. We respect third-party intellectual property and copyright.

Transparency

Where AI has meaningfully contributed to external-facing work or a high-stakes decision, we are transparent about it, in line with applicable legal, contractual, and professional obligations. This does not extend to every AI-assisted sentence or internal note.

Continuous Review

Xirgo reviews its AI governance as technology, regulation, customer expectations, and security risks evolve, so these commitments stay current.