Use of Generative Artificial Intelligence (GenAI) policy

Published 2 February 2025

Purpose of this policy 

The purpose of this policy document is to provide a framework for the use of Generative Artificial Intelligence (GenAI). 

Copilot Chat is the Council's default GenAI tool. It is the only approved GenAI tool for processing personal or sensitive information. Other tools such as ChatGPT or Gemini may only be used for non-sensitive, public data.

GenAI tools are Large Language Model (LLM) tools such as:

  • OpenAIs
  • ChatGPT
  • Microsoft Copilot
  • other similar tools used by users

Users of GenAI under this policy include:

  • Council employees
  • contractors
  • developers
  • suppliers
  • temporary staff
  • consultants 
  • other third parties

This policy for Westmorland and Furness Council is designed to ensure that the use of GenAI is ethical, complies with all applicable laws, regulations, and council policies, and complements the council’s existing information and security policies. 

The global pace of development and application of GenAI is such that this policy will be in a constant state of development and will be reviewed quarterly and will likely be regularly refined. 

GenAI can create realistic, human-like text, images, code, and art based on vast amounts of (usually public) data it has been trained on. 

GenAI can: 

  • produce a range of useful outputs, like text, audio, images, video, and code
  • respond to natural language questions, so any employee can use it
  • understand several types and large amounts of unstructured data in varying formats

Introduction and context 

GenAI is increasingly used across industries around the world, including the public sector. It has the potential to improve how services are delivered.

Westmorland and Furness Council is technologically ambitious. We already use digital solutions to improve how we work, and GenAI is one of these technologies.

You should use Copilot Chat for Council GenAI work by default, unless ICT and the SIRO Group approve an exception. The rationale is enterprise-level security and Microsoft 365 integration.

Copilot Chat is our preferred GenAI tool because it provides enterprise-level security within our Microsoft environment.

We must use GenAI safely and appropriately. It has the potential to help us:

  • manage and use data
  • communicate with residents, service users and suppliers
  • provide support more efficiently

The development and use of GenAI has received significant attention from the media and security sector. This is particularly the case where problems with the technology have occurred.

All employees and elected Members must follow this policy when using GenAI. This is important because GenAI can create equality, security and data protection risks.

Anyone who uses or plans to use GenAI must:

  • read and understand this policy
  • follow its requirements
  • be open and transparent about how they use GenAI

Managers must know how GenAI is being used within their services. They must regularly discuss its use at service meetings.

We will review this policy every three months. Managers must understand any changes, communicate them to their teams and make sure they are followed.

This policy sets out the requirements employees must follow when using GenAI. This includes using a privacy by design approach to assess security risks and protect personal, confidential and sensitive data.

The policy applies to technology designed, developed or bought by Council officers. It covers AI tools including:

  • LLMs
  • Microsoft Copilot
  • OpenAI's ChatGPT
  • other generative AI services

The UK Government's approach to AI use and regulation is still developing. We will keep this policy under review while providing clear guidance about how employees can and cannot use AI.

We will update the policy when needed to reflect changes in:

  • national and global developments
  • legislation
  • UK Government policy

This policy supports our existing ICT, security and data protection policies. The Council's SIRO Group oversees these policies and is chaired by the Director of Enabler Services, the nominated Senior Information Risk Owner.

When using GenAI, employees must also follow existing Council requirements for:

  • information governance
  • data protection
  • development of ICT projects
  • ICT compliance and risk
  • equality impact assessments

The SIRO Group may ask GenAI users to provide updates on their use.

Compliance requirements

This policy applies to everyone at Westmorland and Furness Council. It applies when using GenAI for Council work on both Council-owned and personal devices.

To comply when using GenAI for Council work, you must:

  • use Copilot Chat by default
  • make sure the enterprise security shield is visible when using Copilot Chat
  • only use alternative GenAI tools where there is an approved and recorded business case
  • only enter personal or sensitive information into Copilot Chat
  • only use alternative GenAI tools with public, non-sensitive information
  • use GenAI fairly and avoid bias and discrimination
  • support the Council's goals and values

Only Copilot Chat can be used to process personal or sensitive information. Other GenAI tools must only be used with public, non-sensitive information.

You can only use GenAI for work purposes if you follow this policy. This includes creating content for:

  • reports
  • emails
  • presentations
  • images
  • customer service communications

When using GenAI, you must consider:

  • governance
  • copyright
  • accuracy
  • confidentiality
  • disclosure
  • how it works with existing tools

Alternative GenAI tools will only be added to the Council's White List where their use is supported by an approved and recorded business case.

If you have any concerns that using GenAI could create a data protection risk, do not use the tool. Contact the Service Manager, Digital Innovation or a member of the SIRO Group for guidance.

Governance

Requests to use alternative GenAI tools require formal approval and a Data Protection Impact Assessment (DPIA). Copilot Chat is the default GenAI tool for Council activities.

Do not enter personal or confidential information into a GenAI website, tool, or app that has not been supplied by the Council’s ICT team.

This DPIA is to understand the:

  • intention to use
  • reason for use
  • expected information to be input
  • generated output and distribution of content

Once this policy is adopted, anyone who wants to use other forms of AI must follow the processes set out in this policy.

You must request formal access through the:

  • ICT Project Management Office (PMO)
  • Data, Digital and Technology (DDaT) board

You must follow copyright law when using GenAI.

You must not use GenAI to create content that infringes another person's intellectual property rights. This includes copyrighted material.

For example, if you use GenAI to create a logo, it could produce something based on an existing copyrighted or trademarked logo.

If you are unsure whether your use of GenAI could infringe copyright, contact the Information Governance Team before using the tool.

Accuracy

Accurate information is essential for the Council. When using GenAI, you must:

  • be aware that GenAI can produce incorrect or made-up information
  • fact check all content produced by GenAI
  • review and, where needed, edit GenAI content before using or sharing it
  • take responsibility for the accuracy of any GenAI content you use or share
  • check and correct the information if you have any doubts about its accuracy

You are responsible for making sure GenAI-generated content is accurate before you use or publish it.

Confidentiality

Copilot Chat is approved to process sensitive and personally identifiable information on behalf of Westmorland and Furness Council.

You must not enter confidential, commercial or personal information into other public GenAI tools.

This is because the information could become publicly available. Entering this information into a public GenAI tool would be a data breach and must be reported to the Council's SIRO Group.

When using GenAI, you must:

  • follow all relevant data protection laws and Council policies
  • not use GenAI apps on personal, non-Council devices to record or summarise work meetings or provide translation services
  • not enter sensitive information into external or free GenAI tools downloaded to a personal device

Social impact and equality

GenAI can affect groups of people in different ways. It may contain bias or be trained on data that includes stereotypes.

When using GenAI, you must:

  • consider how its use could affect different groups of people
  • be aware of potential bias and stereotypes
  • not allow GenAI alone to decide who can access Council services
  • involve a professional in any automated or AI-informed decisions
  • make sure there is an appeals process for automated or AI-informed decisions

Ethical use

Data ethics means managing and using data responsibly. This is particularly important when handling commercial, personal or sensitive information.

Responsible use of data helps ensure our practices benefit society without compromising ethical standards.

When using GenAI, you must:

  • not create content that is discriminatory, offensive or inappropriate
  • consider whether using GenAI is appropriate for the task
  • speak to your manager if you are unsure
  • contact the Council's Information Governance Team or Data Protection Officer for advice if needed

Transparency and disclosure

You must make it clear when content has been created using GenAI.

Use a note such as: This content was created with the help of artificial intelligence (AI). The author has reviewed it for accuracy and made changes where needed. The author takes responsibility for the final content.

Risk management

Using GenAI involves risks. Everyone who uses GenAI is responsible for managing these risks.

GenAI may store sensitive data and information. This information could be at risk of a data breach or cyber attack.

You should complete a due diligence checklist for any work where you plan to use GenAI.

You should consider:

  • legal compliance
  • bias and discrimination
  • security, including technical protections and security certifications
  • data sovereignty
  • data protection

Before using a GenAI tool, the Council must assess its technical protections and security certifications.

If you are unsure whether a GenAI tool is appropriate, check with:

  • ICT
  • Digital Innovation
  • the Council’s Data Protection Officer

When using Copilot Chat, make sure you are within the Council’s Microsoft tenancy and that enterprise security is active.

When using GenAI, you must:

  • make sure you do not enter commercial, sensitive or personally identifiable information
  • check that GenAI-generated content does not contain bias or discriminatory language
  • not allow GenAI to make decisions about Council services
  • check all advice and information produced by GenAI

If you have any doubts about the security of information you plan to enter, do not use the GenAI tool.

Information you enter into GenAI may enter the public domain. This could:

  • release information that is not public
  • breach legal or regulatory requirements
  • breach customer or supplier contracts
  • compromise intellectual property rights

Sharing private or personal information without the owner's permission could breach data protection law.

When using GenAI, you must follow:

  • UK GDPR and data protection laws
  • relevant regulations
  • Council policies

If we buy or develop a GenAI product for internal use, we must consider whether confidential information can be entered into the tool. This will depend on the tool's terms of use.

You should seek advice from Legal Services about the terms of service and privacy policy for any GenAI tool being considered. This includes checking:

  • usage rights
  • ownership of outputs
  • any disclaimers

Intellectual property

A key consideration when using GenAI is who owns the information entered into the tool and the content it creates.

GenAI tools may be trained using data collected from sources such as websites, databases and files. This can create intellectual property issues.

When using GenAI, you must:

  • make sure your use complies with intellectual property laws and Council policies
  • consider whether information entered into a tool contains copyrighted material
  • check the terms of any GenAI tool before it is procured or used

Some suppliers may have terms that allow them to:

  • reuse information entered into their tools to improve their systems
  • retain ownership of content produced by their tools

These terms must not conflict with the Council's requirements for the ownership and control of its intellectual property.

If you need advice about intellectual property, contact Legal Services.

Policy compliance

You must report any breaches of this policy to:

  • the Council’s Information Governance Team
  • your line manager

If you do not follow this policy, you may face disciplinary action under the Council’s Human Resources and Data Protection policies and procedures.

Review and monitoring

We will review this policy every three months.

We will update it when necessary to make sure it continues to comply with relevant:

  • legislation
  • regulations
  • Council policies

Acknowledgement

By using GenAI, you confirm that you have read and understood this policy and the risks of using GenAI.

This policy is based on guidance prepared by:

  • the Society for Innovation Technology and Modernisation
  • the Local Government Association (LGA)

Queries and advice

For help accessing or using Copilot Chat, contact the ICT Service Desk.

For questions or advice, email the Artificial Intelligence team. Alternatively, you can contact Lynne Davidson, Service Manager of Digital Innovation.

Artificial Intelligence Team
Email: artificial.intelligence@westmorlandandfurness.gov.uk