Generative AI policy

1. Purpose and scope

Generative artificial intelligence (AI) tools are transforming the way we work. Informed and responsible use of AI has the potential to increase efficiency in the workplace, bringing opportunities to automate tasks, foster innovation, increase productivity, improve quality of outputs and reduce time spent on activities. With these benefits come potential risks, including data protection breaches, copyright issues, the protection of confidential information, ethical considerations and compliance with wider legal obligations. 

VisitScotland permits the informed and responsible use of authorised AI applications by the workforce in carrying out identified work-related activities. The terms of this policy must be complied with when using generative AI to carry out work-related activities. It applies to the use of generative AI both during and outside normal working hours and whether or not use of generative AI is on an individual’s own device or one of VisitScotland’s devices, and whether at home, in the office or from a remote working location, provided it is for work-related purposes, whether in relation to your particular role or otherwise. 

The purpose of this policy is to:

• set out our rules on the use of generative AI in the workplace and how it should be adopted to ensure we maximise the benefits of generative AI while minimising any risks or concerns
• set out expected behaviours that meet our values, to ensure everyone is responsible when accessing, interpreting, and acting on AI-generated outputs and
• serve as a reminder of the responsibilities covered by existing policies, which equally apply to generative AI tools. When you are using generative AI tools for work-related activities, it is imperative to ensure that you do so in a safe and responsible way, and in a manner that does not compromise the organisation or its reputation.

2. Policy statement and commitment

This area is developing at a fast pace, and it is not yet clear what the opportunities and implications around using generative AI tools will be.

VisitScotland is committed to supporting employees to learn and utilise new technology in a safe way, acknowledging the usage of AI tools will vary by role. The organisation is also committed to reviewing this policy regularly to take into account emerging developments and ensure that our workforce is able to use generative AI in a positive way to assist with their work. 

However, given the unknown data and privacy implications, we have written this policy in a way which requires staff to work with us to identify tools which can be used for specific work-related activities which can then be reviewed / approved before being added to a permitted list of applications to ensure we continue to remain compliant with data protection and other legislation. 

3. Roles and responsibilities

This policy applies to anyone working for VisitScotland. This includes employees, Board members, contractors, graduates and modern apprentices (collectively referred to in this policy as ‘workforce’). 

This policy should be read in conjunction with the IT Acceptable Use , Data Protection and Records Management, Information Security Policies, Mobile Device Standard and Acceptable Use of Personal Devices Standard.

You are expected to read and understand this policy as a condition of your employment. Breach of this policy may be a disciplinary matter. Serious or persistent breaches may constitute gross misconduct and result in dismissal. Details of the disciplinary procedure can be found in the Disciplinary Policy.

The policy does not form part of your contract of employment and we reserve the right to amend it at any time.

Questions about the content of this policy or suggestions for change should be reported to the AI Steering Group . If you are in doubt and require clarification on any matter, please submit a Halo request.

Before you can access a generative AI tool for work-related purposes you must first check the tool and use case have been approved. This information can be found on the AI Zone. If you are unsure, or you have a new request, please submit a Halo ticket for AI tool approval.

Raising concerns - anyone who has concerns over AI usage in the workplace that does not adhere to the Generative AI Policy should raise those concerns in the same way as for other issues – directly with their line manager or head of department, or through existing HR policies and procedures.

4. Summary

VisitScotland’s Generative Artificial intelligence (Generative AI) Policy is set out in detail within this document.

In summary, examples of use cases permitted include:

• Do ensure that any use of generative AI tools is carried out responsibly – remember existing IT and information security policies still apply. 
• Do review already approved tools before considering other gen AI tools.
• Do submit a request via Halo before using any generative AI tools.
• Do ask yourself the question, “would we be okay with this information being shared externally?”.
• Do use generative AI to make processes more efficient where appropriate – it’s perfectly fine to use AI prompts for idea generation, brainstorming or copywriting suggestions.
• Do use generative AI to refine your copy – want to sound more professional, or to be more concise? That’s fine, just ensure there is nothing sensitive or confidential in the text.
• Do fact-check for accuracy any specific mentions of locations, landmarks or other information that could be false / out of date, and the appropriateness of promoting.
• Do be open to emerging technologies and developing new skills – generative AI will transform how we work and brings exciting new opportunities.
• Do alert your line manager or head of department if you have concerns about how AI is being used in the workplace.

But...

• Do not share personal, sensitive, confidential, embargoed or proprietary data or information.
• Do not think generative AI tools are exempt from the existing IT Acceptable Use, Information Security and Data Protection policies. They are not.
• Do not integrate any AI tool into VisitScotland systems without express consent from IT.
• Do not use generative AI to record meetings (video, audio or use transcription services) on any platform without express consent from both IT and Legal teams.
• Do not use generative AI to carry out any task that has legal and/or financial consequences (for example to draft terms and conditions or other legal documents).
• Do not use generative AI to carry out any part of a grievance and/or disciplinary procedure (for example to decide a grievance outcome or appropriate disciplinary penalty).
• Do not use or publish any form of content that is 100% AI generated. Always fact-check information presented and re-write for VisitScotland brand guidelines and audiences.

What is acceptable and what is prohibited will depend on your job and the nature of the task that you are engaged in. If you are unsure about using generative AI for a task that you are undertaking, you should speak to your line manager, head of department or submit a Halo request for further advice.

5. Terminology

Terminology used in relation to generative AI can be confusing. AI is also a broad topic.

This policy focuses specifically on the use of generative AI tools. Examples of this include , but are not limited to, OpenAI ChatGPT & GPT-4, GPT-5, Google Bard, Bing AI ChatBot, DALL -E image generation, GitHub Co pilot for code generation.

We have set out are some common terms used when describing AI and what they mean:

• Generative AI - refers to a type of artificial intelligence which can be used to create new content (for example, text, code, images, videos or music - referred to as the output). The AI uses natural language processing (NLP) to interrogate extensive data sets.
• Large language models (LLMs) – LLMs are a type of generative AI that can generate human like text in response to a prompt. They use deep learning techniques and massive data volumes to generate a response.
• GPT – this is short for “generative pre-trained transformer”, which is a type of large language model (LLM) that uses deep learning to produce natural language texts based on information requested in the input. ChatGPT is an example of a GPT model which can be used to generate text. 
• Hallucination - LLMs can produce outputs which may initially appear to be believable but are in fact highly inaccurate or fabricated. This is known as a hallucination.
• Prompts  - these are the inputs or queries that a user provides to the generative AI tool to receive the required output. Prompts can be used by the generative AI tool to further train the LLM.

Please note: Generative AI is distinct from AI deployed within the enterprise -level platforms currently utilised and approved by the organisation, including IT, Finance and HR systems, where governance and controlled usage already exists.

6. General principles of using generative AI

The following principles apply when using generative AI for work -related activities:

• Transparency and explainability - understanding how, when, and for which purpose AI is being used.
• Accountability and responsibility - generative AI usage requires personal judgement. Individuals remain responsible for their own work and accountable for the quality of outputs they deliver.
• Fairness, bias and discrimination - generative AI tools should only be used with awareness and understanding of their limitations. It is your responsibility to review and evaluate AI outputs to minimise the risk of stereotyping, bias or discrimination.
• Safety and security - understanding the importance of protecting organisational data that is confidential, proprietary, or protected by regulation.
• Ethical use - generative AI should be used in ways that align with organisational and societal values. This includes respect for others, avoiding misuse, and ensuring AI is applied to enhance , not undermine, trust, inclusion, and integrity in communications and decision-making.

7. Use of generative AI at VisitScotland

The intention is for VisitScotland to allow access to certain publicly available generative AI applications, or APIs for work-related purposes.

By ‘work-related purposes’, we mean: subject matter and content research, facilitating ideation, generating early drafts, or providing inspiration. AI tools can also be helpful in refining documents, reports and copy drafting to make text more concise. Even if use is permitted, the fact that something is permissible does not mean it will necessarily be an appropriate use of an authorised AI tool. 

Use of embedded generative AI tools

Embedded generative AI allows people to use language - based prompts to ask questions about their organisation’s data, or for specific support on a task. Embedded generative AI tools provide straightforward user interfaces in products that people are already familiar with.

Copilot Chat is approved for use and available for all staff. This should be the default tool before considering other gen AI tools that provide similar functionality. A recorded training session is available. 

Use of public and paid-for generative AI applications or APIs

Before you can access a generative AI tool for work-related purposes you must first submit an AI Use Case approval request via Halo, where the request will be assessed as appropriate by IT, Data Protection, Legal and the AI Steering Group. 

If you are already using generative AI tools at work, you must check the tool and use case is on the approved list. If it is not, a request should be submitted via Halo before use of the tool continues.

This will ensure that appropriate scrutiny is provided by IT, DPO and Legal in relation to the proposed tool so that we:

• meet our data protection obligations; including by recording the purpose of processing activity and the legal basis for processing, defining the vendor and asset records; and applying Data Protection Impact Assessment (DPIA) screening questions and
• retain a list of all approved tools
• are aware of the terms and conditions upon which the AI tool is available
• can periodically review approved tools, as enhanced versions are released

Any issues from a legal, privacy or data protection perspective will be noted and if there are major concerns, you may be asked to consider using another tool . 

A list of permitted AI applications and the purpose they are used for across the organisation is available to view on the AI Zone. The list of authorised AI applications may be updated at any time. If you think there is any generative AI application that should or should not be on the permitted list, please submit a Halo request.

If a tool and use case appears on the list of permitted AI applications and tools, you must comply with the following:

Opt-out

Use of authorised AI applications is subject to you selecting the opt-out option before first use. This will prevent the data you enter into the prompt being used by the LLM to train itself. If the opt out selection is unclear, or is not available on the authorised AI application, please check with IT before use via the IT Service Desk.

Be secure

You must apply the same IT security best practices, including connection to the VPN, use of strong passwords, and no sharing of logins. The existing IT Acceptable Use Policy applies when using AI tools. If you are in doubt, always check with IT before use via the IT Service Desk.

VisitScotland data

Do not place sensitive organisational data, personal data or information that is confidential, embargoed, proprietary, or protected by regulation, into external generative AI tools.

Ensure such data is not entered into the application as a prompt. Do not include references to organisations, partners, businesses or individuals. 

You should be aware that the content that you input into a generative AI tool may be used to train its model and could form part of the responses to questions posed by other users.

Data protection

Ensure that personal data and sensitive personal data is not entered into the application as a prompt, as this would breach our Data Protection Policy, as well as data protection legislation. Employees are responsible for adhering to the existing Data Protection Policy applies when using generative AI tools.

Legal and ethical

Reliance on purely AI generated outputs brings risks around legal challenges in relation to copyright, trademark infringement and plagiarism.

When you receive a response from an AI-powered chatbot, you are not always provided with information about where that data has come from. For this reason, it may inadvertently include copyrighted works. There can be significant legal consequences for copyright infringement.

To minimise the risk of copyright infringement, you are prohibited from copying, reproducing and / or distributing entire or substantial parts of generative AI outputs.

You should also be aware of any intellectual property rights owned by third parties, such as copyright, database rights or trademark rights in relation to content which is entered into AI applications as a prompt. You must abide by any relevant licensing conditions regarding intellectual property rights in the authorised AI application's terms of use and ensure that third party proprietary data or material is not entered into the application as a prompt without the third party's permission. For example, this includes ensuring that all or any substantial part of any copyright work owned by a third party is not inputted into the application as a prompt without the third party's consent.

Do not prompt AI platforms to ‘write in the style of…’ other brands or individuals, which may introduce legal, ethical and reputational risks around ownership from too closely emulating others. It is important to retain VisitScotland’s own brand voice and identity.

Authentic imagery of Scotland is one of our greatest destination marketing assets, and we do not use AI generated or overly enhanced images or videos to represent Scotland. We may use audio and video editing tools for minor edits to improve experiences for audiences, such as removing unwanted background noise or distractions in shots. All audio or visual content sourced should utilise VisitScotland Asset Library or adhere to existing VisitScotland Content License process. Any exceptional use cases should be approved by your Head of Department.

AI generated outputs are also prone to bias due to the data that they are trained on and output from these tools may be unfair to certain groups of people.

Procurement

Any paid subscriptions or licences involving Gen AI should be submitted via the Halo process for awareness and assessment, prior to procurement. This relates to AI tools in broadest sense including, but not limited to, generation of editorial copy, imagery and illustration, audio, text-to-video / audio, design, coding or chatbots.

Discriminatory language

Never input offensive, discriminatory, or inappropriate content as a prompt. You must remember the principles set out within our Equal Opportunities Policy as well as our Public Sector Equality Duty. You must not generate content to impersonate, bully, or harass another person, or to generate explicit or offensive content.

If you are using output from any of these tools in your work, you must ensure that you address and correct any bias and comply with the organisation's Equal Opportunities Policy at all times.

Accuracy and concern for quality

Generative AI tools can make a useful contribution, but are not a replacement for the expertise, skills and knowledge of our people. 

You must fact-check and verify any generated content, prior to relying on it, using more credible sources.

AI-assisted content to be published or shared externally must be adapted to existing VisitScotland content guidelines and ensure alignment to strategic messaging.

AI tools will not have the same insight and understanding of organisational objectives or end user requirements, so it is important that focus is retained in content development. AI-assisted content is subject to the existing content standards and workflows, and should be checked for accuracy, bias, readability, accessibility and inclusivity. 

As AI-generated and human-written content merges, to retain brand reputation, VisitScotland’s editorial content should maintain a concern for quality, and demonstrate experience, expertise,  authoritativeness, and trustworthiness.

8. Personal use of generative AI

This policy applies to use of AI on any VisitScotland devices and on personal phones, where they are being used for a work purpose.

Many VisitScotland employees will already be using AI outside of the workplace. When you are not at work, it is, of course, entirely up to you to decide whether and how you choose to use AI on your own devices.

Always check the privacy policy before use, to understand how information you input will be used.

Be mindful of the personal, private, or sensitive information you disclose and share with AI tools .

9. Monitoring and review

The use of generative AI is evolving rapidly, and this policy will be reviewed regularly, every six months initially or at such time that a significant change is made to legislation, regulations, or business practices. 

10. Appendix - glossary