Charter 01 · Responsible practice
Responsible use of AI
AI should expand people’s ability to understand and act. It must not weaken their rights, control over their data, or freedom to change technology.
This charter applies to AI use by adnap staff and contractors, and guides the AI systems we design, integrate or operate for clients. It complements applicable law and each client’s own policies.
Start with the need, not the model
Before adding AI, we state the problem, the expected benefit and how success will be measured. We compare it with simpler options: better documentation, conventional software, search, or a changed process. If AI adds no clear value, we do not add it.
Keep people accountable
AI output is a proposal, not an authority. A named person reviews material generated or recommended content before it is delivered, merged, published or used to make a consequential decision. We do not delegate employment, access-to-rights or other high-impact decisions to an automated system without a lawful, documented and appropriately supervised framework.
Protect data and confidentiality
We do not submit client secrets, credentials, personal data, source code or non-public documents to a public AI service unless the client has explicitly approved the use and the service has been assessed for that purpose. We minimize and, where possible, redact or pseudonymize inputs. Before deploying an AI system that processes personal data, we clarify roles, purpose, legal basis, retention, transfers and security measures with the client; we assess whether a DPIA is needed.
Choose for sovereignty and reversibility
We assess where data is hosted and accessed, applicable jurisdictions, provider ownership and dependencies, model and data portability, logging, retention, training use, and exit conditions. European hosting alone does not settle sovereignty. We document trade-offs and favor open standards, self-hosting or European providers where they meet the security, performance and support requirements. We preserve a viable fallback and avoid making a client’s essential capability depend on a single model or API.
Secure the whole chain
We review the provider, model, integrations, access controls and data flows before use. We apply least privilege, separate environments, keep secrets out of prompts, and treat retrieved content and model output as untrusted input. We test for prompt injection, data leakage, insecure tool calls and failure modes proportionate to the system’s exposure. Findings and incidents are recorded and escalated.
Check quality, fairness and rights
We test representative cases and known edge cases; check factual accuracy, bias, accessibility and security; and tell users when AI materially contributes to an interaction or deliverable. We respect intellectual property and licensing, do not present generated material as verified fact, and provide a way to challenge or correct consequential outputs.
Use resources deliberately
We consider whether AI is proportionate to the task, choose the smallest capable model, avoid unnecessary repeated inference and account for compute, energy and water impacts where information is available.
Operational safeguards
- Approved tools and use cases are recorded with their purpose, data classes, owner and review date.
- Staff receive practical guidance on limitations, confidentiality, verification and incident reporting.
- Client approval, contractual terms and security review are required before client data enters an AI service.
- AI-assisted code and content remain subject to normal peer review, testing, licensing checks and acceptance criteria.
- Every deployed system has a human owner, a monitoring approach, an incident path and a documented way to disable or replace it.
These safeguards are applied in proportion to the use case and made explicit during project scoping. The charter is reviewed at least annually and whenever law, risk or our practices materially change.
Reference frameworks
This charter draws on the CNIL’s guidance for AI and personal data, the EU AI Act, UNESCO’s Recommendation on the Ethics of AI, and ENISA’s work on AI cybersecurity.