Artificial Intelligence Usage Policy
We reviewed Harborview Analytics' published Code of Business Conduct and Ethics and did not find a section addressing AI tool use. This draft is written to stand alone or to be incorporated into that document.
1. Purpose and Scope
Harborview Analytics, Inc. ("Harborview" or "the Company") develops and sells B2B data analytics software to enterprise customers across financial services, healthcare, and technology sectors. Our employees regularly work with client data, proprietary algorithms, unreleased product roadmaps, and material nonpublic financial information. Generative AI tools offer genuine productivity benefits across sales, engineering, customer success, and finance functions — and the Company intends to enable their use thoughtfully, not to prohibit them.
This policy establishes the rules under which Harborview employees, contractors, and agents ("Covered Persons") may use generative AI tools in connection with Company work. Its goal is to make safe, confident AI use the default — not to create compliance friction that causes employees to work around it.
This policy covers all use of generative AI tools when conducting Company business, including use on personal devices.
2. Definitions
- Generative AI tool — any software that uses a large language model or similar foundation model to generate text, code, images, or other content in response to prompts. This includes but is not limited to AI assistants, AI-powered coding tools, AI writing aids, and AI-powered search tools.
- Approved tool — a generative AI tool that the Company has reviewed and added to the Approved Tool List maintained by the Policy Owner (see Section 8).
- Confidential information — any non-public information relating to Harborview's business, including customer data, customer lists, contract terms, unreleased product features, source code, financial projections, personnel matters, strategic plans, and information subject to nondisclosure agreements.
- MNPI (material nonpublic information) — information about Harborview that is both (a) material (meaning a reasonable investor would consider it important in making an investment decision) and (b) not yet publicly disclosed. Examples include earnings results before public announcement, major contract wins or losses, M&A discussions, and significant product launches not yet announced.
- Personal or consumer account — an account with a generative AI provider held by an individual in their personal capacity, as distinct from an enterprise or business account managed and contracted by Harborview.
3. Approved Tools
Covered Persons may use generative AI tools for Company work only if the tool appears on the Approved Tool List. The table below shows what a populated Approved Tool List looks like for Harborview — your version would reflect your actual tool stack after procurement and legal review.
| Tool | Account type required | Cleared for | Not cleared for |
|---|---|---|---|
| Claude for Work claude.ai |
Harborview Teams plan Company-managed; personal accounts not permitted for work use |
Drafting and editing, summarization, research on publicly available data, internal documentation, writing assistance, general Q&A | Customer PII or client data sets, MNPI, proprietary algorithm details, source code containing trade secrets, contract terms under NDA |
| GitHub Copilot GitHub Enterprise Copilot |
GitHub Enterprise Copilot license Assigned through IT; personal GitHub accounts not permitted |
Code completion, code review, test generation, inline documentation for internal repositories | Prompts containing customer data, proprietary algorithms marked confidential, credentials or API keys, MNPI-related business logic |
| Microsoft 365 Copilot M365 Copilot add-on |
IT-managed M365 E3/E5 with Copilot license Must be accessed through company tenant only |
Drafting emails and documents from internal content, meeting recaps in Teams, summarizing internal documents, non-confidential spreadsheet analysis | Documents or emails containing MNPI, customer contract terms, client data, anything subject to active blackout period |
Until a tool is added to the Approved Tool List, it may not be used for Company work. If you want to use a tool that is not yet on the list, follow the process in Section 6.
4. Data Rules
4.1 General rule
Covered Persons may not enter Confidential Information into any generative AI tool other than an Approved Tool. This prohibition applies regardless of whether the tool is accessed through a browser, app, API, or integration with another product (e.g., an AI writing assistant embedded in an email client or document editor).
Because Harborview's work regularly involves customer data, proprietary analytics models, and enterprise contract terms — all of which are Confidential Information — this means employees should assume the restriction applies unless the tool is on the Approved Tool List. When in doubt, do not paste.
This restriction does not prevent using AI tools for tasks that involve only non-confidential content (e.g., drafting a generic onboarding email, generating sample SQL for internal training, or summarizing a publicly available earnings call transcript).
4.2 MNPI handling
Because Harborview is a publicly traded company (Nasdaq: HVAN), certain employees will have access to MNPI in the ordinary course of their work. The handling of MNPI through AI tools presents distinct legal risk under securities law, separate from general confidentiality concerns.
The following presents two approaches to MNPI in AI tools. Harborview's leadership — in consultation with outside securities counsel — must choose one before this policy is adopted. Do not treat either option as selected until that decision is made and documented.
Option A — Default prohibited (stricter): No Covered Person may enter MNPI into any generative AI tool, regardless of whether it is on the Approved Tool List. This is the more conservative position and requires no ongoing judgment calls about what qualifies as MNPI.
Option B — Tiered with named sign-off (more permissive): Entry of MNPI into an Approved Tool requires advance written approval from the CFO or General Counsel (or their designees). Approval is documented in [designated system] and specifies the nature of the MNPI, the tool, and the business purpose. Routine financial data (e.g., current-quarter actuals being used in an internal model) may be treated differently from high-sensitivity MNPI (e.g., preliminary earnings, M&A terms, or undisclosed regulatory matters).
This section should be reviewed by securities counsel before adoption.
5. Reviewing AI Output
Generative AI tools produce plausible-sounding output that may be factually wrong, legally problematic, or inappropriate for the intended use. Before relying on AI-assisted work, a Covered Person must review it for accuracy, completeness, and fitness for purpose.
Specifically, AI-assisted work may not be:
- sent to a customer, prospect, partner, or outside counsel without human review;
- included in a public filing, press release, or investor communication without human review;
- used as the basis for a business, legal, or financial decision without human review; or
- submitted as original work when the context requires disclosure of AI assistance.
"Review" means an actual check for accuracy and appropriateness by a person who understands the subject matter — not simply reading the output once before forwarding it.
6. Requesting a New Tool
If you want to use a generative AI tool that is not on the Approved Tool List, bring the request to the Policy Owner before using the tool. Requests should include:
- the name of the tool and the provider;
- the intended use case; and
- whether you anticipate entering any Confidential Information or MNPI.
The Policy Owner will assess the request and respond within [X] business days. Using an unapproved tool while a request is pending is not permitted.
This is not intended to be a slow or difficult process. The goal is to build a list that reflects how people actually work — not to create a backlog of unanswered requests.
7. Reporting an Incident
If you become aware that Confidential Information or MNPI has been entered into an unapproved tool, or that approved-tool rules have been violated, you must report it to the Policy Owner within the same business day. Reports may also be made to [designated contact / ethics hotline].
Employees who report an incident in good faith will not face adverse consequences for the report itself. Harborview does not retaliate against good-faith reporters.
The Policy Owner will assess each report and escalate to legal counsel, the CFO, or the Board as the circumstances require.
8. Governance
- Policy Owner: [Name / Title] is responsible for maintaining the Approved Tool List, processing tool requests, receiving incident reports, and serving as the first point of contact for questions about this policy.
- Review cadence: This policy will be reviewed at least annually, or sooner if there are material changes in the Company's AI tool usage, a significant security or compliance incident, or new regulatory guidance.
- Acknowledgment: Covered Persons will be asked to acknowledge this policy at [onboarding / annual certification / next all-hands]. Acknowledgment records will be maintained by [HR / Legal].
- Securities counsel review: Section 4.2 of this policy addresses MNPI handling and should be reviewed and approved by outside securities counsel before the policy is adopted or distributed.
This is a draft for internal review. It is not legal advice. Harborview Analytics should have this policy reviewed by qualified legal counsel — including securities counsel for Section 4.2 — before adoption.
Ready for a draft built on your actual company?
The example above follows the same structure your policy would — but yours would be researched against your company's actual filings, governance documents, and industry context. In about a minute, you'll have a real starting point.
- Personalized to your company name, ticker, and industry
- Checked against your existing Code of Conduct for gaps
- MNPI section included if you're publicly traded
- PDF and .txt ready to share with your team or counsel