Responsible Use AI Principles

1. Introduction

In these Principles, “LS Law”, “we”, “us” and “our” refer to LS Law Holdings Limited and each of its group companies from time to time, including LS Law Limited and LS Law Consultants Limited (together, the “LS Law Group”). These Principles apply across the whole of the LS Law Group. Our consultants are engaged by LS Law Consultants Limited, and references in these Principles to consultants being engaged by, providing services to or for, or giving confirmations to, LS Law are to LS Law Consultants Limited and, where relevant, the wider LS Law Group.

LS Law recognises the potential of artificial intelligence (AI) to transform the way we work and improve the services we provide. We are committed to ensuring we use AI in a secure and responsible way, respecting privacy, confidentiality and third-party rights. This includes any AI used by third parties on our behalf. 

What do we mean by Artificial Intelligence?  Generally, we use the term ‘artificial intelligence’ to describe machine-based systems which infer solutions to set tasks and have a degree of autonomy, and includes any machine-driven insights derived from the use of such systems. AI is evolving continually, and at unprecedented speed and scale. We constantly monitor the way in which we are using AI, and these Principles will develop over time, based on internal and external feedback as well as industry and legislative trends.

2. AI Guiding Principles

As part of our responsible AI approach, we:

• Consider the real-world impact of any AI that we may use or develop;

• Take action to prevent the creation or reinforcement of unfair bias;

• Create accountability through human oversight; and

• Respect privacy and champion robust data governance.

3. Fairness 

Fairness and non-discrimination are at the core of our business philosophy and value. We understand that mathematical, statistical, or data accuracy does not guarantee freedom from bias. We use an approved suite of AI tools, which are monitored with human over-sight to ensure as far as possible data inputs and outputs which create unfair bias, or lead to unfavourable outcomes for individuals or groups based on gender, ethnicity, marital status, disability, age, religion or other personal attributes are not created or perpetuated as the AI systems we use develop, or which produces results that, while not necessarily discriminatory, are nevertheless skewed and therefore not accurate. 

4. Real World Impact, Transparency, & Accountability

Before implementing any AI tools, we will 

• Evaluate an AI system’s reliability and are explicit about its intended use. Where AI tools are used in our services and internal processes, we will inform our clients, consultants and suppliers and relevant third parties as appropriate to ensure transparency in where and how we are using AI. 

• Identify stakeholders beyond direct customers or employees and think about whether people’s health, livelihood (including career prospects) or rights are affected in anyway ensuring we only use trustworthy AI tools and systems in line with our company values before implementing the use of any AI tools. 

When using any AI Tools, it is important that humans are accountable for its development, use, and outputs. We have an appropriate level of human oversight throughout the life cycle of any project or process that may involve AI. 

We only use a defined suite of AI tools and systems which are subject to an agreed set of terms and conditions, as well as applicable law, and we hold our suppliers accountable to these requirements. This supports ongoing, robust quality assurance of the output of any AI.

5. Data Governance

Strong data governance is essential, and robust data management and security policies and procedures critical. We are committed to handling personal data in accordance with all applicable data protection laws and regulations as well as our own Privacy Policy, which requires that we always act as responsible stewards of personal data, and we will not input personal data into any AI tools unless absolutely necessary, and never into any Open AI Tool. 

Approved AI Tools

LS Law maintains an approved suite of AI tools and systems. This comprises: (a) AI tools that we use directly to perform and deliver our services, namely Wordsmith and ChatGPT (used under a paid enterprise subscription which provides enhanced data protection, security and confidentiality safeguards, and under which inputs are not used to train the underlying AI models); and (b) back-office and business support software that incorporates AI functionality, namely HubSpot, Ashby, Clockify, Xero, Monday.com and the Microsoft 365 suite of tools. Only the AI tools and systems listed in this section are approved for use in connection with LS Law's business. This list will be reviewed and updated by LS Law from time to time as our use of AI evolves. Because our consultants are engaged on an independent basis and use their own systems, we recognise that consultants may need to use AI tools or systems that are not part of the approved suite. A consultant may use such a non-approved tool in connection with LS Law's business only where (a) the tool provides Sufficient Data Security (as described in the section headed "Data Security for Non-Approved Tools" below); and (b) the consultant has first given LS Law a signed declaration to that effect in the form we require. LS Law may refuse or withdraw its acceptance of any non-approved tool, and require the consultant to stop using it, at any time.

Data Security for Non-Approved Tools

Where a consultant uses an AI tool or system that is not part of our approved suite, the consultant must be reasonably satisfied, and must confirm to LS Law in a signed declaration, that the tool provides a level of data security that is sufficient having regard to the nature of the information involved and the requirements of applicable data protection law. For these purposes, an AI tool or system is likely to provide “Sufficient Data Security” where, as a minimum: (a) personal data and confidential information are encrypted both in transit and at rest using up-to-date, industry-standard encryption; (b) access to the tool and to the information within it is restricted to authorised users through strong authentication (including multi-factor authentication) and appropriate role-based access controls; (c) the tool preserves the confidentiality, integrity, availability and resilience of the information processed, including the ability to restore access following an incident, and the provider regularly tests the effectiveness of its security measures; (d) the provider’s terms confirm that information entered into the tool is kept confidential and is not used to train the underlying AI models or otherwise disclosed to, or reused by, third parties; (e) the tool is used under a paid business or enterprise subscription (rather than a free or consumer tier) where that is necessary to obtain these protections; (f) the provider is bound by written terms requiring it to implement appropriate technical and organisational security measures and, where it processes personal data on the consultant’s or LS Law’s behalf, by data-processing terms that meet the requirements of applicable data protection law; (g) where personal data is stored or accessed outside the United Kingdom, an appropriate international transfer safeguard is in place (such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment); and (h) the provider offers appropriate data retention, deletion and breach-notification controls and, where available, holds recognised security accreditations (such as ISO 27001, SOC 2 or Cyber Essentials). These are the minimum indicators only. The level of security that is “sufficient” must always be appropriate to the risk, and the more sensitive or confidential the information, the higher the standard required. A consultant must not input personal data, confidential client information or legally privileged material into any non-approved tool that does not meet this standard and must never input personal data into any free or open, consumer-grade AI tool. If a consultant is in any doubt, they must contact LS Law before using the tool.

Higher-risk tools require prior approval. Notwithstanding the above, a signed declaration alone is not sufficient where a consultant intends to input into a non-approved tool (a) any client personal data (including, in particular, special category personal data or criminal offence data, as defined in data protection law); or (b) legally privileged or other highly confidential client information. In those cases, the consultant must obtain LS Law's prior written approval before using the tool. LS Law's General Counsel (or their nominee) is responsible for reviewing signed data-security declarations and requests to use non-approved tools and will aim to respond within 10 working days of receiving a complete declaration or request. LS Law may also audit or spot-check any non-approved tool, and the basis on which a consultant has confirmed that it provides Sufficient Data Security, at any time.

Consultant Confirmation and Compliance

All consultants engaged by LS Law must comply with these Responsible Use AI Principles at all times. Before using any AI tool or system in connection with any work carried out for, or on behalf of, LS Law, and thereafter on at least an annual basis (and at such other times as LS Law may reasonably require), each consultant must:

• confirm to LS Law in writing the identity of each AI tool or system they are using, or intend to use, in connection with LS Law's business or the services they provide to us;

• confirm that each such AI tool or system either forms part of LS Law's approved suite of AI tools or, if it does not, provides Sufficient Data Security and is covered by a signed data-security declaration given in accordance with the section headed "Data Security for Non-Approved Tools";

• confirm that they have read, understood and agree to comply with these Principles and any related LS Law policies governing the use of AI, data protection and confidentiality;

• confirm that their use of AI tools and systems complies with all laws and regulations applicable in the country or countries in which they are based or from which they provide services to LS Law; and

• promptly notify LS Law of any change to the AI tools or systems they use and provide an updated confirmation whenever these Principles are amended or whenever LS Law otherwise requests.

Consultants must not use any AI tool or system in connection with LS Law's business unless it forms part of the approved suite or the consultant has given LS Law a signed data-security declaration for it in accordance with these Principles. Failure to comply with this section may result in the suspension or termination of the consultant's engagement.

Compliance with Local Laws

Our consultants are engaged in, and provide services from a number of different countries. Each consultant is responsible for ensuring that their use of AI tools and systems in connection with LS Law's business complies not only with these Principles but also with all laws and regulations applicable in the country or countries in which they are based or from which they operate. This includes, in particular, local data protection, privacy, confidentiality, intellectual property and AI-specific laws and regulations, which may differ from, or impose stricter or additional requirements than, those applicable in the United Kingdom (for example, the EU General Data Protection Regulation and the EU AI Act, where these apply). Where local requirements conflict with these Principles, or impose a higher standard, consultants must comply with the higher standard and must notify LS Law promptly of any such conflict or additional requirement so that we can agree an appropriate approach together. If a consultant is in any doubt as to how local laws apply to their use of AI, they must contact LS Law before using the relevant AI tool or system.

Further information

If you require any further information, or you have concerns regarding our use of AI, please contact us via info@lslawservices.com