• 4.1 Security by Design : AI services are designed and deployed using secure development practices, appropriate access controls and encrypted communications, consistent with the safeguards described in Section 6 (Data Protection).

• 4.2 Human Oversight : AI is intended to assist users and improve operational efficiency, not to replace human judgement. Business decisions affecting customers remain subject to appropriate human review where required, and a human-in-the-loop control point is available for higher-impact use cases. Users retain responsibility for validating AI-generated recommendations before acting on them.

• 4.3 Transparency : Customers and users are informed when they are interacting with an AI-powered system, and AI-generated content is distinguishable from human-generated content wherever practical.

• 4.4 Privacy : AI processes customer information in accordance with applicable contractual obligations and data protection requirements. Only the minimum data necessary for the intended purpose is processed, and sensitive information is processed only where authorised and appropriately protected.

• 4.5 Fairness : AI capabilities are designed to minimise unintended bias and provide consistent outcomes irrespective of gender, race, religion, nationality, age, disability or other protected characteristics. Where AI materially influences customer-facing outcomes, this is factored into the monitoring described in Section 8.

• 4.6 Reliability : AI functionality is monitored to maintain accuracy, resilience and operational effectiveness. Critical business processes include appropriate fallback mechanisms – such as routing to a human agent – in the event AI services become degraded or unavailable.

• 4.7 Accountability : Customer Experience Lab remains accountable for the governance of AI capabilities delivered within SparrowCX. Customers remain responsible for the business policies, workflows and operational decisions they implement using the platform. Section 5 sets out how this accountability is divided in more detail.

5. Roles and Responsibilities

Responsible use of AI within SparrowCX is a shared responsibility between Customer Experience Lab, customers, implementation partners and end users.

6. Acceptable Use

Customers may use SparrowCX AI capabilities for legitimate business purposes, including:

• Customer support
• Contact centre operations
• Knowledge management
• Workforce assistance
• Operational reporting
• Interaction sentiment capture

• Interaction summarisation
• Workflow automation

The platform must not be used for unlawful, fraudulent, discriminatory or harmful activities, including but not limited to:

• Generating deceptive or impersonating content intended to mislead customers or third parties
• Automated decisions that unlawfully discriminate against individuals or groups
• Circumventing consent, security or access controls
• Processing personal data beyond the purpose for which it was collected

7. Data Protection

SparrowCX supports secure handling of customer information through:

• Role-Based Access Control (RBAC)
• Encryption of data in transit using TLS
• Encryption of data at rest where supported by the deployment environment
• Secure API communication
• Audit logging
• Configurable data retention policies

Customer data is not used to train foundation AI models without the customer’s explicit agreement.

8. AI Risk Management

Customer Experience Lab maintains an ongoing AI risk management process that includes:

• Identification of AI-related risks
• Assessment of operational impact
• Monitoring of model performance
• Security assessments
• Continuous improvement based on customer feedback and operational experience

The AI governance programme is aligned with recognised industry practices, including the principles of ISO/IEC 42001 and the NIST AI Risk Management Framework.

9. Third-Party AI Services

Where SparrowCX integrates with third-party AI providers or Large Language Models (LLMs):

• Customer data is shared only as required to provide the requested functionality
• Third-party services are evaluated for security, privacy and contractual suitability
• Customers may configure or restrict the use of external AI services where supported by the deployment architecture

10. Incident Management and Escalation

If a user or customer identifies an AI output that appears inaccurate, unsafe, biased or otherwise inconsistent with this policy, it should be reported through [insert support channel / escalation contact]. Customer Experience Lab will assess reported incidents, take corrective action where warranted, and notify affected customers in line with contractual and regulatory obligations.

11. Monitoring and Continuous Improvement

AI capabilities are periodically reviewed to improve:

• Accuracy
• Reliability
• Security
• User experience
• Regulatory alignment

Feedback from customers and users is incorporated into the ongoing development of SparrowCX AI services.

12. Compliance

This policy supports alignment with recognised industry standards and regulatory frameworks, including:

• ISO/IEC 42001 (AI Management Systems)
• NIST AI Risk Management Framework (AI RMF)
• GDPR
• India’s Digital Personal Data Protection (DPDP) Act
• HIPAA (where applicable)
• PCI DSS (where applicable)

Alignment with these frameworks is subject to customer deployment architecture, operational controls and applicable contractual requirements.

13. Policy Exceptions

Requests for an exception to this policy must be submitted in writing with the business justification, scope, duration and compensating controls. Exceptions are reviewed and, where approved, are time-bound and subject to periodic re-assessment.

14. Governance

This policy is reviewed at least annually, and more frequently where required by evolving technology, regulatory change or industry best practice. Customer Experience Lab is committed to continually improving the governance, transparency and responsible use of AI across the SparrowCX platform.

14.1 Version History