ICT Institute Responsible AI Use Policy 2026

AI services, such as chatbots and agents can be used for many tasks such as answering questions, creating text and images, editing documents or creating documents. Using AI is, however, not always safe or appropriate and can lead to wrong answers, confusion and other problems. Therefore, ICT Institute has adopted in 2026 a new more restrictive AI policy that was designed to ensure human effort is used when the situation asks for it, and AI use is transparent and appropriate. This policy is mandatory for ICT Institute staff in all client and internal projects, and can be used by organisations if they want to.

AI use general principles

The following principles should be applied by any professional in their work. The rest of this policy is designed to clarify how to use these principles.

1. Be authentic. There are many situations where, as a consultant, expert, auditor or professional, you are asked for your perspective based on your experience. You cannot use AI for this. Use your own brain to determine your own perspective (it may be brief). You can use AI only as a tool to refine texts, but not for the first draft.
2. Be transparent. If you use AI outcomes or assistance in any of your work, make sure this is clear to the recipient. You may not pass off AI work as your own, or secretly use AI. You can use spell check or autocorrect if your editor has this since that is a normal and widely known use of common tools.
3. Do not share confidential information with untrusted AI service providers. All AI companies collect data that they use in large datasets and utilize further. Ensure that you do not share personal details, passwords, or names with AI.
4. Verify the outcomes. Many AI models generate answers that look good but are not necessarily correct. Also, the data used to create the AI ​​model may be outdated or contain errors. Therefore, always verify that the text you intend to use is accurate.
5. Respect artists and copyright. It is possible, but not permitted, to ask AI to imitate living artists or to create something derived from existing work. This is a violation of copyright. Therefore, pay close attention to what you ask of a model and whether the results do not resemble existing work too closely.

Experimenting with AI is allowed

Part of our work at ICT Institute is to understand technology. That is why we encourage everyone to experiment with AI services and tools, separate from client work. Curiosity is welcome: try new tools, explore what is possible, test the limits and share what you learn with colleagues.

So it is allowed to test and evaluate AI or do experiments on AI. You can do any experiment with AI services and tools as needed; just make sure that you do not misuse the results outside the context of the experiment.

Some practical guidelines:

• Experiment with your own material or publicly available information, never with client data or confidential documents. We have published several datasets such as the Utrecht Housing dataset, the Lego color dataset and the Fairness in recruitment dataset to provide other researchers with data they can use.
• Keep results within the experiment. If you later want to use an outcome in real work, the regular rules of this policy apply.
• Share what you learn, including what did not work. Failed experiments are often the most instructive. We share our research results in journals such as our computers and society research journals but also at other conferences such as BNAIC.

Note that we also have additional advice for responsible computer science and AI research, where we also explain how you avoid GDPR violations, privacy issues and ethical violations. This page is required for all student research.

Use of AI in expert reports

Court experts have a special role. When a court appoints an expert, it relies on that person’s own knowledge and judgement, and the parties in the case must be able to trust that the report is careful and independent. The Landelijk Register van Gerechtelijke Deskundigen (LRGD), the Dutch national register of court experts, has therefore published a guideline on the use of AI by court experts: the Richtlijn voor gebruik van AI-toepassingen door gerechtelijk deskundigen (7 April 2025). ICT Institute staff must follow this guideline for all expert reports related to court cases. The most important rules in this guideline are:

• AI supports, it never replaces. The expert is appointed in person. AI may support the work, but carrying out the entire investigation with AI is not allowed.
• Know your tools. Experts understand how the AI tools they use work, recognise the risks and follow the supplier’s terms and instructions.
• Protect confidentiality. Only use AI tools with sufficient confidentiality safeguards, or do not enter confidential data at all. Personal data may only be entered where privacy law allows it, and documents are preferably anonymised first.
• The expert remains responsible. Every AI result, including cited sources, is checked against the expert’s own knowledge. Experts specifically watch for hallucinations, invented sources and plagiarism.
• Be transparent. AI use is disclosed in the report, so that the court, lawyers and parties can assess it. This can include the tool and model used, the prompt, the result and how the expert used it.
• Evaluate periodically. AI tools change quickly, so experts regularly check whether their use still fits the guideline.

As you can see, these guidelines are similar to our principles.

Use of AI for audit reports

We do many audits, for instance for ISO 27001 certification. Audits revolve around transparency and are executed to generate meaningful insights and trust regarding certain processes. When we audit an organisation, clients rely on our professional judgement. This trust is built upon the notion that our findings are accurate and evidence-based on our experience and expertise. Thus, we cannot hand this process over to an AI tool, as the individual’s professionalism would no longer be in the loop. AI can play a role in supporting the audit process, but the auditor should remain fully responsible for every finding, conclusion and recommendation presented in the audit report.

When using AI for audit work, the following rules apply:

• Findings are based on verified evidence. Every finding must be traceable to evidence the auditor has reviewed personally, such as documents, records, observations or interviews. AI output is never audit evidence in itself.
• The auditor determines the results. AI can help summarise documents, structure notes or improve the wording of a report. Deciding whether something is a nonconformity, an observation or an opportunity for improvement is always the auditor’s own call.

Some companies use advanced software, such as Vanta or Notion, to support their ISMS or use AI to help write some policies. This is allowed and we can adjust the audit plan to make efficient use of software, but we still need to check the evidence in a real audit.

Use of AI in creating client documents and presentations

Clients hire us for our expertise and our view on their situation, so the substance of every report and presentation must come from us. AI can help with the form, but not with the content.

• Prepare your own presentations. Building a presentation is also preparing to give it. Working out the story and the slides yourself means you know the material and can answer questions. Letting AI build the presentation may leave you unprepared.
• Start each page with your own key message. Write your own first draft or outline, even if it is short. Use AI afterwards to sharpen the text, not to create the first version.
• Use AI only as a language assistant after a first draft. AI is well suited to checking spelling and grammar, improving structure and readability, or suggesting clearer phrasing, much like a regular spelling and grammar checker.
• Add sources to pages if sources are used, and check every source. AI can invent facts, figures and references that look convincing. Click on each link, check any claim if you add it to a slide.
• If you use AI output for a page, e.g. an illustration or chart made with AI, make this explicit on that page. Never present AI work without making it clear that it is AI or AI-enhanced.

Use of AI in generating images

AI image tools can create or modify images in seconds, which makes them useful for illustrations, mock-ups and visual ideas. They also raise questions about copyright, authenticity and privacy. When you use AI to generate or modify images, follow these rules:

• Respect artists and copyright. Do not ask AI to imitate living artists or to create something derived from existing work. Check that the result does not resemble an existing image, logo or character too closely.
• Be transparent. Make clear when an image is AI-generated or AI-modified, for example with a short caption or note. This should be on the actual page, since pages can be reused.
• Avoid realistic images of real people. Do not generate or modify images of real, identifiable people, such as colleagues or clients, without their consent. Realistic fake images can mislead and can harm someone’s reputation.
• Keep confidential material out. Do not upload screenshots, photos or documents containing client information or personal data to image tools without adequate safeguards.

Use of AI in software development

When creating or maintaining software you can use AI, but you should be careful that the code works as intended, does not contain malware and does not infringe on copyright.

To prevent this, you must follow these rules:

• Understand what you commit. Review AI-generated code before you use it. If you cannot explain what the code does, do not use it.
• Test thoroughly. Check that the code works as intended, including edge cases and error handling, and remove redundant or unclear code.
• Check dependencies. AI can suggest libraries that are outdated, vulnerable or do not exist at all. Attackers sometimes register such invented package names and fill them with malicious code. Only use dependencies you have verified.
• Keep secrets out of code. Do not enter passwords, API keys or other secrets into source code.
• Review for security and maintainability. Have AI-generated code reviewed like any other code, and make sure it is secure and maintainable, not just functional.

These rules are in line with existing software best practices, including the ISO 27001 controls for software development.  If your company develops software you should probably extend this policy and set up a controlled software development and testing pipeline where you integrate AI and AI-testing.

Further reading

If you are interested in responsible AI use, we also offer AI literacy training where we discuss AI risks.