This statement describes how Superfast IT uses artificial intelligence (AI) in delivering its managed services. It supports our Master Services Agreement and Data Processing Agreement, and matches our internal Artificial Intelligence Policy (version 2.0).

1. Purpose

We use AI to work faster and more thoroughly, without putting client data, client systems or our reputation at risk. This statement explains where we use AI, what happens to client data, and the controls we apply.

2. How we use AI

Our staff use AI for drafting, summarising tickets and documents, research, writing internal scripts, and triaging alerts with the AI built into our security tools.

We also run AI agents: AI tools with delegated access that carry out tasks without a person directing each step. The rules for them are:

• A named person approves before an agent changes a client system or sends anything outside Superfast IT.
• Agents never hold write access to client tenants. An agent that reads a client tenant uses its own identity where the service allows it and needs Managing Director approval.
• Rule-based automation, such as creating a new user, keeps its write access to client tenants. Where an AI step decides what change to make, a person approves it before it runs.
• Every agent has an owner who checks its results and can stop it.

3. Client data and AI

Client data only goes into AI tools on our approved list, used with company-managed accounts and the vendor's business-grade controls. It never goes into free consumer AI tools, and we never allow a vendor to train its models on client data.

Approved tools are used with client data for everyday work, such as summarising a ticket or drafting a report. Any bulk or new use of your data, such as analysing your logs outside the vendor's built-in tooling, needs your written agreement first. If personal data is involved, we complete a Data Protection Impact Assessment before starting.

If you have your own AI policy, we follow whichever is stricter.

Microsoft 365 Copilot, where you license it and use it within your own Microsoft 365 tenant, processes your data under your own Microsoft licence terms. We do not enable Copilot for you without your consent and an assessment of fit.

4. Approved AI tools

We keep an internal Approved AI Tools List. Our Technical Director assesses every AI tool before use, including how the vendor handles data and whether it trains on it. Our Managing Director also signs off any tool that will process client data. Where a tool stores personal data outside the UK, a transfer risk assessment applies.

The categories of AI we use are:

• AI assistants for staff productivity, on paid business tiers with company-managed accounts and model training switched off
• Microsoft 365 Copilot within our own tenant