Artificial Intelligence Acceptable Use Policy

Artificial Intelligence Acceptable Use Policy

1.0 Purpose

Publicly available applications driven by Artificial Intelligence (“AI”), such as chatbots (ChatGPT, Google’s Gemini, Microsoft Copilot) or image and video generators are impressive and widely popular, but while these content-generating tools may offer attractive opportunities to streamline work functions and increase our efficiency, they come with serious security, accuracy, and intellectual property risks. Generative AI applications include a wide array of tools that can put AI in both the foreground and background of the service (MCP servers which facilitate agentic connections between platforms, web browsers like Dia Atlas & Comet which have AI ‘companion’ features that run on pages you view, terminal applications that give AI LLM’s access to your local files, and so on).

Voyages Encore Travel Inc. ("Encore") maintains an Artificial Intelligence Acceptable Use Policy (the “Policy”) highlights the unique issues raised by AI, helps employees understand the guidelines for its acceptable use, and protects Encore’s confidential or sensitive information, trade secrets, intellectual property, workplace culture, commitment to diversity, and brand.

2.0 Scope

This policy applies to the use of any third-party or publicly available AI tools and other similar applications that mimic human intelligence to generate answers, work products, or perform certain tasks.
This Policy applies to all company employees. The terms of this Policy are in addition to the Acceptable Use Policy.

3.0 Roles and Responsibilities

3.0.1 All Employees

  • Read, Understand, and Comply with this policy.
  • Any questions related to this policy can be directed to the Service Desk.

3.0.2 Director of IT

  • Approve and enforce compliance with this policy.

  • Answer all questions or comments related to this policy.

3.0.3 Cyber Security Analyst

  • Manage and review this policy at least annually.

  • Collect evidence as required.

4.0 Policy

  • Understand that AI may be useful but are not a substitute for human judgment and creativity.

  • Understand that many AI is prone to “hallucinations,” false answers or information, or information that is stale, and therefore responses must always be carefully verified by a human.

  • Immediately inform the Service Desk (servicedesk.encore.ca) when you have used a non-approved AI tool to help perform a task.

4.1 Allowable Use

  • Only AI tools which have been approved by the IT team are permitted. Refer to the list of approved AI tools for the up-to-date list of tools that are vetted and permitted for use. If you have an AI tool that you’d like to use (free and open source, internally built, procured and paid for, etc.), please get in touch with the Service Desk to get an approval and if approved, the list of approved AI tools will be updated accordingly.

  • Verify that any response from a AI tool that you intend to rely on or use is accurate, appropriate, not biased, not a violation of any other individual or entity’s intellectual property or privacy, and consistent with Encore’s policies and applicable laws.

  • In all cases, use should be consistent with the Acceptable Use Policy.

4.2 Prohibited Use

  • Use of AI which does not have an IT approval cannot use any personal, confidential, proprietary, or otherwise sensitive information.

  • Use of AI cannot use any PII: this would include but not be limited to individual’s names, addresses, email addresses, credit card information, telephone numbers. It must also exclude any travel data that has not been anonymized to prevent it from being directly or indirectly linked to a client.

    • Example 1: if client information is contained in a spreadsheet or other dataset, any columns or fields that include PII or non‑anonymized travel details must be removed or replaced with anonymized or aggregated values before the data is used in any AI process.

    • Example 2: instead of using a record such as “Client 12345’s trip from London to Paris on 3 March at 08:00 on Flight AB123,” the data should be anonymized or aggregated. This could mean storing information as “a client trip from London to Paris in early March” or “30 client trips between London and Paris during March,” ensuring that no travel information can reasonably identify or be traced back to a specific client.

  • Do not use AI-generated content that includes or imitates copyrighted material. AI may not be used for any activity that would be illegal, fraudulent or a violation of any state or federal law, or company policies.

  • The use of AI-generated code (commonly called ‘vibe coding’) is not permitted to be used with the zii platform, our API’s, our internal data warehouses, or any other internal source of PII without following our best-practice code review process.

  • Do not use AI to make or help you make employment decisions about applicants or employees, including recruitment, hiring, retention, promotions, transfers, performance monitoring, discipline, demotion, or terminations.

  • Do not upload or input any confidential, proprietary, or sensitive Company information into AI .

    • Examples include passwords and other credentials, protected health information, personnel material, information from documents marked Confidential, Sensitive, or Proprietary, or any other nonpublic Company information that might be harmful to Encore if disclosed. This may breach your or Encore’s obligations to keep certain information confidential and secure, risks widespread disclosure, and may cause Encore’s rights to that information to be challenged.

5.0 Respect for the environment

Please be aware that the use of generative AI tools is resource intensive and will have a large impact on the environment. Processing a single ChatGPT query consumes ten times as much electricity as a Google search, while image-generating tasks are even more energy-intensive. Please be mindful of this when using these tools.

6.0 Enforcement

The IT Department will actively monitor and/or block third-party A.I. tools through various internal controls.

The Information Security Office will verify compliance to this policy through various methods, including but not limited to, business tool reports, internal and external audits. All those found in policy violation may be subject to disciplinary action, up to and including termination.

7.0 Definitions

“Employee” – means all salaried and hourly paid Employees including the Steering Committee, Contractors, Consultants, Temporaries, Interns, Agents and other workers at Voyages Encore Travel Inc., including all personnel affiliated with third parties. Can be referred to by the pronoun ‘their’, ‘they’ or ‘them’.

"Encore" – for the purpose of this policy, refers to Voyages Encore Travel Inc. and Encore Travel Americas.

“Generative Artificial Intelligence” (AI) – artificial intelligence capable of generating text, images or other data using generative models, often in response to prompts. Generative AI models learn the patterns and structure of their input training data and then generate new data that has similar characteristics.

“Hallucinations” – means false answers or information received from AI, or information that is stale, and therefore responses must always be carefully verified by a human.

“Steering Committee” – means the Chief Executive Officer; Chief Technology Officer; Vice President, Commercial Strategy; Vice President, Operations; Vice President, Product & Engineering; VP Finance & Administration; Vice President, Marketing

“Their”, “They” or “Them” – means the person or entity previously referred to.

    • Related Articles

    • Acceptable Use Policy

      1.0 Purpose The purpose of the Acceptable Use Policy (the "Policy") is to outline the acceptable use of Voyages Encore Travel Inc.’s computing and network resources ("IT resources") as well as other organizational assets. These rules are in place to ...
    • Email Policy

      1.0 Overview Electronic email is extensively used across various industry verticals and serves as the primary method of communication and awareness within an organization. However, improper use of email can introduce legal, privacy, and security ...
    • Data Classification Policy

      1.0 Purpose The purpose of the Data Classification Policy (the “Policy”) is to ascertain information and data of Voyages Encore Travel Inc.’s (“Encore”) systems are maintained in a secure, accurate, and reliable manner and be readily available for ...
    • Information Security Policy

      1.0 Introduction Voyages Encore Travel Inc. (“Encore”) is committed to safeguarding the confidentiality, integrity and availability of all physical and electronic information assets of the organization to ensure that regulatory, operational and ...
    • Password Policy

      1.0 Purpose The purpose of the Password Policy (the “Policy”) is to establish a standard for the creation of strong passwords, the protection of those passwords, and the frequency of change. 2.0 Scope The scope of this policy includes all personnel ...