AI use policy

Extranet Systems Pty Ltd (ABN 29 632 743 189) ("Extranet Systems", "we", "us") builds artificial intelligence systems for clients and uses AI in our own work. This policy sets out the principles we apply to both, so that clients, partners and the public know what to expect. It is the public summary of the AI policy within our artificial intelligence management system, which is certified to ISO/IEC 42001, and it operates alongside our Information Security Policy and Privacy Policy.

Scope

This policy applies to every AI system that we develop, deploy, operate or use, including machine learning models, large language models, generative AI, agentic AI and automated decision systems, whether hosted on our own infrastructure, in a client's environment, or provided by a third party. It applies to all of our people in Australia, Bahrain and Egypt and to suppliers acting on our behalf.

Where we use AI

• In client solutions that we design and build, from private AI platforms on GPU infrastructure to assistants, automation and analytics, always to a scope the client has agreed.
• In PentestOps, where AI assists with analysing findings, prioritising and reporting, with every result reviewed by the security testing process and never used to decide on its own whether to attack a target.
• In our own operations, including software development, research, drafting and the assistant on our website. Content on our website may be drafted with AI assistance and is reviewed by our people before publication.

Our principles

1. Human accountability. A named person is accountable for every AI system we deploy and for its outputs. AI informs decisions; where a decision has a legal or similarly significant effect on a person, a human makes it and can explain it.
2. Client data stays the client's. We do not use customer-specific data, including findings, documents, code, configurations or personal information, to train, fine-tune or evaluate any AI model, ours or a third party's, unless the client has agreed to that in writing for a specified purpose. Where we improve our own models, products and services, we may use data that has been anonymised so that no client, person or system can be identified from it, and we never use customer-specific data for that purpose. Client data is processed only on infrastructure we control or that the client has approved in writing; it is not disclosed to third-party AI providers, and Australian client data stays in Australia unless the client agrees otherwise.
3. Privacy and security by design. AI systems are covered by our ISO/IEC 27001 certified controls. Personal information is handled under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, with privacy impact assessments for systems that process personal information, and the specific risks of AI, such as prompt injection, data leakage and model misuse, are assessed and treated.
4. Transparency. We tell people when they are interacting with an AI system rather than a person, and we tell clients which AI models and providers a solution relies on, where they are hosted and what data they receive. We document the intended purpose, limitations and known risks of each system we deploy.
5. Fairness and safety. We test AI systems for inaccurate, biased, unsafe or otherwise harmful outputs before deployment and monitor them in operation. We do not build or deploy AI for purposes that are unlawful, that manipulate or deceive people, or that cause unjustified harm, and we decline work that would.
6. Reliability. AI outputs can be wrong. We design systems so that errors are detectable and correctable, we set and measure performance expectations with the client, and we provide a way for users to report incorrect or harmful outputs.
7. Lawful and ethical use. We apply Australia's AI Ethics Principles and the Voluntary AI Safety Standard, the law of each country we operate in, and the policies of each client, and we keep our practices current as regulation of AI develops.

Governance

Our board of directors is accountable for responsible AI and approves this policy. AI systems are approved before deployment through our AI management system, which records each system's purpose, data, risks, owner and controls; they are reviewed on a defined cycle and after any incident. Our people receive training on the responsible use of AI, including the rules for using AI tools with client and personal information. Suppliers of AI services are assessed and bound by written obligations consistent with this policy.

Use of AI tools by our people

Our people may use approved AI tools to do their work. They must not enter client confidential information, personal information, credentials or unreleased company information into any AI tool that has not been approved for that class of information, must review and take responsibility for anything an AI tool produces, and must not represent AI-generated material as independent human work where that matters, such as in expert advice or regulated reporting.

Reporting a concern

If you believe an AI system we operate has produced an incorrect, unfair or harmful result, or has handled information improperly, email info@extranetsystems.com.au with the subject "AI concern". We will acknowledge your report, investigate it and tell you the outcome.

Review

This policy is reviewed at least annually and whenever a significant change in our use of AI, in the law or in recognised standards requires it. The current version is always the one published at extranetsystems.com.au/policies/ai-use/.

Contact

See all our policies