Purpose
Credo Software uses artificial intelligence (AI) to work more efficiently and to serve our clients better. AI supports human judgment; it never replaces it, especially on decisions that affect people. This policy describes how we choose, use and oversee AI so our clients can keep trusting us with their information.
Scope
This policy applies to all Credo employees, contractors and partners working on our behalf. It covers AI used in our products and services, in software development, in internal operations, and in marketing and client communications.
Our principles
- Human accountability: a person at Credo is responsible for every AI-assisted outcome. AI output that reaches a client or affects an employee is reviewed by a person before it is used.
- People first: in our HR and workforce solutions, AI may recommend but never decides matters such as hiring, discipline, pay, training or termination.
- Fairness: we test AI features that score, rank or flag people for bias, and we correct what we find.
- Transparency: we tell clients and their employees when AI is part of a product or deliverable, and we answer questions about our AI use honestly.
- Privacy: client and employee data is used only for the purpose the client provided it, and it is never used to train public AI models.
- Accuracy: we verify AI output before we rely on it or publish it.
- Honesty in claims: we do not overstate what our AI does.
Approved tools and data protection
- Only company-approved, business-grade AI tools may be used for Credo or client work. Approved tools must contractually commit not to train on our data. Personal or free AI accounts are not permitted.
- Sensitive personal data, such as HR, medical and pay records or government identifiers, and passwords or other credentials are never entered into AI tools. We use synthetic or de-identified data instead.
- Client confidential information is used in AI tools only with the client’s permission or after identifying details are removed.
- Where a client’s requirements are stricter than this policy, the client’s requirements apply.
This policy works alongside our Data Protection Policy.
AI in our products
Before an AI feature is released in a Credo product, it is documented, assessed for risk, tested for accuracy and security (and for bias where it affects people), and approved by Credo leadership. In our products:
- AI output is clearly labeled and presented as a recommendation, not a final decision.
- Users can always reach a person at Credo about an AI result.
- Clients can ask how an AI result was produced and, where a non-AI option exists, opt out of AI features.
- AI features are monitored after release and re-tested regularly, including whenever the underlying model changes.
AI in software development
AI-assisted code is reviewed by a qualified developer and must pass automated testing and security scanning before release. AI tools are not permitted to deploy to production systems or to access production data.
AI in marketing and communications
A person reviews and fact-checks every AI-assisted communication before it goes out. We never fabricate testimonials, quotes or results, never use a client’s name or materials without permission, and never create images or voices of real people without their consent.
Governance and oversight
- Credo maintains an inventory of the AI tools and features we use, the data they touch and their level of risk.
- This policy is aligned with the NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile. Alignment is voluntary and is not a certification.
- AI incidents, such as exposed data, harmful or incorrect guidance, or bias, are contained, assessed, corrected and documented. Affected clients are notified promptly.
- The policy is reviewed at least annually, and everyone it covers is trained on it.
Questions about how Credo uses AI? Contact us.
