AI Policy

This policy sets out how Keenfunnel LLC ("Keenfunnel") develops, provides and uses artificial intelligence responsibly. It follows the requirements for an AI policy in clause 5.2 of ISO/IEC 42001. Our AI Transparency Notice explains what it means in practice for clients and the public.

Scope

This policy applies to:

1. Every AI system that Keenfunnel develops, provides to clients or uses in its own work, such as chatbots, AI voice agents, AI-generated content and automations;
2. Everyone who works for Keenfunnel or acts on its behalf, including team members and contractors.

Definitions

1. AI system: a machine-based system that is designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments (Article 3(1) of the EU AI Act).
2. Provider and deployer: have the meanings given in the EU AI Act. For each AI system, we record which role we and our client have.

Our commitments

Keenfunnel's management commits to:

1. Meeting the requirements that apply to our AI systems: the laws of the countries where we work and deliver, including the EU AI Act and data protection laws, our contracts with clients and our own policies;
2. Continually improving how we manage AI;
3. Setting AI objectives and reviewing them at least once a year.

Principles

1. Human oversight: a person reviews AI outputs before they are delivered to clients or published, and every AI system we build for clients includes a way to reach a person.
2. Transparency: people know when they are dealing with AI. Our AI Transparency Notice explains how we disclose and label it.
3. Privacy and security: we protect personal data and confidential information in every AI system, as our Privacy Policy and Data Processing Agreement require.
4. Fairness: we check AI systems for bias that could harm people, and correct it.
5. Reliability: we test each AI system for the purpose it serves before we deliver or use it.
6. Accountability: every AI system has an owner, and we keep records of the decisions we take about it.

AI objectives

Each year, management sets AI objectives, for example on transparency, incident response or AI training. Each objective has an owner, a measure and a deadline, and we review progress at least once a year.

Roles

1. Managing Director: owns this policy, approves each version, provides the resources needed and reviews how AI is managed.
2. AI lead: keeps the inventory of AI systems, coordinates risk and impact assessments, and handles AI incidents.
3. Privacy lead: advises on personal data in AI systems and handles data protection requests.
4. Everyone who works for Keenfunnel: follows this policy and reports concerns.

One person may hold more than one role.

Risk and impact assessment

Before we build, deliver or start using an AI system, we:

1. Record it in our AI system inventory, with its purpose, the data it uses, our role and the people it affects;
2. Assess its risks and its impact on people, using ISO/IEC 23894 and ISO/IEC 42005 as guidance;
3. Decide the controls it needs, such as human review, testing, logging and disclosures.

We repeat the assessment when the system, its use or the law changes significantly.

Prohibited uses

We do not develop, provide or use AI systems to:

1. Carry out any practice that the EU AI Act prohibits, such as manipulative or deceptive techniques that cause significant harm, exploiting people's vulnerabilities, social scoring, predicting crimes from profiling alone, untargeted scraping of facial images, emotion recognition at work or in education, or biometric categorization that infers sensitive traits;
2. Create sexual or intimate images of real people, or any material that depicts child sexual abuse;
3. Create deepfakes of real people without their consent, or publish them without a clear label;
4. Present an AI chatbot or AI voice agent as a human;
5. Place AI voice calls without the consent the law requires;
6. Write fake reviews or testimonials;
7. Train AI models on client data without the client's written agreement.

We do not build AI systems for high-risk uses listed in the EU AI Act, such as recruitment, credit scoring or access to education, unless management approves the project after a specific assessment.

AI literacy

Everyone who works with AI at Keenfunnel receives training suited to their role, so that they understand how the systems work, their limits and their risks (Article 4 of the EU AI Act).

Suppliers

Before we use an AI model or tool from a supplier, we review its terms, how it uses data, its security and its documentation, and we choose settings that keep client data out of model training.

Incidents

Anyone who sees an AI system cause or risk harm, such as a harmful output, a data leak or a failure, reports it to the AI lead at once. We stop or fix the system, inform affected clients and people where needed, report to the authorities where the law requires it, and record what we learned.

Retiring AI systems

If an AI system no longer serves its purpose, or its risks are no longer acceptable, we stop using it. Where stopping at once would disrupt a client's service, we phase it out in agreement with the client.

Breaches of this policy

Breaches of this policy may lead to disciplinary measures or to the end of a contract. Breaches of the law may be reported to the competent authorities.

Review

We review this policy at least once a year, and sooner when the law, our services or the risks change. Related documents: our AI Transparency Notice, Ethics Policy and Acceptable Use Policy.

Version 2.0, effective 20 October 2026.