This policy defines how Artificial Intelligence (AI) may be used across Gold Standard and establishes the rules, governance, and controls required to ensure responsible use. It is intended to enable the responsible use of AI in a manner that supports GS’ mission, integrity standards, operational objectives, and legal obligations, while encouraging innovation, efficiency, and organizational learning.

The Policy applies to:

• all AI systems, tools, and AI-enabled activities used, developed, procured, deployed, or operated by or on behalf of Gold Standard;
• all Gold Standard employees, contractors, consultants, temporary personnel, and other individuals acting on behalf of Gold Standard; and
• third-party service providers operating AI systems or processing information on behalf of Gold Standard where such activities fall within the scope of contractual or operational arrangements with Gold Standard.
• where information, analyses, content, or other inputs generated or supported by AI are submitted to, relied upon by, or otherwise influence GS activities, decisions, assessments, or processes from partners, NGOs, programme participants, or other external stakeholders, GS may establish appropriate requirements relating to transparency, disclosure, validation, quality assurance, or acceptable use.

This Policy aims to:

• ensure that AI use supports confidentiality, integrity, availability, and trust;
• provide a consistent framework for evaluating, approving, deploying, and monitoring AI use cases;  
• support responsible, transparent, and accountable use of AI;
• promote alignment with applicable legal, regulatory, and governance obligations; and   
• encourage sustainable and proportionate use of AI that is consistent with GS' commitment to integrity and environmental stewardship.

The policy covers both:

• Dedicated AI tools, whereby the AI features are the main purpose of the tool (e.g, a general-purpose conversational AI tools, such as ChatGPT)
• AI features embedded in specific applications (e.g. tools that support writing, summarisation, search, workflow-automation, or embedded into a Standard Authoring Platform, such as Microsoft Copilot)

All AI use at Gold Standard must adhere to the following principles, which ensure that technology enhances rather than undermines integrity, accessibility, and trust:

• Human accountability: Humans remain responsible for decisions supported by AI, and AI must be used to augment—not replace—professional judgment. In practice, this means AI should be used to support judgment, reduce manual effort, improve consistency, and widen access to high-quality tools and information, while ensuring that a human is always in-the-loop and remains responsible for reviewing, validating, and approving outputs before they are used in operational, client-facing, market-facing, or public contexts. 
• Fairness and non-discrimination: AI systems must be designed and used in ways that avoid introducing or amplifying bias.
• Transparency and explainability: AI systems and AI-supported decisions must be sufficiently transparent and understandable to enable appropriate review, oversight, and accountability. Where appropriate, the use of AI should be communicated, and AI systems, outputs, and significant decisions must be documented and auditable.
• Privacy and data protection: Sensitive data, including personal, confidential, or proprietary GS data must be handled securely and in accordance with internal policies, applicable regulations and external obligations.
• Security and robustness: AI systems must be reliable, resilient, and protected against misuse or failure.
• Confidentiality: AI systems must ensure confidentiality of GS data. In particular, data submitted by GS to AI systems must remain within the GS perimeter and not be used by the AI system supplier for human review or model training.
• Compliance with Laws and Regulations: Ensure that all AI-related activities comply with applicable Swiss laws, data protection regulations (such as the Swiss Federal Act on Data Protection), and any other relevant international standards.
• Sustainability and proportionality: AI should be used in a manner that is proportionate to the value being created and consistent with Gold Standard’s commitment to sustainability and integrity. Where reasonably practicable, Gold Standard should consider the environmental and resource implications of AI-enabled activities and seek to avoid unnecessary or inefficient use of AI systems where comparable outcomes can be achieved through lower-impact approaches.

Gold Standard’s approach to responsible AI is organized around a set of core governance areas. Together, these areas are intended to support practical, scalable, and trustworthy adoption of AI across the organisation while maintaining appropriate oversight, accountability, and operational safeguards.

The framework is intended to support proportionate governance, recognising that not all AI uses present the same level of risk, sensitivity, or operational impact.

1. Oversight, Accountability, and Decision Responsibility: GS will maintain clear accountability for how AI systems and AI-supported processes are used across the organisation. Human responsibility for decisions, outputs, and operational outcomes must remain clear, particularly where AI is used to support expert judgment, stakeholder-facing activities, or integrity-sensitive processes. This includes governance oversight, approval and escalation pathways, allocation of responsibilities, and proportionate human review based on the nature and impact of the use case.
2. Lawful, Ethical, and Responsible Use: AI systems and AI-enabled workflows must operate in a manner that is lawful, responsible, and aligned with Gold Standard’s integrity standards and organisational values. This includes appropriate consideration of privacy, confidentiality, fairness, transparency, contractual obligations, responsible use of information, and the potential impact of AI-enabled outputs or decisions on stakeholders.
3. Information Stewardship and Data Management: GS will apply appropriate governance and controls to the information used within AI systems and workflows. This includes managing how data is sourced, accessed, classified, handled, retained, shared, and protected, as well as ensuring that information used within AI-enabled processes remains reliable, relevant, and appropriately governed.
4. Solution Quality, Assurance, and Lifecycle Management: AI-enabled solutions should be designed, tested, deployed, and maintained in a disciplined and proportionate manner appropriate to the use case and associated risks. This includes validation, testing, monitoring, release management, documentation, and ongoing review to support reliability, consistency, and operational accountability throughout the lifecycle of the solution.
5. Security, Stability, and Operational Safeguards: GS will maintain appropriate technical and operational safeguards to support the secure, reliable, and resilient use of AI systems and workflows. This includes access controls, monitoring, incident response, resilience planning, safeguards against misuse, and additional controls where systems are capable of taking automated or agentic actions.

These governance areas are intended to operate together as a unified framework rather than as standalone control domains. Supporting standards, procedures, technical guidance, and operational practices may evolve over time as technologies, business needs, and regulatory expectations continue to develop.

Gold Standard will apply a risk-based and proportionate approach to AI governance, aligned with the organisation’s Risk Management Process and the Information Security Management System (ISMS). Governance and oversight requirements should reflect the nature, scale, sensitivity, and potential impact of the AI use case.

AI use cases that are low-risk, internally focused, and do not involve sensitive or restricted data may proceed with lighter governance requirements. Use cases involving sensitive data, externally relied-upon outputs, integrity-sensitive processes, autonomous actions, or material operational, legal, or reputational risks require additional review, safeguards, escalation, or approval.

This approach is intended to support safe and scalable adoption of AI while maintaining appropriate oversight, accountability, and operational controls.

Gold Standard recognises that many AI-enabled activities are low-risk productivity tools used in day-to-day work. Certain categories of AI use may therefore be generally permitted without formal use case review, provided approved tools are used and users comply with this Policy and applicable data handling requirements.

Examples of generally permitted uses may include:

―    drafting and editing written materials;

―    summarising documents or meetings;

―    translation;

―    brainstorming and ideation;

―    internal research assistance;

―    presentation or collateral preparation;

―    formatting, administrative, or workflow support activities.

Such use remains subject to restrictions relating to confidential, proprietary, personal, regulated, or otherwise restricted information. Users remain responsible for reviewing outputs and ensuring that AI-generated content is accurate, appropriate, and suitable for its intended use.

Gold Standard may designate approved AI platforms, models, or enterprise tools for organisational use.

Where designated tools exist, personnel should use approved platforms rather than unapproved public or consumer AI services for Gold Standard work activities.

Approved tools should:

• support appropriate security and access controls;
• operate under appropriate enterprise or organisational licensing arrangements where available;
• provide appropriate confidentiality and data handling protections;
• align with applicable legal, contractual, and governance requirements.

Use of unapproved AI tools with confidential, proprietary, personal, or otherwise restricted information may be prohibited or subject to additional review requirements.

AI vendors processing Gold Standard data shall undergo third-party security and privacy due diligence in accordance with Gold Standard Procurement Policy.

AI use cases are considered material where they involve elevated operational, legal, ethical, security, stakeholder, or reputational risk.

A use case may be material where it involves:

• External Reliance. AI outputs are used in client-facing work, public-facing content, certification-related activities, or external deliverables where a third party may reasonably rely on the output.
• Sensitive or Restricted Information. The use case involves confidential, proprietary, personal, privileged, regulated, or otherwise restricted information.
• High-Impact Decisions or Processes. The AI system materially supports or influences decisions, workflows, or operational activities that may significantly affect stakeholders, compliance obligations, or organisational integrity.
• Autonomous or Agentic Actions. The AI system can take actions beyond generating content, including triggering workflows, interacting with external systems, updating records, or communicating externally.
• Material Change or New Risk Exposure. The use case introduces a materially new model, vendor, dataset, integration, deployment environment, or operational risk profile.

Use cases that are limited to low-risk internal productivity support, use no sensitive or restricted information, do not materially affect stakeholder outcomes, and do not involve autonomous actions are generally considered non-material.

Material AI use cases should undergo appropriate review before deployment or operational use.

Review requirements should be proportionate to the nature and risk of the use case and may include legal, security, data governance, operational, or technical assessment as appropriate.

AI use cases should be escalated where they:

• exceed established risk thresholds;
• involve sensitive or regulated information;
• materially affect external stakeholders or integrity-sensitive processes;
• involve autonomous or externally acting systems;
• create significant legal, operational, ethical, or reputational risk; or
• involve uncertainty regarding acceptable use or appropriate safeguards.

Where uncertainty exists, personnel should seek guidance or escalate the matter for appropriate review.

AI systems are intended to support and augment human expertise rather than replace accountable human judgment.

Personnel using AI systems remain responsible for:

• reviewing outputs before operational, external, or stakeholder-facing use;
• ensuring outputs are appropriate, accurate, and contextually suitable;
• complying with applicable confidentiality, security, and data handling obligations;
• following applicable approval or escalation requirements; and
• reporting material incidents, errors, or unintended outcomes through appropriate channels.
• reporting information security incident through the organisational incident management process.

AI-generated outputs should not be treated as authoritative without appropriate human review, particularly where outputs may materially affect stakeholders, integrity-sensitive activities, or operational decisions.

This section sets out Gold Standard’s baseline expectations for the responsible use, development, deployment, and operation of AI-enabled systems and workflows.

These expectations apply proportionately based on the nature, scale, sensitivity, and potential impact of the use case. Supporting standards, procedures, guidance, and operational controls may be developed separately over time.

Material AI use cases should undergo an appropriate intake and review process before operational use or deployment.

The level of review should reflect the nature and potential impact of the use case, including considerations such as:

• sensitivity of the information involved;
• stakeholder or operational impact;
• degree of automation;
• external reliance on outputs;
• legal, security, or reputational exposure.

Material AI activities should have identified ownership, clear business purpose, and accountable operational oversight.

Gold Standard will:

• maintain visibility over material AI-enabled activities;
• apply governance proportionate to risk;
• ensure accountability for AI-supported outcomes; and
• support consistent review of higher-impact use cases.

Information used within AI systems and workflows should be handled responsibly and in accordance with applicable confidentiality, privacy, security, contractual, and governance requirements.

Appropriate safeguards should be applied based on the nature and sensitivity of the information involved. Information processed by AI systems shall be classified according to the Gold Standard Information Classification Scheme and handled in accordance with the associated protection requirements.

Confidential, proprietary, personal, privileged, or otherwise restricted information should not be used within AI systems unless appropriate controls and approvals are in place.

Gold Standard aims to:

• protect sensitive and restricted information;
• support lawful and responsible information use;
• maintain stakeholder trust; and
• support reliable AI-enabled outputs and workflows.

Material AI-enabled solutions should undergo appropriate design review, testing, validation, and release processes before operational deployment or external use.

Testing activities should be proportionate to the use case and may include assessment of:

• reliability and consistency;
• operational suitability;
• security and resilience;
• limitations and failure conditions; and
• alignment with intended use.

Material AI systems should have documented ownership, operational expectations, and escalation pathways where appropriate. Where AI-enabled systems create or modify material organisational data, documents, records, or other content, appropriate version control, audit trails, and recovery mechanisms should be maintained to support traceability and prevent unintended loss or overwriting of information.

Gold Standard aims to:

• support reliable and operationally appropriate AI-enabled systems;
• reduce risks arising from inaccurate or inappropriate outputs;
• ensure material systems are appropriately reviewed before deployment; and
• maintain accountability throughout the operational lifecycle.

AI systems are intended to support and augment human expertise rather than replace accountable human judgment.

Material AI use cases should maintain an appropriate level of human review, supervision, or intervention based on the nature and potential impact of the activity.

Personnel remain responsible for reviewing outputs and ensuring that AI-supported decisions, deliverables, and communications remain appropriate, accurate, and contextually suitable.

Gold Standard aims to:

• preserve clear human accountability for material outcomes;
• reduce over-reliance on AI-generated outputs;
• maintain professional judgment in integrity-sensitive activities; and
• ensure AI-supported work remains aligned with organisational expectations and standards.

AI systems capable of taking actions beyond content generation should operate within clearly defined operational and technical boundaries.

Appropriate safeguards should be applied relating to:

• permitted actions and system access;
• approval checkpoints;
• monitoring and traceability;
• escalation and intervention mechanisms;
• recovery or rollback processes where appropriate; and
• limitations on autonomous behaviour.

Higher-impact automated systems may require additional review, safeguards, monitoring, or approval requirements.

Gold Standard aims to:

• maintain appropriate control over automated system behaviour;
• reduce risks associated with unintended or unauthorised actions;
• preserve operational traceability and accountability; and
• support safe and proportionate use of automation capabilities.

External AI tools, vendors, models, or service providers used in connection with GS activities should undergo appropriate review based on the nature, sensitivity, and risk of the proposed use.

Review considerations may include:

• security and confidentiality protections;
• data handling practices;
• contractual and licensing terms;
• operational reliability;
• transparency and vendor limitations; and
• traceability of inputs, outputs, approvals, decisions, and significant automated actions where technically feasible
• alignment with Gold Standard Information Security requirements.

Gold Standard aims to:

• manage risks associated with external AI services and providers;
• support responsible use of third-party AI capabilities;
• maintain appropriate protection of organisational and stakeholder information; and
• apply consistent governance expectations across internal and external AI-enabled activities.

Material AI systems and workflows should be subject to appropriate monitoring and review during operation to support continued reliability, security, and alignment with approved use.

Gold Standard should maintain appropriate processes for:

• identifying and responding to incidents or failures;
• monitoring operational performance and material risks;
• managing significant unintended outcomes;
• reviewing material system or use case changes; and
• supporting continuous improvement where appropriate.

Gold Standard aims to:

• identify operational, security, or governance issues in a timely manner;
• maintain reliability and trustworthiness of AI-enabled activities;
• support appropriate remediation and escalation of material incidents; and
• ensure governance practices evolve alongside operational and technology changes.

Use Case Owners remain responsible for ensuring that AI-enabled activities operating within their area of responsibility:

• comply with this framework and applicable operational standards;
• undergo required review or escalation processes;
• maintain appropriate operational safeguards and controls;
• comply with applicable confidentiality, privacy, and security obligations; and
• maintain appropriate human accountability for operational outcomes.

Responsibility for operational use of AI may not be delegated solely to automated systems, vendors, or technical teams.

“Use Case Owner” refers to the individual designated as accountable for a specific AI-enabled activity, workflow, system, deployment, or operational use case. Depending on the nature of the activity, the Use Case Owner may be: a business owner, technical owner, operational owner, project or delivery lead, or another designated accountable individual responsible for the relevant activity or workflow.

Personnel using AI-enabled tools or systems remain responsible for:

• using approved tools appropriately;
• handling information in accordance with applicable requirements;
• reviewing outputs before reliance or external use;
• escalating issues, information security incidents, or uncertainties where appropriate; and
• exercising professional judgment when using AI-supported outputs or recommendations.

AI-generated outputs should not be treated as authoritative without appropriate review and contextual assessment.

Data Office will ensure compliance with this policy and maintain its relevance over time:

• Compliance will be enforced through defined mechanisms, including audits and clear accountability structures.
• The policy will be reviewed and updated periodically to reflect evolving risks, technologies, and organisational needs.
• The policy will be aligned with applicable regulations and industry standards.
• Oversight processes will ensure consistent application across all AI use cases and teams.
• Lessons learned from monitoring and incidents will be incorporated into continuous improvement of governance and controls.

For any questions regarding this Policy, or to raise concerns about the responsible use of AI at Gold Standard, please contact the Data Office at [email protected]

Gold Standard encourages the timely reporting of potential AI misuse, policy violations, or other concerns. Information security incidents must also be reported through the organisation's established incident management process.