How we use AI

1. Purpose

We use artificial intelligence to assist career professionals and their clients by reducing administrative effort, organising and summarising information, assisting with analysis, generating draft content and providing other intelligent capabilities within the Voyj platform.

We recognise that artificial intelligence, particularly generative AI, introduces risks relating to privacy, confidentiality, accuracy, bias, security, transparency, consent and inappropriate reliance on automated outputs.

This policy establishes the principles and mandatory requirements governing the selection, development, deployment and use of artificial intelligence by us.

The purpose of this policy is to ensure that AI is used in a manner that:

• protects customer and client information;
• preserves human judgement and accountability;
• respects client consent and professional obligations;
• provides meaningful benefit to users;
• is transparent where appropriate;
• minimises unnecessary disclosure of information;
• appropriately manages AI providers and subprocessors;
• recognises the limitations of AI-generated information; and
• complies with applicable privacy, security, professional and other legal obligations.

2. Scope

This policy applies to artificial intelligence used:

• as part of the Voyj platform;
• to process information on behalf of Voyj customers;
• to provide AI-assisted features to Voyj users;
• by our personnel in operating or supporting the service;
• in software development and testing;
• for customer support;
• for internal business operations; and
• through third-party AI services engaged by us.

It applies to generative AI, large language models, machine learning systems and other automated systems capable of generating, analysing, classifying, recommending, inferring or transforming information. This policy applies regardless of whether an AI system is:

• developed by us;
• hosted by us;
• accessed through an API;
• provided through cloud infrastructure;
• supplied as a commercial service; or
• incorporated into another product used by us.

3. AI Principles

Our use of artificial intelligence is governed by the following principles.

4. Permitted Uses of AI

Subject to appropriate controls, we may use AI to provide functionality including:

• summarisation;
• transcription and transcript processing;
• drafting and rewriting;
• extraction and organisation of information;
• categorisation;
• search and retrieval assistance;
• document analysis;
• identification of themes or patterns;
• preparation of suggested actions or questions;
• assistance with resumes, cover letters and other career material;
• preparation of meeting or case summaries;
• administrative assistance;
• natural-language interaction with Voyj functionality; and
• other functions intended to assist users in performing their work.

This list is illustrative rather than exhaustive. New AI functionality must be assessed according to its purpose, information requirements and potential impact rather than merely whether a similar AI function has previously been approved.

5. Prohibited Uses

We must not knowingly use AI to:

• make fully autonomous decisions having a significant adverse effect on an individual without meaningful human review;
• make employment, eligibility, legal or similarly significant determinations solely on the basis of generative AI output;
• intentionally discriminate against individuals on the basis of protected or irrelevant personal characteristics;
• fabricate information about an individual and represent it as verified fact;
• impersonate an individual deceptively;
• create deliberately misleading records;
• circumvent our access controls or customer permissions;
• expose customer information to unauthorised AI services;
• use customer data to train general-purpose AI models;
• covertly use AI in circumstances where disclosure or consent is required; or
• perform an activity prohibited by applicable law.

AI must not be used as a mechanism to avoid professional, ethical or legal responsibilities that would otherwise apply to a person performing the same activity.

6. Human Oversight

Voyj is designed to support professional decision-making rather than replace it.

Where AI produces:

• recommendations;
• assessments;
• interpretations;
• inferred information;
• suggested decisions;
• client-facing material; or
• other information capable of materially influencing an outcome,

the user must have a reasonable opportunity to review, modify, reject or disregard the AI output. We must not intentionally design an AI feature in a manner that misleadingly represents an AI-generated recommendation as an objective fact. Higher-risk uses require correspondingly greater human oversight. Responsibility for professional decisions remains with the practitioner or organisation making those decisions.

7. Client Transparency and Consent

We recognise that responsible use of AI within career development practice may require clients to be informed about how AI is being used.

Where AI is materially involved in a client interaction, practitioners should ensure that clients are appropriately informed.

This is particularly relevant where AI is used for:

• meeting recording;
• transcription;
• automated notetaking;
• analysis of client conversations;
• assessment interpretation;
• analysis of personal documents;
• generation of client-specific recommendations; or
• other processing that may not reasonably be apparent to the client.

Where consent is required by law, professional standards, contractual obligations or the circumstances of the engagement, appropriate consent must be obtained before the relevant AI processing occurs. We will, where reasonably practicable, provide functionality that assists practitioners in recording or managing relevant disclosure and consent. The availability of an AI feature within Voyj does not itself mean that use of that feature is appropriate in every client or professional context. Customers and practitioners remain responsible for determining whether their use of a particular AI capability is appropriate for the circumstances of their engagement.

8. AI-Generated Content and Accuracy

Generative AI is probabilistic and may generate incorrect or fabricated information.

We do not represent AI-generated content as inherently accurate merely because it was generated by the Voyj platform.

Where appropriate to the use case, we may:

• identify content as AI-generated or AI-assisted;
• provide warnings regarding limitations;
• provide access to relevant underlying source information;
• require user confirmation;
• restrict automated actions; or
• implement technical validation.

Users remain responsible for reviewing AI-generated material before relying upon it for professional or material decisions. AI-generated information about an identifiable person must be handled with the same care as other personal information where applicable, including where the AI-generated information may be inaccurate.

9. Personal and Sensitive Information

Personal information supplied to or generated by an AI system remains subject to our privacy and security requirements.

Before personal information is supplied to an AI system, we must consider whether:

• the information is reasonably necessary for the function;
• the AI service is approved for processing that class of information;
• the proposed use is consistent with the purpose for which the information is held;
• appropriate security and privacy protections exist;
• the provider’s data retention arrangements are acceptable; and
• any additional consent, notice or other legal basis is required.

Additional care must be taken where information may constitute sensitive information. AI must not be used to infer sensitive characteristics about an individual unless the function has been specifically assessed and there is a legitimate and lawful purpose for doing so.

10. AI Providers

AI providers that receive customer information must be approved by us.

Before approving an AI provider for such use, we must reasonably assess relevant matters including:

• security;
• privacy;
• data handling practices;
• model training practices;
• data retention;
• provider access to submitted information;
• subprocessors;
• data processing locations;
• contractual protections;
• deletion capabilities;
• incident management; and
• suitability for the intended use.

Approval applies to the particular service and intended use and does not automatically authorise every product offered by the same provider. We must periodically review material AI providers because provider terms, models, capabilities and data handling practices may change.

11. Model Training and Improvement

12. Retrieval-Augmented and Contextual AI

We may provide AI systems with information retrieved from a customer’s Voyj environment in order to answer questions or perform requested functions.

Such retrieval must respect the same authentication, organisation boundaries, role-based access controls and permissions that govern access to the underlying information.

An AI interface must not provide a user with information that the user would not otherwise be authorised to access.

AI must not be treated as a privileged mechanism for bypassing our application security model.

Where practicable, contextual information should be retrieved only when required for the user’s request and limited to information relevant to that request.

Customer information must not become persistent shared AI context available to other customers.

13. Automated Actions

AI systems may assist users in preparing actions within Voyj.

Where an AI system is capable of modifying records, sending communications, creating tasks, changing workflow state or taking another external action, the level of required confirmation must be proportionate to the potential impact of that action.

High-impact or irreversible actions should ordinarily require explicit user confirmation.

AI systems must operate within the permissions of the user or service identity under which they act.

AI must not be granted broader access merely to simplify implementation of an AI feature.

14. Internal Use of AI by Our Personnel

The protections applying to customer information also apply when our personnel use AI tools.

Our personnel must not enter customer personal information, confidential customer information, credentials, secrets or production data into publicly available or otherwise unapproved AI services.

This prohibition applies to uses including:

• debugging;
• software development;
• customer support;
• incident investigation;
• document preparation;
• data analysis; and
• general productivity.

The convenience of an AI tool does not constitute authorisation to disclose customer information to it. Where AI is required for a legitimate internal purpose involving customer information, an approved service with appropriate privacy, security and contractual protections must be used. Information supplied must be limited to the minimum reasonably necessary.

15. AI-Assisted Software Development

We may use AI-assisted software development tools.

Source code may be supplied to approved development tools where we have assessed the applicable security, confidentiality, data-retention and intellectual-property arrangements.

Developers must not intentionally expose:

• production credentials;
• API secrets;
• private cryptographic keys;
• customer data;
• production database contents; or
• other restricted information to AI development tools unless the tool and specific use have been expressly approved for that information.

AI-generated source code must be treated as untrusted code until reviewed. Developers remain responsible for:

• code review;
• testing;
• security;
• licensing considerations;
• architectural correctness; and
• the resulting behaviour of deployed software.

Use of an AI coding tool does not transfer responsibility for the resulting software to the AI provider.

16. Data Location and AI Processing

Our Data Storage and Retention Policy governs the location of customer data stored at rest.

AI processing is distinct from persistent data storage.

An approved AI provider may process limited information outside Australia where required to provide an authorised AI function, subject to appropriate privacy, security, contractual and legal controls.

We will assess the processing arrangements of AI providers and disclose material overseas processing where required.

AI processing outside Australia does not alter our commitment regarding the location of primary customer data stored at rest.

Where reasonably practicable, we will seek to minimise both the amount of information transferred outside Australia and the duration for which that information is retained.

17. AI Data Retention

AI providers receiving identifiable customer information must provide clearly defined and appropriately limited data-retention arrangements.

We will prefer zero-data-retention arrangements where these are technically and commercially available and suitable for the relevant functionality.

Where zero data retention is not available, provider retention must:

• be limited to a defined period;
• have a legitimate operational, security or legal purpose;
• not permit use of customer information for general-purpose model training;
• provide appropriate protection during the retention period; and
• be assessed and approved by us.

Customer information must not be retained by an AI provider indefinitely merely because retention is technically possible. Our own retention of AI-generated content incorporated into customer records is governed by our Data Storage and Retention Policy.

18. AI Security

AI integrations must be designed with appropriate consideration of AI-specific security risks.

Depending upon the functionality, this may include protection against:

• prompt injection;
• malicious documents or content;
• unauthorised retrieval of information;
• cross-customer information disclosure;
• manipulation of automated actions;
• inappropriate disclosure of system instructions;
• excessive permissions;
• insecure output handling;
• unintended disclosure through model context; and
• abuse of AI functionality.

AI-generated instructions, code or tool requests must not automatically be considered trustworthy merely because they originate from an approved model. Security controls must be proportionate to the capabilities provided to the AI system. AI systems capable of taking actions require additional controls appropriate to the potential consequences of those actions.

19. Customer Segregation

AI functionality must preserve our customer and organisation boundaries.

Information belonging to one customer must not intentionally be provided to another customer’s AI context.

Shared AI infrastructure may be used where appropriate security and logical isolation exist, but customer information must remain appropriately segregated.

Customer information must not become shared model memory available to other Voyj customers.

The same role-based access controls and organisational boundaries applying elsewhere in Voyj must continue to apply when information is accessed through an AI interface.

20. Transparency to Users

We will provide reasonable transparency regarding material AI functionality.

Depending upon the nature of the feature, this may include:

• identifying that AI is being used;
• identifying AI-generated or AI-assisted content;
• explaining the purpose of the AI functionality;
• describing important limitations;
• identifying when human review is required;
• providing relevant consent mechanisms; and
• providing information regarding relevant data processing.

We are not required to expose proprietary prompts, security controls, model configurations or other information where disclosure would create security, intellectual-property or operational risk.

21. AI Risk Assessment

New or materially changed AI functionality must be assessed before production deployment.

The level of assessment must be proportionate to the potential impact of the functionality.

Relevant considerations include:

• the purpose of the AI;
• information supplied to the AI;
• whether personal or sensitive information is involved;
• potential impact on individuals;
• consequences of inaccurate output;
• potential bias or unfairness;
• required human oversight;
• client disclosure and consent;
• security risks;
• data processing location;
• provider retention;
• model training arrangements;
• transparency requirements; and
• the ability for a user to challenge, correct or disregard an output.

Higher-risk uses require more rigorous assessment, testing and approval.

22. Testing and Monitoring

AI functionality must be reasonably tested before production deployment.

Testing should be appropriate to the intended use and may include evaluation of:

• accuracy;
• reliability;
• security;
• inappropriate disclosure;
• hallucination;
• bias;
• failure modes;
• prompt injection;
• permission enforcement; and
• behaviour under unexpected input.

Material AI systems should be periodically reviewed after deployment. A previously approved AI system may require reassessment where the provider, underlying model, functionality, information flows or intended use materially changes.

23. AI Provider and Model Changes

We may change AI providers or underlying models as technologies, security requirements, commercial arrangements and capabilities evolve.

A change of model does not require amendment of this policy provided that the replacement service complies with the requirements established by this policy.

Material changes to the way customer information is processed must nevertheless undergo appropriate assessment.

This policy therefore establishes the requirements AI services must satisfy rather than mandating a particular AI vendor or model.

24. Incidents

Suspected unauthorised disclosure, inappropriate use or unintended exposure of customer information involving an AI system must be treated as a potential security or privacy incident.

We must investigate material incidents and take appropriate steps to:

• contain the incident;
• understand the information involved;
• determine the cause;
• assess potential harm;
• remediate the issue;
• meet applicable notification obligations; and
• reduce the likelihood of recurrence.

Where appropriate, an AI feature or provider may be suspended while an incident is investigated.

25. Governance and Accountability

We retain responsibility for the AI functionality we choose to provide.

Responsibility for safe and appropriate AI deployment cannot be transferred to an AI model or outsourced merely by engaging a third-party AI provider.

We must maintain appropriate internal ownership of:

• AI provider approval;
• AI risk assessment;
• security;
• privacy;
• production deployment; and
• material AI incidents.

We should maintain an internal record of material AI systems and providers used in delivering the service. That record should identify, where applicable:

• the provider;
• the purpose;
• the classes of information processed;
• relevant data locations;
• retention arrangements;
• model-training arrangements; and
• the date of the most recent assessment.

26. Alignment with Career Development Professional Standards

We support career development professionals and recognise the professional and ethical standards applicable to career development practice in Australia.

In addition to applicable law and Australian privacy requirements, our approach to artificial intelligence takes into account:

• the Career Industry Council of Australia (CICA) Professional Standards for Australian Career Development Practitioners;
• the CICA Guiding Principles for Career Development Services and Career Information Products; and
• the Career Development Association of Australia (CDAA) Guidelines for the Use of Generative Artificial Intelligence (GenAI) for Career Practitioners.

Consistent with these frameworks, we support the responsible use of AI based upon:

• privacy;
• transparency;
• informed participation and consent where appropriate;
• fairness;
• inclusion;
• accuracy;
• professional accountability; and
• meaningful human involvement.

We recognise that the use of AI does not diminish a career practitioner’s professional responsibilities to their clients. Where AI is used materially within a client interaction, including AI-assisted recording, transcription, notetaking, assessment or generation of client-specific material, practitioners should ensure that clients are appropriately informed and that any consent required by law, professional standards or the circumstances of the engagement has been obtained. We will, where reasonably practicable, provide functionality that assists practitioners in using AI consistently with their professional and ethical obligations. We do not represent the availability of an AI feature within the platform as meaning that use of that feature is appropriate in every professional or client context.

27. Exceptions

Exceptions to this policy must:

• have a legitimate business, technical or legal justification;
• be appropriately risk assessed;
• be approved by an authorised representative of ours; and
• be documented where material.

An exception must not be used merely to bypass privacy, security, consent or human-oversight requirements.

28. Relationship With Our Other Policies

This policy should be read together with our:

• Privacy Policy;
• Data Storage and Retention Policy;
• Information Security Policy;
• Business Continuity and Disaster Recovery arrangements;
• Terms of Service;
• Data Processing Agreement, where applicable; and
• applicable customer agreements.

Where another binding agreement establishes additional AI, privacy or data-processing requirements, those requirements apply in addition to this policy. Applicable law always takes precedence over this policy.

29. Applicable Law and Jurisdiction

We are an Australian-operated service and this policy is established with reference to applicable Australian laws and regulatory requirements, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Our approach to AI governance also takes into account applicable Australian Government guidance concerning the safe and responsible adoption of artificial intelligence.

We additionally recognise relevant professional standards and guidance applicable to the Australian career development profession, including those published by CICA and CDAA.

Where we provide services to customers or process personal information subject to the laws of another jurisdiction, additional legal or contractual requirements may apply.

Nothing in this policy is intended to limit any rights or obligations that cannot lawfully be excluded or modified under applicable law.

30. Definitions

AI provider

A third party providing an artificial intelligence model, platform, API, infrastructure or AI-enabled service used by us.

AI system

A machine-based system capable of generating, analysing, classifying, predicting, recommending, inferring or otherwise transforming information in a manner that would ordinarily be associated with artificial intelligence.

Customer data

Information submitted to, generated through or stored within Voyj on behalf of a customer.

Generative AI

Artificial intelligence capable of generating content such as text, images, audio, video, software code or structured data.

General-purpose AI model

An AI model designed to perform a broad range of tasks rather than a single narrowly defined function.

Human oversight

Meaningful involvement by an authorised person who is able to understand the purpose of an AI output and, where appropriate, review, modify, reject or override it.

Personal information

Information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined by applicable Australian privacy law.

Sensitive information

Information falling within the definition of sensitive information under applicable Australian privacy law.

31. Policy Statement

We believe artificial intelligence can materially improve the tools available to career professionals without transferring professional judgement or accountability to a machine.

Our approach is therefore based on five fundamental commitments:

These principles apply regardless of the AI provider, model or technology used to deliver the capability.