AI policy
Our approach to AI
EOS uses Artificial Intelligence where it can improve our products, services and internal business operations. We are committed to using AI responsibly, securely and transparently, with appropriate safeguards for customer and personal information.
How we use AI
EOS may use AI in two principal ways:
Within our products and services
We may incorporate AI capabilities into specific features of our products, including MoveMan. Where we do so, AI is used for defined purposes to assist with the processing or analysis of information.
Our current generative AI functionality within MoveMan uses a dedicated Microsoft Azure OpenAI service. EOS does not train or fine-tune the underlying foundation models using customer data.
Within EOS
Our employees may use approved enterprise AI tools, including Microsoft Copilot, to support activities such as:
- drafting and summarising information;
- research and analysis;
- software development and technical assistance;
- administrative and productivity tasks.
The use of AI does not remove employees' responsibility for reviewing their work or complying with EOS information security, confidentiality and data protection requirements.
Customer data
Protecting customer information is fundamental to our use of AI.
EOS does not use customer information to train our own general-purpose AI models and does not provide customer information for the purpose of training public generative AI models.
Where customer information needs to be processed by AI as part of an EOS product or service, we use approved enterprise services with appropriate security and data-protection controls.
For example, AI functionality within MoveMan uses Microsoft Azure OpenAI rather than consumer/public AI services. Microsoft states that prompts, outputs and other customer data submitted to Azure-hosted models are not used to train generative AI foundation models without the customer's permission or instruction.
Security and privacy
AI services are subject to our existing information security, access-control and data-protection requirements.
Access to EOS systems is restricted to authorised individuals, and appropriate identity and security controls are applied according to the system and information being processed.
Where MoveMan AI administration is concerned, access is restricted to authorised personnel using Microsoft Entra ID with multi-factor authentication.
Human responsibility
AI is used to assist people, not replace appropriate human judgement.
Generative AI can produce inaccurate, incomplete or inappropriate responses. Employees are responsible for reviewing AI-generated information before relying upon or distributing it.
EOS does not rely upon generative AI to make autonomous decisions that have legal or similarly significant effects upon individuals.
Responsible use
EOS employees are expected to use only approved AI services for company activities and to comply with our security, confidentiality and data-protection requirements.
In particular, we do not knowingly use AI to:
- circumvent security or access controls;
- unlawfully discriminate against individuals;
- disclose confidential customer information to unapproved public AI services;
- train customer-specific AI models without appropriate authorisation; or
- replace appropriate human oversight for significant decisions.
AI providers
EOS primarily uses established enterprise technology providers for generative AI capabilities.
Our current services include Microsoft Azure OpenAI for defined MoveMan functionality and Microsoft Copilot for approved internal productivity purposes.
For Azure-hosted models, Microsoft's Data, privacy, and security for Models sold by Azure documentation explains Microsoft's approach to customer information and model training. [learn.microsoft.com]
Governance
EOS periodically reviews its use of AI to reflect developments in technology, security, privacy, regulation and industry good practice.
New or materially changed uses of AI involving customer or personal information are considered from a security, privacy and data-protection perspective before being introduced.