Legal

AI Governance Policy

Version 1.2. Effective November 4, 2026.

Version: 1.2
Effective date: November 4, 2026
Owner: AI Governance Lead (with Compliance & Security)
Review cycle: Quarterly or upon material change
Supporting controls: SOC 2 Type II (Vanta), Vendor Management, Data Classification, Access Control, Change Management

1. Purpose

This policy defines how PlanTools develops, deploys, monitors, and governs artificial intelligence (“AI”) across our platform and internal operations. PlanTools is a FinTech technology software-as-a-service platform serving financial advisors, recordkeepers, broker-dealers, and DCIOs. We process Recordkeeper plan data feeds that include retirement plan and participant data. Our partnerships with Morningstar and Index Providers deliver all of our investment information to support all of our subscribed clients’ reporting and fiduciary workflows.

Our practical principles and structured reviews focus on data minimalism: we never train models on our customers. Not their data, not our partners’ data, and we keep sensitive data under strict control. The objective is practical AI value with complete protection of participant data and clear support for our customers’ fiduciary responsibilities.

2. Scope

Applies to all employees, contractors, and partners; all AI systems, features, agents, and tools (internal or customer-facing); all data processed in connection with AI; and all third-party AI providers.

3. Core Principles

Open Communication, No BS
1. Clear disclosure of AI use, capabilities, limitations, and data practices.
Build for Trust
1. No training on customer/Participant/partner data; strong contractual and technical controls; reliability first.
Accountability Is a Team Sport
1. Humans remain accountable; named owners; structured reviews.
Empower Advisors & Protect Participants
1. Assess impacts on fairness, accuracy, and participant outcomes.
Unleash Potential Without Creating Inequity or Risk
1. Prioritize high-value, low-risk uses that improve transparency and outcomes.

4. Data Handling & AI Restrictions (Non-Negotiable)

Absolute prohibition on using Recordkeeper data, Participant data, advisor data, or any customer-controlled data to train, fine-tune, or improve AI models (PlanTools or third-party).
Third-party providers must contractually guarantee no training and preferably Zero Data Retention.
Data minimization and purpose limitation required.
AI features inherit existing role-based access controls and permissions.
Highest protections are applied to Participant Personally Identifiable Information (“PII”), balances, contributions, distributions, elections, and any non-public personal or ERISA-sensitive information.
Partner data (Morningstar, Department of Labor, Securities and Exchange Commission, Index Providers, Recordkeeper Partners, other Data Providers, etc.) is used only under applicable agreements and never for training.

5. AI Model Inventory and Risk Table

A living AI Inventory is maintained and reviewed at least quarterly (or upon material change). Record every AI system, model, feature, agent, or third-party integration.

Required Inventory Fields

Use case/feature name
Description and business purpose
Model/provider (internal, Grok, OpenAI, Anthropic, Google, etc.)
Data categories processed
Data flows (source → AI → destination)
Owner
Risk rating (Low / Medium / High)
Last Responsible Technology Review date
Contractual protections status (no-training, ZDR, DPA)
Human oversight requirements
Customer-facing? (Y/N) and disclosure method
Status (Active / Pilot / Retired)

Risk Rating Criteria

Low: Internal productivity only; no customer/Participant data; limited impact.
Medium: Processes limited non-sensitive data or supports internal analysis with human review.
High: Involves Participant data, investment-related outputs, report generation for customers, or any automated insight that could influence fiduciary or plan decisions.

Example Risk Table Structure (maintained in the official inventory)

Use Case	Model/Provider	Data Categories	Risk	Owner	Review Cadence	Human Oversight	Disclosure
Report summarization	Approved enterprise LLM	Aggregated report text only	Medium	Product	Quarterly	Required before delivery	Labeled in report
Internal code assist	Approved enterprise LLM	Code only (no customer data)	Low	Engineering	Quarterly	Developer review	N/A

The inventory is evidence for SOC 2 and is available for audit.

6. Responsible Technology Reviews

Every new or materially changed AI use case must complete a Responsible Technology Review using the template in Section 10 before production use. High-risk items require an AI Governance Lead and Compliance approval. Reviews are retained with the inventory.

7. Vendor Due Diligence for AI

All third-party AI providers undergo due diligence integrated with Catapult and Vanta Vendor Management before approval and annually thereafter (or upon material change).

Minimum Requirements

Contractual no-training clause covering all PlanTools, customer, Recordkeeper, and Participant data (inputs and outputs).
Preference for Zero Data Retention.
Current SOC 2 Type II or equivalent.
Data Processing Addendum meeting our privacy standards.
Audit rights, incident notification, and appropriate liability terms.
Model description, known limitations, and confirmation of training data sources.
Data flow mapping and permission inheritance confirmation.

Vendors unable to meet the no-training and contractual protections are prohibited for any use involving customer or Participant data. Ongoing monitoring includes security incidents, model changes, and subprocessor updates.

8. AI Transparency and Communication

In-product disclosure: Clear indicators when users interact with AI features (e.g., “AI-assisted,” “Generated with AI – review required”).
Report and output labeling: Any AI-generated or AI-assisted content in advisor reports, scorecards, or deliverables is labeled and includes appropriate caveats.
Documentation: Customer-facing materials and help content explain AI capabilities, limitations, data practices (including the no-training commitment), and human oversight.
Plain language: No marketing spin. Limitations, accuracy caveats, and “not fiduciary advice” statements are explicit where relevant.
Change communication: Material changes to AI data practices or features are communicated to affected customers and partners.
Internal communication: Share approved tools, prohibited practices, and policy updates with all staff.
Customer inquiries: Clear process for responding to questions about AI use, data handling, or specific outputs.

Transparency supports both Atlassian-style openness and the trust required by our customers’ fiduciary roles.

9. Roles, Training, Monitoring & Continuous Improvement

AI Governance Lead: Owns inventory, review process, vendor AI assessments, and policy.
Product & Engineering: Implement controls, permission inheritance, disclosures, and logging.
Security & Compliance: Align with SOC 2/Vanta, manage vendor reviews, support audits.
All staff: Follow acceptable use; never input customer or Participant data into unapproved tools.

Training on this policy and practical AI use is required for relevant roles and refreshed at least annually. Logging, incident response, and post-incident reviews apply to material AI issues. Review the policy and inventory at least quarterly.

10. PlanTools Responsible Technology Review Template

Instructions: Complete for every new or materially changed AI use case. Use traffic-light ratings. Retain with the AI Inventory.

Project / Use Case Summary

Use case name and description:
Owner:
Teams involved:
Intended users:
Data sources (Recordkeeper, Participant, Morningstar, DOL, SEC, Index Providers, other):
Third-party AI/model (if any):
Risk classification (Low / Medium / High):
Date / Reviewers: