AI Policy: Do No Harm

Why This Matters

A client that opens its test results and SCADA logs to me is trusting that the tool I build on them will not be turned against the network those records describe. In the energy sector the system at the far end of a decision keeps a hospital lit or a pump running, so the rules have to be written down before the data arrives. I have adopted Anthropic's Usage Policy as my own rather than drafting a rival, because it says plainly what I already hold to: be open about what the system is, keep people safe, do no harm. What follows is a summary; the policy itself is the authority. Where the data lives and who can read it is on the trust page.

Universal Standards

These apply to every use of my AI services, whatever the application, and they are not negotiable.

Prohibited Uses

The following is prohibited when using any EthosPower service or tool:

Illegal Activities

• Drug trafficking or controlled substance distribution
• Human trafficking or exploitation
• Intellectual property theft or infringement
• Money laundering or financial crimes

Critical Infrastructure

• Attacking or compromising power grids, water systems, or telecommunications
• Interfering with medical devices or healthcare systems
• Disrupting transportation or logistics networks
• Compromising financial system infrastructure

Cybersecurity Threats

• Creating or distributing malware, viruses, or ransomware
• Unauthorised access to computer systems or networks
• Bypassing security controls or authentication systems
• Phishing, social engineering, or credential theft

Weapons & Violence

• Designing weapons, explosives, or incendiary devices
• Creating chemical, biological, or nuclear agents
• Providing instructions for violence or terrorism
• Inciting violence against individuals or groups

Harmful Content

• Child sexual abuse material (CSAM) in any form
• Hate speech targeting protected characteristics
• Extremist propaganda or radicalisation content
• Content designed to psychologically manipulate or harm

Privacy & Identity

• Unauthorised surveillance or tracking of individuals
• Facial recognition for mass surveillance or law enforcement without proper authorisation
• Identity theft or impersonation
• Doxing or publishing private information

Misinformation

• Generating fake news or deliberately false information
• Election interference or voter manipulation
• Creating deepfakes without disclosure
• Academic fraud or falsifying research

Fraud & Deception

• Scams, confidence schemes, or predatory practices
• Pyramid schemes or multi-level marketing fraud
• Deceptive advertising or hidden terms
• Market manipulation or insider trading

High-Risk Applications

If you are building in one of these domains, three further requirements apply. They match how I run everything I build, with a person signing off each decision:

Requirements for High-Risk Applications

1. Human Review: A qualified human expert must review AI outputs before they reach end users
2. AI Disclosure: You must clearly inform users that AI assisted in generating the output
3. Audit Trail: Maintain records of AI decisions for accountability and appeals

Consumer Applications

If you are building consumer-facing products on my AI services:

Chatbots & Assistants

• Users must know they're interacting with AI
• Don't impersonate real people without explicit consent
• Provide clear escalation paths to human support

Products for Minors

• Implement appropriate content filtering
• Comply with COPPA, GDPR-K, and other child protection laws
• Obtain parental consent where required

Agentic Systems

• AI agents must operate within defined boundaries
• Implement human oversight for consequential actions
• Ensure graceful failure modes

Enforcement

Consequences of a violation may include:

• Throttling: Reduced access to services
• Suspension: Temporary service interruption
• Termination: Permanent access removal
• Legal Action: For severe violations

If you become aware of a violation, your own or someone else's, report it to me at once.