江苏林洋能源股份有限公司人工智能应用管理规范制度

江苏林洋能源股份有限公司

Jiangsu Linyang Energy Co., Ltd.

人工智能应用管理规范制度

Artificial Intelligence Application Management Policy

文件编号：LY-IT-001    版本：V1.0    生效日期：2026年1月8日

Document No.: LY-IT-001    Version: V1.0    Effective Date: January 8, 2026

第一章　总则
Chapter 1  General Provisions

第一条　目的与适用范围
Article 1  Purpose and Scope

为规范公司人工智能（AI）工具的引入、使用与采购，在提升效率与创新能力的同时，防范数据泄露、知识产权流失、合规违法及业务连续性风险，特制定本制度。本制度适用于公司全体员工、外包人员、合作伙伴，以及公司范围内使用的各类 AI 工具与服务，包括通用大模型与 AI 对话写作工具、AI 编程助手、AI 设计与翻译工具、自研或私有化部署的模型，以及嵌入办公、研发、生产系统的 AI 功能模块。

This Policy regulates the introduction, use and procurement of artificial intelligence (AI) tools, so that while efficiency and innovation are improved, risks of data leakage, loss of intellectual property, non-compliance and business continuity are prevented. It applies to all employees, outsourced personnel and partners, and to all AI tools and services used within the Company, including general-purpose large models and AI dialogue and writing tools, AI coding assistants, AI design and translation tools, self-developed or privately deployed models, and AI functional modules embedded in office, R&D and production systems.

第二条　基本原则
Article 2  Basic Principles

1. 安全第一：AI 应用不得损害公司数据、系统与业务安全，安全管控优先于效率诉求。

1. Security first: AI applications shall not impair the security of the Company's data, systems or business; security control takes precedence over efficiency.

2. 最小权限：AI 工具、插件与 API 仅授予完成任务所必需的最小权限。

2. Least privilege: AI tools, plug-ins and APIs shall be granted only the minimum permissions necessary to complete the task.

3. 可追溯：AI 使用过程应可审计、可回溯，关键输出须经人工核验。

3. Traceability: AI use shall be auditable and traceable, and key outputs must be verified by a human.

4. 合规使用：遵守国家法律法规及行业监管要求，尊重第三方知识产权。

4. Compliant use: applicable laws, regulations and industry regulatory requirements shall be observed, and third-party intellectual property shall be respected.

5. 以人为本、透明可解释、公平无歧视、责任可归集：AI 辅助而非替代人的专业判断与责任；对个人权益或重大经营事项有实质影响的 AI 决策应可解释；训练数据与输出不得含有歧视性内容；每项 AI 应用均须明确业务、技术与数据负责人。

5. Human-centred, transparent and explainable, fair and non-discriminatory, and accountable: AI assists rather than replaces human professional judgement and responsibility; AI decisions materially affecting individual rights or significant business matters shall be explainable; training data and outputs shall contain no discriminatory content; and each AI application shall have designated business, technical and data owners.

第二章　组织与职责
Chapter 2  Organization and Responsibilities

公司建立“决策—管理—执行”三级 AI 治理组织，各方职责见表 1。

The Company establishes a three-tier AI governance structure of “decision – management – execution”, with responsibilities set out in Table 1.

第三章　分类分级管理
Chapter 3  Classification and Grading

第三条　AI 工具分级
Article 3  Grading of AI Tools

AI 工具按数据可控程度分为三级：L1 通用工具（公网 SaaS，数据可能留存或用于训练）、L2 企业授权工具（采购企业版，数据不出域或明确不用于训练）、L3 私有化或自研工具（部署于公司环境，数据完全受控）。

AI tools are graded into three levels by data controllability: L1 general-purpose tools (public-cloud SaaS, where data may be retained or used for training), L2 enterprise-licensed tools (enterprise edition procured, with data kept in-domain or expressly not used for training), and L3 private or self-developed tools (deployed in the Company's environment with fully controlled data).

第四条　数据分类分级与适配
Article 4  Data Classification and Adaptation

公司数据按敏感程度分为公开级、内部级、机密级、绝密级。公开级可用于任何级别工具；内部级仅可在 L2 及以上工具中处理；机密级仅可在 L3 工具中处理，且须经部门负责人与 AI 管理办公室双重批准；绝密级数据（含核心算法、芯片架构、未公开重大经营信息、重大诉讼材料）严禁输入任何 AI 工具。适配关系见表 2。

Company data is classified by sensitivity into Public, Internal, Confidential and Strictly Confidential. Public data may be used in tools of any level; Internal data only in L2 and above; Confidential data only in L3 tools with dual approval by the department head and the AI Management Office; Strictly Confidential data (including core algorithms, chip architecture, undisclosed material operating information and material litigation materials) shall never be input into any AI tool. The adaptation matrix is set out in Table 2.

第四章　场景化管理要求
Chapter 4  Scenario-Based Management Requirements

第五条　日常办公场景
Article 5  Daily Office Scenarios

1. 建立办公类 AI 工具白名单，禁止名单外工具处理公司数据，禁止私自使用未授权工具绕过安全管控。

1. Establish a whitelist of office AI tools; tools outside the list are prohibited from processing Company data, and unauthorized tools shall not be used privately to circumvent security controls.

2. 禁止向公网 AI（L1）输入企业敏感数据；含个人信息的材料须先脱敏。

2. Enterprise sensitive data shall not be input into public-cloud AI (L1); materials containing personal information must be de-identified first.

3. 优先采购企业版或私有化工具，确保数据不出域、不用于训练；AI 辅助生成的文档须人工复核后方可发布。

3. Enterprise or private-deployed tools shall be preferred to ensure data remains in-domain and is not used for training; documents generated with AI assistance shall be reviewed by a human before release.

第六条　软件开发场景
Article 6  Software Development Scenarios

主要风险为源代码与算法泄露、生成代码含漏洞或硬编码密钥、开源许可证侵权、插件窃取代码。管控要求：使用企业版 AI 编程助手并关闭代码上传训练选项；AI 生成代码须经测试扫描与人工评审后合入；含密钥、核心算法与业务逻辑的敏感代码严禁输入公网 AI；对生成代码开展开源成分与许可证扫描；AI 编程插件统一白名单管理。

Main risks are leakage of source code and algorithms, vulnerabilities or hard-coded keys in generated code, open-source licence infringement, and code theft through plug-ins. Controls: use enterprise AI coding assistants with training uploads disabled; AI-generated code may only be merged after test scanning and human review; sensitive code containing keys, core algorithms or business logic shall never enter public-cloud AI; conduct open-source component and licence scanning; centrally whitelist AI coding plug-ins.

第七条　硬件研发场景
Article 7  Hardware R&D Scenarios

主要风险为核心硬件 IP（原理图、PCB、芯片架构、固件）泄露、第三方 IP 核含后门、仿真与良率数据被留存、AI 生成设计存在功能或安全缺陷。管控要求：研发环境实行“强隔离 + 私有化 AI”，禁止公网 AI 接触核心设计资产；建立硬件 IP 分级保护，明确严禁进入任何 AI 工具的文件、参数与固件；AI 生成的电路、固件与测试脚本须经仿真验证与功能安全评估；第三方 IP、固件须提供 SBOM 与安全评估报告；涉及人身安全或关键基础设施的产品，最终决策须由资深工程师与功能安全团队确认。

Main risks are leakage of core hardware IP (schematics, PCB, chip architecture, firmware), backdoors in third-party IP cores, third-party retention of simulation and yield data, and functional or safety defects in AI-generated designs. Controls: apply “strong isolation + private AI” in R&D environments and prohibit public-cloud AI from accessing core design assets; establish graded hardware IP protection and specify files, parameters and firmware that must never enter any AI tool; AI-generated circuits, firmware and test scripts must undergo simulation verification and functional safety assessment; third-party IP and firmware must be supported by an SBOM and security assessment report; for products involving personal safety or critical infrastructure, final decisions must be confirmed by senior engineers and the functional safety team.

第八条　人力资源与财务场景
Article 8  HR and Finance Scenarios

第九条　禁止使用的 AI 系统
Article 9  Prohibited AI Systems

参照《欧盟人工智能法案》等法规对不可接受风险 AI 实践的规制，公司严格禁止引入、开发、部署或使用以下类型的 AI 系统：

With reference to the regulation of unacceptable-risk AI practices under the EU Artificial Intelligence Act and comparable legislation, the Company strictly prohibits the introduction, development, deployment or use of the following AI systems:

1. 操纵型 AI：使用潜意识、故意操纵或欺骗性技术，实质性扭曲个人行为，导致其作出非理性决策，并造成或可能造成重大损害的 AI 系统。

1. Manipulative AI: AI systems that deploy subliminal, deliberately manipulative or deceptive techniques to materially distort a person's behaviour, causing them to make decisions in an irrational manner, and causing or likely to cause significant harm.

2. 漏洞利用型 AI：利用年龄、残疾或特定社会经济状况等脆弱性，实质性扭曲个人行为的 AI 系统。

2. Exploitation-of-vulnerability AI: AI systems that exploit vulnerabilities arising from age, disability or specific social or economic circumstances to materially distort a person's behaviour.

3. 社会评分型 AI：基于社会行为或个人特征，对个人或群体进行可信度评估或分类，导致其在与原数据产生情境无关的情形下受到有害对待，或产生不成比例、不合理结果的 AI 系统。

3. Social-scoring AI: AI systems that evaluate or classify individuals or groups based on social behaviour or personal characteristics, leading to detrimental treatment in social contexts unrelated to the context in which the data were originally generated, or to disproportionate or unjustified outcomes.

上述判断由 AI 管理办公室会同法务合规部在引入评估阶段完成，并在影响评估中留存书面结论。对疑似属于禁止类但用途正当的技术，须提交 AI 治理委员会专项审议，未经批准不得实施。

This determination is made by the AI Management Office together with the Legal & Compliance Department at the introduction-assessment stage, with the written conclusion retained in the impact assessment. Technologies that appear to fall within the prohibited categories but have a legitimate purpose shall be submitted for dedicated review by the AI Governance Committee and may not be implemented without approval.

第五章　采购与供应商管理
Chapter 5  Procurement and Supplier Management

第十条　采购审批与合同要求
Article 10  Procurement Approval and Contract Requirements

引入 AI 工具须履行安全评估与审批流程，评估内容包括数据安全、模型安全、合规性与退出机制。合同中应明确供应商的数据安全、保密、知识产权、责任划分与数据删除义务；优先选择支持私有化部署、数据不留存、不用于训练的企业级服务；对开源 AI 组件开展漏洞扫描、许可证检查与供应链风险评估；建立供应商清单与定期复审机制，评估不合格的及时下线。

The introduction of AI tools shall follow a security assessment and approval process covering data security, model security, compliance and exit mechanisms. Contracts shall specify the supplier's obligations on data security, confidentiality, intellectual property, allocation of liability and data deletion; enterprise-grade services supporting private deployment, no data retention and no use for training shall be preferred; conduct vulnerability scanning, licence checks and supply chain risk assessment for open-source AI components; establish a supplier list and periodic re-review mechanism, and promptly take offline any supplier failing assessment.

第十一条　供应商尽职调查与条款
Article 11  Supplier Due Diligence and Clauses

引入 AI 工具前，AI 管理办公室应会同法务合规部、采购部开展尽职调查，核查供应商主体资质、模型来源合法性、训练数据合规性、安全事件历史、跨境数据传输安排与退出后的数据删除承诺，尽调报告作为采购决策依据，保存不少于十年。合同最低条款见表 3。

Before introducing an AI tool, the AI Management Office shall conduct due diligence together with the Legal & Compliance Department and the Procurement Department, examining the supplier's qualifications, legality of model sources, training data compliance, security incident history, cross-border data transfer arrangements and post-exit data deletion commitments; the report shall support the procurement decision and be kept for at least ten years. Minimum contract clauses are set out in Table 3.

第十二条　绿色 AI 要求
Article 12  Green AI Requirements

鉴于 AI 需求增长对数据中心能源消耗带来的可持续性风险，公司在 AI 部署与采购中关注生态足迹，推动绿色低碳发展，具体要求如下：

Given the sustainability risks that growing AI demand poses to the energy consumption of data centres, the Company shall consider ecological footprint in AI deployment and procurement and promote green, low-carbon development, with the following requirements:

1. 能效优化：推广模型压缩、推理优化等技术以减少计算负载与能源浪费，优先选用节能基础设施。

1. Energy efficiency: promote model compression, inference optimisation and similar techniques to reduce computational load and energy waste, and give priority to energy-efficient infrastructure.

2. 资源管理：测量并减少 AI 数据中心与模型的能源使用、水资源使用及碳强度。

2. Resource management: measure and reduce the energy use, water use and carbon intensity of AI data centres and models.

3. 可再生能源：鼓励并要求供应商使用可再生能源，优先选择具有低碳承诺的 AI 服务商。

3. Renewable energy: encourage and require suppliers to use renewable energy, and give priority to AI service providers with low-carbon commitments.

4. 生命周期评估：在 AI 工具引入与退出阶段评估其环境影响，并纳入供应商复审机制。

4. Life-cycle assessment: assess environmental impacts at the introduction and exit stages of AI tools, and incorporate the assessment into the supplier re-review mechanism.

第六章　数据与模型安全
Chapter 6  Data and Model Security

第十三条　数据与模型安全要求
Article 13  Data and Model Security Requirements

1. 建立数据脱敏机制，对输入 AI 的敏感信息进行识别与自动遮蔽；自研、微调模型须使用合规、已授权、已脱敏的训练数据。

1. Establish a data de-identification mechanism to identify and automatically mask sensitive information input into AI; self-developed and fine-tuned models shall use compliant, authorised and de-identified training data.

2. 防范提示词注入、模型越狱与数据投毒，定期开展安全测试；对 AI 输入输出与调用行为保留审计日志。

2. Prevent prompt injection, model jailbreaking and data poisoning, and conduct regular security testing; retain audit logs of AI inputs, outputs and invocation behaviour.

3. 防范过度依赖与“自动化偏见”，关键决策须有人工复核环节。

3. Prevent over-reliance and “automation bias”; key decisions must include a human review step.

第十四条　公平与非歧视
Article 14  Fairness and Non-Discrimination

公司应在 AI 系统的设计与开发中确保公平和非歧视行为，避免因算法或数据导致的不公正对待，具体措施如下：

The Company shall ensure fair and non-discriminatory conduct in the design and development of AI systems, avoiding unfair treatment arising from algorithms or data, through the following measures:

1. 数据治理：识别并减轻训练数据中的偏见，确保数据集的多样性与代表性。

1. Data governance: identify and mitigate bias in training data, and ensure the diversity and representativeness of datasets.

2. 偏见审计：定期对 AI 模型开展偏见审计与评估，及时发现并纠正潜在的歧视性输出。

2. Bias audits: conduct regular bias audits and assessments of AI models, promptly identifying and correcting potentially discriminatory outputs.

3. 持续监测：建立对 AI 决策结果的公平性监测机制，防范因年龄、性别、种族等因素产生的系统性偏差。

3. Continuous monitoring: establish a fairness monitoring mechanism for AI decision outcomes, preventing systematic bias arising from factors such as age, gender or ethnicity.

第十五条　影响评估与上线准入
Article 15  Impact Assessment and Go-Live Admission

新增或重大变更的 AI 应用上线前，须完成 AI 影响评估，内容包括：应用目的与必要性、涉及的数据类别与主体范围、对个人权益与业务的影响程度、算法可解释性、公平性与偏见测试结论、人工干预与退出机制、安全测试结论。评估由业务部门发起、AI 管理办公室组织、法务合规部参与，经 AI 治理委员会或授权人员批准后方可上线；评估每年复核一次，应用发生重大变更时重新评估。

Before an AI application is newly introduced or materially changed, an AI impact assessment shall be completed, covering the purpose and necessity of the application, the categories of data and scope of data subjects, the degree of impact on individual rights and business, algorithmic explainability, fairness and bias testing conclusions, human intervention and exit mechanisms, and security testing conclusions. The assessment is initiated by the business department, organized by the AI Management Office and participated in by the Legal & Compliance Department, and go-live requires approval by the AI Governance Committee or authorised personnel. The assessment is reviewed annually and repeated upon material change.

第十六条　模型风险管理
Article 16  Model Risk Management

公司建立 AI 模型台账，逐项记录模型名称、版本、类型、用途、训练数据来源、部署环境、责任人与上线日期。模型上线后至少每半年开展一次性能、偏差与公平性监测；发现显著偏差或准确率下降的，应暂停使用并查明原因。模型退役时应归档模型说明与测试报告。

The Company maintains an AI model register recording, for each model, its name, version, type, purpose, source of training data, deployment environment, owner and go-live date. After go-live, performance, bias and fairness monitoring shall be conducted at least semi-annually; where significant bias or a decline in accuracy is found, use shall be suspended and the cause identified. Upon retirement, model documentation and test reports shall be archived.

第七章　监督、应急与申诉
Chapter 7  Supervision, Emergency Response and Appeals

第十七条　监测、审计与应急
Article 17  Monitoring, Audit and Emergency Response

通过 AI 安全网关、DLP、日志分析等手段对 AI 使用行为统一监控与定期审计，及时发现“影子 AI”与异常数据访问。发生或疑似发生 AI 相关数据泄露、模型被攻击、知识产权流失等事件的，使用者应立即上报信息部，按信息安全事件处置，包括止损、溯源、通知与整改。

AI usage shall be uniformly monitored and periodically audited through AI security gateways, DLP and log analysis, so that “shadow AI” and abnormal data access are promptly detected. Where an AI-related incident such as data leakage, model attack or loss of intellectual property occurs or is suspected, the user shall immediately report to the IT Department and handle it as an information security incident, including loss containment, tracing, notification and rectification.

第十八条　违规处置
Article 18  Handling of Violations

违反本制度的，视情节轻重采取口头警示、书面警告、暂停 AI 工具使用权限、通报批评、绩效扣减、赔偿损失直至解除劳动合同等措施；涉嫌违法犯罪的移送司法机关。部门负责人未履行管理职责导致本部门发生违规的，一并追究管理责任。

Violations shall be handled according to severity by measures including verbal warning, written warning, suspension of AI tool access, internal reprimand, performance deduction, compensation for losses and, ultimately, termination of employment; suspected criminal conduct shall be referred to judicial authorities. Where a department head's failure to perform management duties leads to a violation, management responsibility shall also be pursued.

第十九条　异议与申诉
Article 19  Objections and Appeals

为保障员工、客户、供应商、合作伙伴及其他相关方的合法权益，公司建立对 AI 决策或结论的异议与申诉机制。认为 AI 决策对其权益产生不利影响，或认为该决策存在错误、偏见、缺乏透明度或违法的，均有权提出异议并要求复核。

To protect the legitimate rights and interests of employees, customers, suppliers, partners and other stakeholders, the Company establishes a mechanism for objections to and appeals against AI decisions or conclusions. Anyone who considers that an AI decision adversely affects their rights, or that it is erroneous, biased, lacking in transparency or unlawful, may raise an objection and request review.

第二十条　渠道告知与公示
Article 20  Notification and Publication of Channels

公司应在官方网站、员工手册、供应商合作协议及客户服务条款中告知申诉机制与受理渠道，并在内部培训中说明申诉流程；渠道信息变更的，于变更后十个工作日内更新公示内容。

The Company shall disclose the appeal mechanism and intake channels on its official website, in the employee handbook, in supplier cooperation agreements and in customer service terms, and shall explain the appeal process in internal training; where channel information changes, the published content shall be updated within ten working days.

第八章　附则
Chapter 8  Supplementary Provisions

第二十一条　制度关系与解释
Article 21  Relationship with Other Policies and Interpretation

本制度与公司《信息安全管理制度》《数据分类分级管理办法》《个人信息保护制度》《供应商管理规定》《商业道德与反贿赂反腐败管理制度》配套执行，未尽事宜适用上述制度；如有冲突，以要求更严格者为准。本制度由信息部负责解释与修订，自发布之日起施行，各部门可据此制定实施细则。

This Policy is implemented together with the Company's Information Security Management Policy, Data Classification and Grading Management Measures, Personal Information Protection Policy, Supplier Management Regulations, and Business Ethics and Anti-Bribery and Anti-Corruption Management Policy; matters not covered are governed by those documents, and where conflicts arise the stricter requirement prevails. This Policy is interpreted and revised by the IT Department and takes effect on the date of issuance; departments may formulate implementing rules accordingly.

第二十二条　年度评估与培训
Article 22  Annual Review and Training

信息部每年组织一次制度执行情况评估，内容包括执行有效性、AI 风险清单完整性、违规与申诉处理情况、监管要求变化，评估报告报 AI 治理委员会审议并作为修订依据；遇法律法规重大变化、重大 AI 安全事件或业务模式重大调整时，及时启动专项修订。全体员工每年至少接受一次 AI 合规与安全培训，新员工于入职三十日内完成；从事 AI 开发、运维与采购的人员应接受模型安全、数据合规、算法伦理与许可证管理专项培训，培训记录保存不少于三年。

The IT Department shall organize an annual assessment of implementation, covering effectiveness, completeness of the AI risk register, handling of violations and appeals, and changes in regulatory requirements; the report is submitted to the AI Governance Committee and serves as the basis for revision, with dedicated revisions initiated promptly upon major legal changes, major AI security incidents or significant business model adjustments. All employees shall receive AI compliance and security training at least annually, and new hires within thirty days of onboarding; personnel engaged in AI development, operation and procurement shall receive specialized training on model security, data compliance, algorithm ethics and licence management, with training records kept for at least three years.