江蘇林洋能源股份有限公司

Jiangsu Linyang Energy Co., Ltd.

人工智能應用管理規范制度

Artificial Intelligence Application Management Policy

文件編號：LY-IT-001    版本：V1.0    生效日期：2026年1月8日

Document No.: LY-IT-001    Version: V1.0    Effective Date: January 8, 2026

第一章　總則
Chapter 1  General Provisions

第一條　目的與適用范圍
Article 1  Purpose and Scope

為規范公司人工智能（AI）工具的引入、使用與采購，在提升效率與創新能力的同時，防范數據泄露、知識產權流失、合規違法及業務連續性風險，特制定本制度。本制度適用于公司全體員工、外包人員、合作伙伴，以及公司范圍內使用的各類 AI 工具與服務，包括通用大模型與 AI 對話寫作工具、AI 編程助手、AI 設計與翻譯工具、自研或私有化部署的模型，以及嵌入辦公、研發、生產系統的 AI 功能模塊。

This Policy regulates the introduction, use and procurement of artificial intelligence (AI) tools, so that while efficiency and innovation are improved, risks of data leakage, loss of intellectual property, non-compliance and business continuity are prevented. It applies to all employees, outsourced personnel and partners, and to all AI tools and services used within the Company, including general-purpose large models and AI dialogue and writing tools, AI coding assistants, AI design and translation tools, self-developed or privately deployed models, and AI functional modules embedded in office, R&D and production systems.

第二條　基本原則
Article 2  Basic Principles

1. 安全第一：AI 應用不得損害公司數據、系統與業務安全，安全管控優先于效率訴求。

1. Security first: AI applications shall not impair the security of the Company's data, systems or business; security control takes precedence over efficiency.

2. 最小權限：AI 工具、插件與 API 僅授予完成任務所必需的最小權限。

2. Least privilege: AI tools, plug-ins and APIs shall be granted only the minimum permissions necessary to complete the task.

3. 可追溯：AI 使用過程應可審計、可回溯，關鍵輸出須經人工核驗。

3. Traceability: AI use shall be auditable and traceable, and key outputs must be verified by a human.

4. 合規使用：遵守國家法律法規及行業監管要求，尊重第三方知識產權。

4. Compliant use: applicable laws, regulations and industry regulatory requirements shall be observed, and third-party intellectual property shall be respected.

5. 以人為本、透明可解釋、公平無歧視、責任可歸集：AI 輔助而非替代人的專業判斷與責任；對個人權益或重大經營事項有實質影響的 AI 決策應可解釋；訓練數據與輸出不得含有歧視性內容；每項 AI 應用均須明確業務、技術與數據負責人。

5. Human-centred, transparent and explainable, fair and non-discriminatory, and accountable: AI assists rather than replaces human professional judgement and responsibility; AI decisions materially affecting individual rights or significant business matters shall be explainable; training data and outputs shall contain no discriminatory content; and each AI application shall have designated business, technical and data owners.

第二章　組織與職責
Chapter 2  Organization and Responsibilities

公司建立“決策—管理—執行”三級 AI 治理組織，各方職責見表 1。

The Company establishes a three-tier AI governance structure of “decision – management – execution”, with responsibilities set out in Table 1.

第三章　分類分級管理
Chapter 3  Classification and Grading

第三條　AI 工具分級
Article 3  Grading of AI Tools

AI 工具按數據可控程度分為三級：L1 通用工具（公網 SaaS，數據可能留存或用于訓練）、L2 企業授權工具（采購企業版，數據不出域或明確不用于訓練）、L3 私有化或自研工具（部署于公司環境，數據完全受控）。

AI tools are graded into three levels by data controllability: L1 general-purpose tools (public-cloud SaaS, where data may be retained or used for training), L2 enterprise-licensed tools (enterprise edition procured, with data kept in-domain or expressly not used for training), and L3 private or self-developed tools (deployed in the Company's environment with fully controlled data).

第四條　數據分類分級與適配
Article 4  Data Classification and Adaptation

公司數據按敏感程度分為公開級、內部級、機密級、絕密級。公開級可用于任何級別工具；內部級僅可在 L2 及以上工具中處理；機密級僅可在 L3 工具中處理，且須經部門負責人與 AI 管理辦公室雙重批準；絕密級數據（含核心算法、芯片架構、未公開重大經營信息、重大訴訟材料）嚴禁輸入任何 AI 工具。適配關系見表 2。

Company data is classified by sensitivity into Public, Internal, Confidential and Strictly Confidential. Public data may be used in tools of any level; Internal data only in L2 and above; Confidential data only in L3 tools with dual approval by the department head and the AI Management Office; Strictly Confidential data (including core algorithms, chip architecture, undisclosed material operating information and material litigation materials) shall never be input into any AI tool. The adaptation matrix is set out in Table 2.

第四章　場景化管理要求
Chapter 4  Scenario-Based Management Requirements

第五條　日常辦公場景
Article 5  Daily Office Scenarios

1. 建立辦公類 AI 工具白名單，禁止名單外工具處理公司數據，禁止私自使用未授權工具繞過安全管控。

1. Establish a whitelist of office AI tools; tools outside the list are prohibited from processing Company data, and unauthorized tools shall not be used privately to circumvent security controls.

2. 禁止向公網 AI（L1）輸入企業敏感數據；含個人信息的材料須先脫敏。

2. Enterprise sensitive data shall not be input into public-cloud AI (L1); materials containing personal information must be de-identified first.

3. 優先采購企業版或私有化工具，確保數據不出域、不用于訓練；AI 輔助生成的文檔須人工復核后方可發布。

3. Enterprise or private-deployed tools shall be preferred to ensure data remains in-domain and is not used for training; documents generated with AI assistance shall be reviewed by a human before release.

第六條　軟件開發場景
Article 6  Software Development Scenarios

主要風險為源代碼與算法泄露、生成代碼含漏洞或硬編碼密鑰、開源許可證侵權、插件竊取代碼。管控要求：使用企業版 AI 編程助手并關閉代碼上傳訓練選項；AI 生成代碼須經測試掃描與人工評審后合入；含密鑰、核心算法與業務邏輯的敏感代碼嚴禁輸入公網 AI；對生成代碼開展開源成分與許可證掃描；AI 編程插件統一白名單管理。

Main risks are leakage of source code and algorithms, vulnerabilities or hard-coded keys in generated code, open-source licence infringement, and code theft through plug-ins. Controls: use enterprise AI coding assistants with training uploads disabled; AI-generated code may only be merged after test scanning and human review; sensitive code containing keys, core algorithms or business logic shall never enter public-cloud AI; conduct open-source component and licence scanning; centrally whitelist AI coding plug-ins.

第七條　硬件研發場景
Article 7  Hardware R&D Scenarios

主要風險為核心硬件 IP（原理圖、PCB、芯片架構、固件）泄露、第三方 IP 核含后門、仿真與良率數據被留存、AI 生成設計存在功能或安全缺陷。管控要求：研發環境實行“強隔離 + 私有化 AI”，禁止公網 AI 接觸核心設計資產；建立硬件 IP 分級保護，明確嚴禁進入任何 AI 工具的文件、參數與固件；AI 生成的電路、固件與測試腳本須經仿真驗證與功能安全評估；第三方 IP、固件須提供 SBOM 與安全評估報告；涉及人身安全或關鍵基礎設施的產品，最終決策須由資深工程師與功能安全團隊確認。

Main risks are leakage of core hardware IP (schematics, PCB, chip architecture, firmware), backdoors in third-party IP cores, third-party retention of simulation and yield data, and functional or safety defects in AI-generated designs. Controls: apply “strong isolation + private AI” in R&D environments and prohibit public-cloud AI from accessing core design assets; establish graded hardware IP protection and specify files, parameters and firmware that must never enter any AI tool; AI-generated circuits, firmware and test scripts must undergo simulation verification and functional safety assessment; third-party IP and firmware must be supported by an SBOM and security assessment report; for products involving personal safety or critical infrastructure, final decisions must be confirmed by senior engineers and the functional safety team.

第八條　人力資源與財務場景
Article 8  HR and Finance Scenarios

第九條　禁止使用的 AI 系統
Article 9  Prohibited AI Systems

參照《歐盟人工智能法案》等法規對不可接受風險 AI 實踐的規制，公司嚴格禁止引入、開發、部署或使用以下類型的 AI 系統：

With reference to the regulation of unacceptable-risk AI practices under the EU Artificial Intelligence Act and comparable legislation, the Company strictly prohibits the introduction, development, deployment or use of the following AI systems:

1. 操縱型 AI：使用潛意識、故意操縱或欺騙性技術，實質性扭曲個人行為，導致其作出非理性決策，并造成或可能造成重大損害的 AI 系統。

1. Manipulative AI: AI systems that deploy subliminal, deliberately manipulative or deceptive techniques to materially distort a person's behaviour, causing them to make decisions in an irrational manner, and causing or likely to cause significant harm.

2. 漏洞利用型 AI：利用年齡、殘疾或特定社會經濟狀況等脆弱性，實質性扭曲個人行為的 AI 系統。

2. Exploitation-of-vulnerability AI: AI systems that exploit vulnerabilities arising from age, disability or specific social or economic circumstances to materially distort a person's behaviour.

3. 社會評分型 AI：基于社會行為或個人特征，對個人或群體進行可信度評估或分類，導致其在與原數據產生情境無關的情形下受到有害對待，或產生不成比例、不合理結果的 AI 系統。

3. Social-scoring AI: AI systems that evaluate or classify individuals or groups based on social behaviour or personal characteristics, leading to detrimental treatment in social contexts unrelated to the context in which the data were originally generated, or to disproportionate or unjustified outcomes.

上述判斷由 AI 管理辦公室會同法務合規部在引入評估階段完成，并在影響評估中留存書面結論。對疑似屬于禁止類但用途正當的技術，須提交 AI 治理委員會專項審議，未經批準不得實施。

This determination is made by the AI Management Office together with the Legal & Compliance Department at the introduction-assessment stage, with the written conclusion retained in the impact assessment. Technologies that appear to fall within the prohibited categories but have a legitimate purpose shall be submitted for dedicated review by the AI Governance Committee and may not be implemented without approval.

第五章　采購與供應商管理
Chapter 5  Procurement and Supplier Management

第十條　采購審批與合同要求
Article 10  Procurement Approval and Contract Requirements

引入 AI 工具須履行安全評估與審批流程，評估內容包括數據安全、模型安全、合規性與退出機制。合同中應明確供應商的數據安全、保密、知識產權、責任劃分與數據刪除義務；優先選擇支持私有化部署、數據不留存、不用于訓練的企業級服務；對開源 AI 組件開展漏洞掃描、許可證檢查與供應鏈風險評估；建立供應商清單與定期復審機制，評估不合格的及時下線。

The introduction of AI tools shall follow a security assessment and approval process covering data security, model security, compliance and exit mechanisms. Contracts shall specify the supplier's obligations on data security, confidentiality, intellectual property, allocation of liability and data deletion; enterprise-grade services supporting private deployment, no data retention and no use for training shall be preferred; conduct vulnerability scanning, licence checks and supply chain risk assessment for open-source AI components; establish a supplier list and periodic re-review mechanism, and promptly take offline any supplier failing assessment.

第十一條　供應商盡職調查與條款
Article 11  Supplier Due Diligence and Clauses

引入 AI 工具前，AI 管理辦公室應會同法務合規部、采購部開展盡職調查，核查供應商主體資質、模型來源合法性、訓練數據合規性、安全事件歷史、跨境數據傳輸安排與退出后的數據刪除承諾，盡調報告作為采購決策依據，保存不少于十年。合同最低條款見表 3。

Before introducing an AI tool, the AI Management Office shall conduct due diligence together with the Legal & Compliance Department and the Procurement Department, examining the supplier's qualifications, legality of model sources, training data compliance, security incident history, cross-border data transfer arrangements and post-exit data deletion commitments; the report shall support the procurement decision and be kept for at least ten years. Minimum contract clauses are set out in Table 3.

第十二條　綠色 AI 要求
Article 12  Green AI Requirements

鑒于 AI 需求增長對數據中心能源消耗帶來的可持續性風險，公司在 AI 部署與采購中關注生態足跡，推動綠色低碳發展，具體要求如下：

Given the sustainability risks that growing AI demand poses to the energy consumption of data centres, the Company shall consider ecological footprint in AI deployment and procurement and promote green, low-carbon development, with the following requirements:

1. 能效優化：推廣模型壓縮、推理優化等技術以減少計算負載與能源浪費，優先選用節能基礎設施。

1. Energy efficiency: promote model compression, inference optimisation and similar techniques to reduce computational load and energy waste, and give priority to energy-efficient infrastructure.

2. 資源管理：測量并減少 AI 數據中心與模型的能源使用、水資源使用及碳強度。

2. Resource management: measure and reduce the energy use, water use and carbon intensity of AI data centres and models.

3. 可再生能源：鼓勵并要求供應商使用可再生能源，優先選擇具有低碳承諾的 AI 服務商。

3. Renewable energy: encourage and require suppliers to use renewable energy, and give priority to AI service providers with low-carbon commitments.

4. 生命周期評估：在 AI 工具引入與退出階段評估其環境影響，并納入供應商復審機制。

4. Life-cycle assessment: assess environmental impacts at the introduction and exit stages of AI tools, and incorporate the assessment into the supplier re-review mechanism.

第六章　數據與模型安全
Chapter 6  Data and Model Security

第十三條　數據與模型安全要求
Article 13  Data and Model Security Requirements

1. 建立數據脫敏機制，對輸入 AI 的敏感信息進行識別與自動遮蔽；自研、微調模型須使用合規、已授權、已脫敏的訓練數據。

1. Establish a data de-identification mechanism to identify and automatically mask sensitive information input into AI; self-developed and fine-tuned models shall use compliant, authorised and de-identified training data.

2. 防范提示詞注入、模型越獄與數據投毒，定期開展安全測試；對 AI 輸入輸出與調用行為保留審計日志。

2. Prevent prompt injection, model jailbreaking and data poisoning, and conduct regular security testing; retain audit logs of AI inputs, outputs and invocation behaviour.

3. 防范過度依賴與“自動化偏見”，關鍵決策須有人工復核環節。

3. Prevent over-reliance and “automation bias”; key decisions must include a human review step.

第十四條　公平與非歧視
Article 14  Fairness and Non-Discrimination

公司應在 AI 系統的設計與開發中確保公平和非歧視行為，避免因算法或數據導致的不公正對待，具體措施如下：

The Company shall ensure fair and non-discriminatory conduct in the design and development of AI systems, avoiding unfair treatment arising from algorithms or data, through the following measures:

1. 數據治理：識別并減輕訓練數據中的偏見，確保數據集的多樣性與代表性。

1. Data governance: identify and mitigate bias in training data, and ensure the diversity and representativeness of datasets.

2. 偏見審計：定期對 AI 模型開展偏見審計與評估，及時發現并糾正潛在的歧視性輸出。

2. Bias audits: conduct regular bias audits and assessments of AI models, promptly identifying and correcting potentially discriminatory outputs.

3. 持續監測：建立對 AI 決策結果的公平性監測機制，防范因年齡、性別、種族等因素產生的系統性偏差。

3. Continuous monitoring: establish a fairness monitoring mechanism for AI decision outcomes, preventing systematic bias arising from factors such as age, gender or ethnicity.

第十五條　影響評估與上線準入
Article 15  Impact Assessment and Go-Live Admission

新增或重大變更的 AI 應用上線前，須完成 AI 影響評估，內容包括：應用目的與必要性、涉及的數據類別與主體范圍、對個人權益與業務的影響程度、算法可解釋性、公平性與偏見測試結論、人工干預與退出機制、安全測試結論。評估由業務部門發起、AI 管理辦公室組織、法務合規部參與，經 AI 治理委員會或授權人員批準后方可上線；評估每年復核一次，應用發生重大變更時重新評估。

Before an AI application is newly introduced or materially changed, an AI impact assessment shall be completed, covering the purpose and necessity of the application, the categories of data and scope of data subjects, the degree of impact on individual rights and business, algorithmic explainability, fairness and bias testing conclusions, human intervention and exit mechanisms, and security testing conclusions. The assessment is initiated by the business department, organized by the AI Management Office and participated in by the Legal & Compliance Department, and go-live requires approval by the AI Governance Committee or authorised personnel. The assessment is reviewed annually and repeated upon material change.

第十六條　模型風險管理
Article 16  Model Risk Management

公司建立 AI 模型臺賬，逐項記錄模型名稱、版本、類型、用途、訓練數據來源、部署環境、責任人與上線日期。模型上線后至少每半年開展一次性能、偏差與公平性監測；發現顯著偏差或準確率下降的，應暫停使用并查明原因。模型退役時應歸檔模型說明與測試報告。

The Company maintains an AI model register recording, for each model, its name, version, type, purpose, source of training data, deployment environment, owner and go-live date. After go-live, performance, bias and fairness monitoring shall be conducted at least semi-annually; where significant bias or a decline in accuracy is found, use shall be suspended and the cause identified. Upon retirement, model documentation and test reports shall be archived.

第七章　監督、應急與申訴
Chapter 7  Supervision, Emergency Response and Appeals

第十七條　監測、審計與應急
Article 17  Monitoring, Audit and Emergency Response

通過 AI 安全網關、DLP、日志分析等手段對 AI 使用行為統一監控與定期審計，及時發現“影子 AI”與異常數據訪問。發生或疑似發生 AI 相關數據泄露、模型被攻擊、知識產權流失等事件的，使用者應立即上報信息部，按信息安全事件處置，包括止損、溯源、通知與整改。

AI usage shall be uniformly monitored and periodically audited through AI security gateways, DLP and log analysis, so that “shadow AI” and abnormal data access are promptly detected. Where an AI-related incident such as data leakage, model attack or loss of intellectual property occurs or is suspected, the user shall immediately report to the IT Department and handle it as an information security incident, including loss containment, tracing, notification and rectification.

第十八條　違規處置
Article 18  Handling of Violations

違反本制度的，視情節輕重采取口頭警示、書面警告、暫停 AI 工具使用權限、通報批評、績效扣減、賠償損失直至解除勞動合同等措施；涉嫌違法犯罪的移送司法機關。部門負責人未履行管理職責導致本部門發生違規的，一并追究管理責任。

Violations shall be handled according to severity by measures including verbal warning, written warning, suspension of AI tool access, internal reprimand, performance deduction, compensation for losses and, ultimately, termination of employment; suspected criminal conduct shall be referred to judicial authorities. Where a department head's failure to perform management duties leads to a violation, management responsibility shall also be pursued.

第十九條　異議與申訴
Article 19  Objections and Appeals

為保障員工、客戶、供應商、合作伙伴及其他相關方的合法權益，公司建立對 AI 決策或結論的異議與申訴機制。認為 AI 決策對其權益產生不利影響，或認為該決策存在錯誤、偏見、缺乏透明度或違法的，均有權提出異議并要求復核。

To protect the legitimate rights and interests of employees, customers, suppliers, partners and other stakeholders, the Company establishes a mechanism for objections to and appeals against AI decisions or conclusions. Anyone who considers that an AI decision adversely affects their rights, or that it is erroneous, biased, lacking in transparency or unlawful, may raise an objection and request review.

第二十條　渠道告知與公示
Article 20  Notification and Publication of Channels

公司應在官方網站、員工手冊、供應商合作協議及客戶服務條款中告知申訴機制與受理渠道，并在內部培訓中說明申訴流程；渠道信息變更的，于變更后十個工作日內更新公示內容。

The Company shall disclose the appeal mechanism and intake channels on its official website, in the employee handbook, in supplier cooperation agreements and in customer service terms, and shall explain the appeal process in internal training; where channel information changes, the published content shall be updated within ten working days.

第八章　附則
Chapter 8  Supplementary Provisions

第二十一條　制度關系與解釋
Article 21  Relationship with Other Policies and Interpretation

本制度與公司《信息安全管理制度》《數據分類分級管理辦法》《個人信息保護制度》《供應商管理規定》《商業道德與反賄賂反腐敗管理制度》配套執行，未盡事宜適用上述制度；如有沖突，以要求更嚴格者為準。本制度由信息部負責解釋與修訂，自發布之日起施行，各部門可據此制定實施細則。

This Policy is implemented together with the Company's Information Security Management Policy, Data Classification and Grading Management Measures, Personal Information Protection Policy, Supplier Management Regulations, and Business Ethics and Anti-Bribery and Anti-Corruption Management Policy; matters not covered are governed by those documents, and where conflicts arise the stricter requirement prevails. This Policy is interpreted and revised by the IT Department and takes effect on the date of issuance; departments may formulate implementing rules accordingly.

第二十二條　年度評估與培訓
Article 22  Annual Review and Training

信息部每年組織一次制度執行情況評估，內容包括執行有效性、AI 風險清單完整性、違規與申訴處理情況、監管要求變化，評估報告報 AI 治理委員會審議并作為修訂依據；遇法律法規重大變化、重大 AI 安全事件或業務模式重大調整時，及時啟動專項修訂。全體員工每年至少接受一次 AI 合規與安全培訓，新員工于入職三十日內完成；從事 AI 開發、運維與采購的人員應接受模型安全、數據合規、算法倫理與許可證管理專項培訓，培訓記錄保存不少于三年。

The IT Department shall organize an annual assessment of implementation, covering effectiveness, completeness of the AI risk register, handling of violations and appeals, and changes in regulatory requirements; the report is submitted to the AI Governance Committee and serves as the basis for revision, with dedicated revisions initiated promptly upon major legal changes, major AI security incidents or significant business model adjustments. All employees shall receive AI compliance and security training at least annually, and new hires within thirty days of onboarding; personnel engaged in AI development, operation and procurement shall receive specialized training on model security, data compliance, algorithm ethics and licence management, with training records kept for at least three years.