Linyang Energy丨Artificial Intelligence Application Management Policy

江苏林洋能源股份有限公司

Jiangsu Linyang Energy Co., Ltd.

人工智能应用管理规范制度

Artificial Intelligence Application Management Policy

文件编号：LY-IT-001    版本：V1.0    生效日期：2026年1月8日

Document No.: LY-IT-001    Version: V1.0    Effective Date: January 8, 2026

第一章　总则
Chapter 1  General Provisions

第一条　目的
Article 1  Purpose

为规范公司人工智能（AI）工具的引入、使用与管理，在充分利用 AI 提升工作效率与创新能力的同时，有效防范数据泄露、知识产权流失、合规违法及业务连续性等风险，保障公司信息资产安全，特制定本制度。

This Policy is formulated to regulate the introduction, use and management of artificial intelligence (AI) tools within the Company, so that while AI is fully leveraged to improve efficiency and innovation capacity, risks including data leakage, loss of intellectual property, non-compliance and business continuity disruption are effectively prevented and the security of the Company’s information assets is safeguarded.

第二条　适用范围
Article 2  Scope of Application

本制度适用于公司全体员工、外包人员、合作伙伴，以及公司范围内所使用的各类 AI 工具与服务，包括但不限于：

This Policy applies to all employees, outsourced personnel and partners of the Company, and to all AI tools and services used within the Company, including but not limited to:

• 通用大模型、AI 对话与写作工具；

• general-purpose large models, AI dialogue and writing tools;

• AI 编程助手、代码生成与审查工具；

• AI coding assistants, code generation and review tools;

• AI 设计、翻译、音视频生成工具；

• AI design, translation, and audio/video generation tools;

• 自研、微调或私有化部署的模型；

• self-developed, fine-tuned or privately deployed models;

• 嵌入办公、研发、生产系统的 AI 功能模块。

• AI functional modules embedded in office, R&D and production systems.

第三条　基本原则
Article 3  Basic Principles

1. 安全第一原则：AI 应用不得损害公司数据、系统与业务安全，安全管控优先于效率诉求。

1. Security first: AI applications shall not impair the security of the Company’s data, systems or business; security control takes precedence over efficiency demands.

2. 最小权限原则：AI 工具、插件、API 仅授予完成任务所必需的最小权限。

2. Least privilege: AI tools, plug-ins and APIs shall be granted only the minimum permissions necessary to complete the task.

3. 可追溯原则：AI 使用过程应可审计、可回溯，关键输出须经人工核验。

3. Traceability: AI use shall be auditable and traceable, and key outputs must be verified by a human.

4. 合规使用原则：遵守国家法律法规及行业监管要求，尊重第三方知识产权。

4. Compliant use: applicable laws, regulations and industry regulatory requirements shall be observed, and third-party intellectual property shall be respected.

第四条　治理原则的延伸
Article 4  Extension of Governance Principles

在第三条基本原则基础上，公司 AI 应用管理同时遵循以下原则：以人为本，AI 辅助而非替代人的专业判断与责任；透明可解释，对个人权益或重大经营事项产生实质影响的 AI 决策应具备可解释性；公平无歧视，AI 模型的训练数据与输出结果不得含有对性别、年龄、民族、地域、宗教、健康状况等的歧视性内容；责任可归集，每一项 AI 应用均须明确业务负责人、技术负责人与数据负责人。

In addition to the basic principles set out in Article 3, the Company’s AI application management also follows these principles: human-centred, with AI assisting rather than replacing human professional judgement and accountability; transparent and explainable, so that AI decisions that materially affect individual rights or significant business matters are explainable; fair and non-discriminatory, so that training data and outputs contain no discriminatory content on grounds of gender, age, ethnicity, region, religion or health status; and attributable responsibility, whereby every AI application has a designated business owner, technical owner and data owner.

第二章　组织与职责
Chapter 2  Organization and Responsibilities

公司建立“决策—管理—执行—监督”四级 AI 治理组织，明确各方职责。

The Company establishes a four-tier AI governance structure of “decision – management – execution – oversight” with clearly defined responsibilities.

第五条　AI 治理委员会
Article 5  AI Governance Committee

公司设立 AI 治理委员会，作为 AI 应用的决策机构，由总裁任主任委员，分管信息部的副总裁、首席财务官、总法律顾问、首席技术官及信息部负责人为委员。委员会每半年召开一次例会，必要时召开临时会议，主要职责包括：审议 AI 发展战略与年度工作计划；审批 L3 私有化及自研模型的立项与上线；审定 AI 风险清单与重大风险处置方案；审议涉及个人权益或重大经营影响的 AI 应用场景；决定 AI 相关重大对外沟通与披露口径。委员会决议以会议纪要形式留存，保存期限不少于十年。

The Company establishes an AI Governance Committee as the decision-making body for AI applications. It is chaired by the President, with the Vice President in charge of the IT Department, the Chief Financial Officer, the General Counsel, the Chief Technology Officer and the Head of the IT Department as members. The Committee holds a regular meeting semi-annually and convenes ad hoc meetings when necessary. Its main responsibilities include: reviewing the AI development strategy and annual work plan; approving the initiation and go-live of L3 private and self-developed models; approving the AI risk register and major risk response plans; reviewing AI application scenarios that affect individual rights or have significant business impact; and determining the approach to major external communication and disclosure relating to AI. Committee resolutions are recorded in minutes and retained for not less than ten years.

第六条　AI 管理办公室
Article 6  AI Management Office

AI 治理委员会下设 AI 管理办公室，设在信息部，作为日常管理机构，由信息部负责人兼任主任。AI 管理办公室负责牵头本制度的组织实施与年度评估，维护 AI 工具白名单与供应商清单，组织 AI 应用的安全评估与上线审批，汇总 AI 风险信息并按季度向委员会报告。

An AI Management Office is set up under the AI Governance Committee and housed in the IT Department as the day-to-day management body, headed concurrently by the Head of the IT Department. The AI Management Office takes the lead in organizing the implementation and annual review of this Policy, maintains the AI tool whitelist and supplier list, organizes security assessment and go-live approval for AI applications, consolidates AI risk information and reports quarterly to the Committee.

第七条　业务部门 AI 管理员
Article 7  AI Administrators of Business Departments

各业务部门应指定一名 AI 管理员，名单报 AI 管理办公室备案，人员变动时于十个工作日内更新。AI 管理员负责本部门 AI 工具申请与权限管理、使用台账维护、员工培训组织、自查自纠以及安全事件的初步核实与上报。

Each business department shall designate an AI administrator and file the name with the AI Management Office, updating it within ten working days of any change. The AI administrator is responsible for applying for and managing AI tools and permissions within the department, maintaining the usage ledger, organizing employee training, conducting self-inspection and self-correction, and preliminarily verifying and reporting security incidents.

第八条　人力资源部与法务合规部职责
Article 8  Responsibilities of HR and Legal & Compliance

人力资源部负责将 AI 使用规范纳入员工行为准则与入职培训，将 AI 合规表现纳入员工年度绩效考核，并按本制度规定处理违规行为。法务合规部负责 AI 相关合同条款审查、知识产权与开源许可证风险审核、个人信息保护合规评估，并牵头处理对 AI 决策或结论提出的异议与申诉。

The Human Resources Department incorporates AI use rules into the employee code of conduct and induction training, includes AI compliance performance in annual employee appraisal, and handles violations in accordance with this Policy. The Legal & Compliance Department is responsible for reviewing AI-related contract clauses, assessing intellectual property and open-source licence risks, evaluating personal information protection compliance, and taking the lead in handling objections and appeals against AI decisions or conclusions.

第三章　AI 工具与数据分类分级
Chapter 3  Classification and Grading of AI Tools and Data

第九条　AI 工具分级
Article 9  Grading of AI Tools

第十条　数据分类分级
Article 10  Data Classification and Grading

公司数据按敏感程度分为四级：公开级、内部级、机密级、绝密级。公开级数据可用于任何级别的 AI 工具；内部级数据仅可在 L2 及以上工具中处理；机密级数据仅可在 L3 工具中处理，且须经部门负责人与 AI 管理办公室双重批准；绝密级数据（含核心算法、芯片架构、未公开重大经营信息、重大诉讼材料）严禁输入任何 AI 工具。数据定级由数据产生部门负责，法务合规部与信息部负责监督执行。

Company data is classified into four levels by sensitivity: Public, Internal, Confidential and Strictly Confidential. Public data may be used in AI tools of any level; Internal data may only be processed in L2 or higher tools; Confidential data may only be processed in L3 tools and requires dual approval by the department head and the AI Management Office; Strictly Confidential data (including core algorithms, chip architecture, undisclosed material business information and material litigation materials) is strictly prohibited from being input into any AI tool. Data classification is the responsibility of the department that generates the data, with the Legal & Compliance Department and the IT Department overseeing implementation.

第十一条　分级适配矩阵
Article 11  Classification-Adaptation Matrix

第四章　场景化管理要求
Chapter 4  Scenario-Based Management Requirements

第一节　日常办公场景
Section 1  Daily Office Scenarios

适用于行政、人力、财务、法务、市场等岗位使用 AI 进行写作、会议纪要、翻译、设计、合同辅助等。

Applies to administrative, HR, finance, legal, marketing and other positions using AI for writing, meeting minutes, translation, design and contract support.

第十二条　管控要求
Article 12  Control Requirements

1. 建立办公类 AI 工具白名单，禁止名单外工具处理公司数据。

1. Establish a whitelist of office AI tools; tools outside the list are prohibited from processing Company data.

2. 禁止私自使用未授权工具，绕过安全管控。

2. Unauthorized tools shall not be used privately in circumvention of security controls.

3. 应避免敏感数据外泄，禁止向公网 AI（L1）输入企业敏感数据；保障隐私合规安全，含个人信息的材料须先脱敏。

3. Sensitive data leakage shall be avoided; enterprise sensitive data shall not be input into public-cloud AI (L1); privacy compliance shall be ensured and materials containing personal information must be de-identified first.

4. 优先采购企业版 / 私有化工具，确保数据不出域、不用于训练。

4. Enterprise or private-deployed tools shall be preferred to ensure data does not leave the domain and is not used for training.

5. 由 AI 辅助生成的文档内容，应经过人工复核才能发布使用，避免 AI 幻觉导致的数据错误。

5. Documents generated with AI assistance shall be reviewed by a human before release and use, to avoid data errors caused by AI hallucination.

第二节　软件开发场景
Section 2  Software Development Scenarios

适用于应用开发、平台开发、算法研发等使用 AI 代码补全、代码审查、测试生成、文档生成等。

Applies to application development, platform development and algorithm R&D using AI for code completion, code review, test generation and documentation generation.

第十三条　主要风险
Article 13  Main Risks

• 源代码与算法泄露；

• leakage of source code and algorithms;

• 生成代码含安全漏洞或硬编码密钥；

• security vulnerabilities or hard-coded keys in generated code;

• 开源许可证侵权（GPL/AGPL 等传染性协议）；

• open-source licence infringement (copyleft licences such as GPL/AGPL);

• 开发工具链被劫持，插件窃取代码与数据。

• hijacking of the development toolchain and theft of code and data through plug-ins.

第十四条　管控要求
Article 14  Control Requirements

1. 使用企业版 AI 编程助手，关闭代码上传训练选项，或采用本地/私有化模型。

1. Use enterprise AI coding assistants with the code-upload-for-training option disabled, or adopt local/private models.

2. AI 生成代码须经测试扫描与人工 Code Review 后方可合入。

2. AI-generated code may only be merged after test scanning and human code review.

3. 含密钥、核心算法、业务逻辑的敏感代码严禁输入公网 AI。

3. Sensitive code containing keys, core algorithms or business logic shall never be input into public-cloud AI.

4. 对 AI 生成代码开展开源成分与许可证扫描，防范许可证风险。

4. Conduct open-source component and licence scanning on AI-generated code to mitigate licence risk.

5. 统一管理与白名单控制 AI 编程插件，禁止私自安装。

5. Centrally manage and whitelist AI coding plug-ins; private installation is prohibited.

第三节　硬件研发场景
Section 3  Hardware R&D Scenarios

适用于芯片、嵌入式、硬件平台、IoT、工业控制等使用 AI 辅助电路设计、PCB 布局、仿真、固件生成、测试脚本、故障诊断等。

Applies to chips, embedded systems, hardware platforms, IoT and industrial control using AI for circuit design, PCB layout, simulation, firmware generation, test s and fault diagnosis.

第十五条　主要风险
Article 15  Main Risks

• 核心硬件 IP（原理图、PCB、芯片架构、固件）泄露；

• leakage of core hardware IP (schematics, PCB, chip architecture, firmware);

• 第三方 IP 核、固件模块含后门或恶意逻辑；

• backdoors or malicious logic in third-party IP cores and firmware modules;

• 仿真、测试、良率数据被第三方留存；

• retention by third parties of simulation, test and yield data;

• AI 生成设计存在缺陷，引发功能/安全事故；

• defects in AI-generated designs causing functional or safety accidents;

• 涉及人身安全、关键基础设施时的物理安全风险。

• physical safety risks where personal safety or critical infrastructure is involved.

第十六条　管控要求
Article 16  Control Requirements

1. 硬件研发环境实行“强隔离 + 私有化 AI”，禁止公网 AI 接触核心设计资产。

1. The hardware R&D environment applies “strong isolation + private AI”; public-cloud AI is prohibited from accessing core design assets.

2. 建立硬件 IP 分级保护，明确严禁进入任何 AI 工具的文件、参数与固件。

2. Establish graded protection of hardware IP and specify the files, parameters and firmware that must never enter any AI tool.

3. AI 生成的电路、固件、测试脚本须经仿真验证、功能安全评估与严格测试。

3. AI-generated circuits, firmware and test s must undergo simulation verification, functional safety assessment and rigorous testing.

4. 引入第三方 IP/固件须提供 SBOM 与安全评估报告，并做独立审计。

4. Third-party IP and firmware must be supported by an SBOM and security assessment report, and be subject to independent audit.

5. 涉及人身安全、关键基础设施的产品，最终决策须由资深工程师与功能安全团队确认。

5. For products involving personal safety or critical infrastructure, the final decision must be confirmed by senior engineers and the functional safety team.

第四节　人力资源与财务场景
Section 4  HR and Finance Scenarios

本制度新增人力资源管理场景与财务管理场景的专门要求，以规范 AI 在涉及个人权益与财务判断事项中的使用。

This Policy adds dedicated requirements for human resources and finance scenarios, to regulate AI use in matters involving individual rights and financial judgement.

第五章　采购与供应商管理
Chapter 5  Procurement and Supplier Management

1. 引入 AI 工具须履行安全评估与审批流程，评估内容包括数据安全、模型安全、合规性与退出机制。

1. The introduction of AI tools shall follow a security assessment and approval process covering data security, model security, compliance and exit mechanisms.

2. 在合同中明确供应商的数据安全、保密、知识产权、责任划分与数据删除义务。

2. Contracts shall specify the supplier’s obligations on data security, confidentiality, intellectual property, allocation of liability and data deletion.

3. 优先选择支持私有化部署、数据不留存、不用于训练的企业级服务。

3. Enterprise-grade services supporting private deployment, no data retention and no use for training shall be preferred.

4. 对开源 AI 组件开展漏洞扫描、许可证检查与供应链风险评估。

4. Conduct vulnerability scanning, licence checks and supply chain risk assessment for open-source AI components.

5. 建立供应商清单与定期复审机制，评估不合格的及时下线。

5. Establish a supplier list and periodic re-review mechanism, and promptly take offline any supplier failing assessment.

第十七条　供应商 AI 尽职调查
Article 17  Supplier AI Due Diligence

引入 AI 工具前，AI 管理办公室应会同法务合规部、采购部开展尽职调查，核查供应商的主体资质、模型来源合法性、训练数据合规性、安全事件历史、跨境数据传输安排与退出后的数据删除承诺。尽调结果形成书面报告，作为采购决策依据，保存期限不少于十年。

Before introducing an AI tool, the AI Management Office shall conduct due diligence together with the Legal & Compliance Department and the Procurement Department, examining the supplier’s qualifications, legality of model sources, compliance of training data, security incident history, cross-border data transfer arrangements and data deletion commitments upon exit. The results are documented in a written report serving as the basis for procurement decisions and retained for not less than ten years.

第十八条　供应商 AI 条款清单
Article 18  Checklist of Supplier AI Clauses

第六章　数据与模型安全
Chapter 6  Data and Model Security

1. 建立数据脱敏机制，对输入 AI 的敏感信息进行识别与自动遮蔽。

1. Establish a data de-identification mechanism to identify and automatically mask sensitive information input into AI.

2. 自研/微调模型须使用合规、已授权、已脱敏的训练数据。

2. Self-developed and fine-tuned models shall use compliant, authorised and de-identified training data.

3. 防范提示词注入、模型越狱与数据投毒，定期开展安全测试。

3. Prevent prompt injection, model jailbreaking and data poisoning, and conduct regular security testing.

4. 对 AI 输入输出、调用行为保留审计日志，满足追溯要求。

4. Retain audit logs of AI inputs, outputs and invocation behaviour to meet traceability requirements.

5. 防范过度依赖与“自动化偏见”，关键决策须有人工复核环节。

5. Prevent over-reliance and “automation bias”; key decisions must include a human review step.

第十九条　影响评估与上线准入
Article 19  Impact Assessment and Go-Live Admission

新增或重大变更 AI 应用上线前，应完成 AI 影响评估，评估内容包括：应用目的与必要性、涉及的数据类别与主体范围、对个人权益与业务的影响程度、算法可解释性、人工干预与退出机制、安全测试结论。评估由业务部门发起，AI 管理办公室组织，法务合规部参与，评估报告须经 AI 治理委员会或授权人员批准后方可上线。影响评估每年复核一次，应用发生重大变更时重新评估。

Before an AI application is newly introduced or materially changed, an AI impact assessment shall be completed, covering the purpose and necessity of the application, the categories of data and scope of data subjects involved, the degree of impact on individual rights and business, algorithmic explainability, human intervention and exit mechanisms, and security testing conclusions. The assessment is initiated by the business department, organized by the AI Management Office and participated in by the Legal & Compliance Department; the application may only go live after the assessment report is approved by the AI Governance Committee or an authorized person. The impact assessment is reviewed annually and re-performed upon material change of the application.

第二十条　模型风险管理
Article 20  Model Risk Management

公司建立 AI 模型台账，逐项记录模型名称、版本、类型、用途、训练数据来源、部署环境、责任人与上线日期。模型上线后至少每半年开展一次性能与偏差监测，重点检验输出准确率、稳定性与群体公平性；监测发现显著偏差或准确率下降的，应暂停使用并查明原因。模型退役时应按档案管理要求归档模型说明与测试报告。

The Company maintains an AI model register recording, for each model, its name, version, type, purpose, source of training data, deployment environment, owner and go-live date. After go-live, performance and bias monitoring shall be carried out at least semi-annually, focusing on output accuracy, stability and group fairness; where significant bias or accuracy degradation is detected, use shall be suspended and the cause identified. When a model is retired, its deion and test reports shall be archived in accordance with records management requirements.

第七章　监督、应急与违规处置
Chapter 7  Supervision, Emergency Response and Violation Handling

第二十一条　监测与审计
Article 21  Monitoring and Audit

通过 AI 安全网关、DLP、日志分析等手段，对 AI 使用行为进行统一监控与定期审计，及时发现“影子 AI”与异常数据访问。

Through AI security gateways, DLP, log analysis and other means, AI usage shall be uniformly monitored and periodically audited, so that “shadow AI” and abnormal data access are promptly detected.

第二十二条　安全事件应急
Article 22  Security Incident Emergency Response

发生或疑似发生 AI 相关数据泄露、模型被攻击、知识产权流失等事件时，使用者应立即上报信息部，按信息安全事件处置，包括止损、溯源、通知与整改。

Where an AI-related incident such as data leakage, model attack or loss of intellectual property occurs or is suspected, the user shall immediately report it to the IT Department and handle it as an information security incident, including loss containment, tracing, notification and rectification.

第二十三条　违规处置
Article 23  Handling of Violations

违反本制度的行为，视情节轻重采取口头警示、书面警告、暂停 AI 工具使用权限、通报批评、绩效扣减、赔偿损失直至解除劳动合同等处理措施；涉嫌违法犯罪的，移送司法机关。部门负责人未履行管理职责导致本部门发生违规行为的，一并追究管理责任。

Violations of this Policy shall be handled according to the severity of the circumstances by measures including verbal warning, written warning, suspension of AI tool access, internal reprimand, performance deduction, compensation for losses and, ultimately, termination of the employment contract; suspected criminal conduct shall be referred to judicial authorities. Where a department head fails to perform management duties and thereby causes a violation in the department, managerial responsibility shall also be pursued.

第二十四条　对 AI 决策或结论的异议与申诉
Article 24  Objections and Appeals against AI Decisions or Conclusions

为保障员工、客户、供应商、合作伙伴及其他相关方的合法权益，公司建立对 AI 决策或结论提出异议的申诉机制。任何个人或组织认为公司使用 AI 作出的决策或结论对其权益产生不利影响，或认为该决策或结论存在错误、偏见、缺乏透明度或违反法律法规的，均有权提出异议并要求复核。

To protect the legitimate rights and interests of employees, customers, suppliers, partners and other stakeholders, the Company establishes an appeal mechanism for objections to AI decisions or conclusions. Any individual or organization that considers that an AI-based decision or conclusion of the Company adversely affects its rights and interests, or that such decision or conclusion is erroneous, biased, insufficiently transparent or in breach of laws and regulations, has the right to raise an objection and request review.

（一）适用情形。本条适用于以下 AI 决策或结论：自动化简历筛选与人员评价结果；AI 辅助形成的信用评级、供应商准入或退出建议；基于 AI 分析的客户服务结论、投诉处理结果；AI 生成的合同审查意见、合规判定意见；涉及个人数据处理或画像分析的结果；其他对个人或相关方权益产生实质影响的 AI 决策。

(1) Scope. This Article applies to the following AI decisions or conclusions: automated CV screening and personnel evaluation results; credit ratings and supplier admission or exit recommendations produced with AI assistance; customer service conclusions and complaint handling outcomes based on AI analysis; AI-generated contract review opinions and compliance determinations; results involving personal data processing or profiling; and other AI decisions that materially affect the rights of individuals or stakeholders.

（二）申诉受理渠道。公司设立统一受理渠道，包括：专用电子邮箱 marketing@linyang.com；书面信函寄送至公司法务部，并注明“AI 决策异议”；向所在部门 AI 管理员或人力资源部当面提出，由接收方于两个工作日内转交法务合规部。匿名申诉应予受理，但可能影响核实与反馈的效果。

(2) Channels. The Company sets up unified intake channels: a dedicated mailbox marketing@linyang.com; written correspondence to the Securities and Legal Department marked “AI Decision Objection”; and oral submission to the AI administrator of the department concerned or to the Human Resources Department, which shall forward it to the Legal Department within two working days. Anonymous appeals shall be accepted, although this may affect verification and feedback.

（三）申诉内容要求。申诉人应说明所涉 AI 决策或结论的基本情况（时间、场景、涉及部门）、受影响的具体权益、异议理由，并可提供相关证明材料。申诉人确有困难无法书面表达的，受理人员应协助记录。

(3) Content requirements. The appellant shall describe the basic circumstances of the AI decision or conclusion concerned (time, scenario, department involved), the specific rights affected and the grounds for objection, and may provide supporting materials. Where the appellant is genuinely unable to express the appeal in writing, the receiving staff shall assist in recording it.

（四）受理与时限。法务合规部应在收到申诉后三个工作日内完成登记并告知申诉人是否受理；不予受理的应说明理由。受理后应在十五个工作日内完成初步核查并反馈处理意见；情况复杂需延长的，经分管副总裁批准可延长十五个工作日，并书面告知申诉人。涉及重大权益、群体性影响或可能引发诉讼的申诉，应在受理后二十四小时内报告总裁及 AI 治理委员会。

(4) Acceptance and time limits. The Legal & Compliance Department shall register the appeal within three working days of receipt and inform the appellant whether it is accepted, giving reasons if not. Once accepted, preliminary verification shall be completed and the handling opinion fed back within fifteen working days; where the matter is complex and extension is needed, it may be extended by fifteen working days with the approval of the Vice President in charge, with written notice to the appellant. Appeals involving material rights, group impact or possible litigation shall be reported to the President and the AI Governance Committee within twenty-four hours of acceptance.

（五）核查程序。核查由法务合规部牵头，业务部门、信息部与人力资源部配合。核查内容包括：AI 决策所依据的数据是否准确完整；模型输出是否符合既定规则与业务逻辑；是否存在算法偏差或歧视；人工复核环节是否履职；相关决策是否符合法律法规与公司制度。核查过程应形成书面记录，充分听取申诉人意见，必要时组织技术复现与专家评审。

(5) Verification procedure. Verification is led by the Legal & Compliance Department with the cooperation of the business department, the IT Department and the Human Resources Department. It covers whether the data underlying the AI decision is accurate and complete; whether model outputs conform to established rules and business logic; whether algorithmic bias or discrimination exists; whether the human review step was properly performed; and whether the decision complies with laws, regulations and Company policies. A written record shall be kept, the appellant’s views shall be fully heard, and technical reproduction and expert review may be arranged where necessary.

（六）处理结果。核查结论分为三类：原决策或结论正确，维持不变；存在瑕疵但不影响实质结论，予以补正并说明；存在错误、偏差或违法情形，予以撤销或重新作出决定，并采取补救措施。处理结果应以书面形式送达申诉人，载明事实认定、依据与救济途径。因 AI 决策错误给相关方造成损失的，公司依法依约承担相应责任。

(6) Outcome. Verification conclusions fall into three categories: the original decision or conclusion is correct and is upheld; it contains flaws that do not affect the substantive conclusion, in which case it is corrected with explanation; or it involves error, bias or illegality, in which case it is revoked or re-determined and remedial measures are taken. The outcome shall be delivered to the appellant in writing, stating the findings of fact, the basis and the remedies available. Where losses are caused to a stakeholder by an erroneous AI decision, the Company shall bear corresponding liability in accordance with law and contract.

（七）复核与救济。申诉人对处理结果不服的，可在收到结果后十五个工作日内向 AI 治理委员会申请复核，委员会应在三十个工作日内作出复核决定，该决定为最终内部结论。申诉人仍不满意的，可依法向有关主管部门投诉、申请仲裁或提起诉讼。申诉不影响其行使其他法定权利。

(7) Review and remedies. An appellant dissatisfied with the outcome may apply to the AI Governance Committee for review within fifteen working days of receipt; the Committee shall decide within thirty working days, and that decision is the final internal conclusion. An appellant still dissatisfied may complain to the competent authorities, apply for arbitration or bring litigation in accordance with law. An appeal does not affect the exercise of other statutory rights.

（八）人工复核优先。对于影响个人重大权益的 AI 决策，在申诉处理期间，如继续执行可能造成难以弥补的损害，经法务合规部批准可暂缓执行，改由人工重新审查后作出决定。公司不得以 AI 自动生成结果为由拒绝提供人工复核。

(8) Priority of human review. For AI decisions affecting material individual rights, where continued implementation during the appeal may cause irreparable harm, implementation may be suspended upon approval of the Legal & Compliance Department and the matter re-determined by human review. The Company shall not refuse human review on the ground that the result was automatically generated by AI.

（九）申诉人保护。公司严禁因申诉、举报或作证而对申诉人及其近亲属实施任何形式的打击报复，包括但不限于降职、调岗、扣减薪酬、解除劳动合同或取消合作资格。违反规定的，按本制度第二十三条从重处理。申诉材料与核查记录按保密文件管理，保存期限不少于十年。

(9) Protection of appellants. The Company strictly prohibits any form of retaliation against appellants and their close relatives for appealing, reporting or testifying, including but not limited to demotion, transfer, salary deduction, termination of employment or disqualification as a partner. Violations shall be handled severely in accordance with Article 23. Appeal materials and verification records are managed as confidential documents and retained for not less than ten years.

第二十五条　申诉渠道告知与公示
Article 25  Notification and Publication of Appeal Channels

公司应在官方网站、员工手册、供应商合作协议及客户服务条款中告知本条申诉机制与受理渠道，并在内部培训中说明申诉流程。申诉渠道信息发生变更的，应在变更后十个工作日内更新公示内容。

The Company shall disclose this appeal mechanism and the intake channels on its official website, in the employee handbook, in supplier cooperation agreements and in customer service terms, and shall explain the appeal process in internal training. Where the appeal channel information changes, the published content shall be updated within ten working days.

第八章　附则
Chapter 8  Supplementary Provisions

1. 本制度是公司 AI 治理的基础性文件，各部门可据此制定实施细则。

1. This Policy is the foundational document of the Company’s AI governance, and departments may formulate implementing rules accordingly.

2. 本制度由信息部负责解释与修订。

2. This Policy is interpreted and revised by the IT Department.

3. 本制度自发布之日起施行。

3. This Policy takes effect on the date of issuance.

第二十六条　与相关制度的关系
Article 26  Relationship with Related Policies

本制度与公司《信息安全管理制度》《数据分类分级管理办法》《个人信息保护制度》《供应商管理规定》《商业道德与反贿赂反腐败管理制度》配套执行。本制度未尽事宜，适用上述制度的规定；如有冲突，以要求更严格者为准。

This Policy is implemented together with the Company’s Information Security Management Policy, Data Classification and Grading Management Measures, Personal Information Protection Policy, Supplier Management Regulations, and Business Ethics and Anti-Bribery and Anti-Corruption Management Policy. Matters not covered herein are governed by those policies; in the event of conflict, the stricter requirement prevails.

第二十七条　年度评估与修订
Article 27  Annual Review and Revision

信息部应每年组织对本制度的执行情况开展一次评估，评估内容包括制度执行的有效性、AI 风险清单的完整性、违规事件与申诉处理情况、监管要求的变化。评估报告报 AI 治理委员会审议，并作为制度修订的依据。遇法律法规重大变化、重大 AI 安全事件或业务模式重大调整时，应及时启动专项修订。

The IT Department shall organize an annual assessment of the implementation of this Policy, covering the effectiveness of implementation, the completeness of the AI risk register, the handling of violations and appeals, and changes in regulatory requirements. The assessment report is submitted to the AI Governance Committee for review and serves as the basis for revision. A dedicated revision shall be initiated promptly upon material changes in laws or regulations, major AI security incidents or significant adjustments to the business model.

第二十八条　培训要求
Article 28  Training Requirements

全体员工每年应至少接受一次 AI 合规与安全培训，新入职员工应在入职三十日内完成培训。从事 AI 开发、运维与采购的人员应接受专项培训，内容包括模型安全、数据合规、算法伦理与许可证管理。培训记录由人力资源部归档保存，保存期限不少于三年。

All employees shall receive AI compliance and security training at least once a year, and new hires shall complete training within thirty days of onboarding. Personnel engaged in AI development, operation and procurement shall receive specialized training covering model security, data compliance, algorithmic ethics and licence management. Training records are archived by the Human Resources Department for not less than three years.