MSA-level client

GSK

Restricted — Internal Only

GSK's schedule is one of the most detailed in the network: nothing gets treated as an 'AI System' in their work without written notice and agreement first, GSK owns everything an AI produces from their data, and any AI incident has to be reported within 48 hours.

Key requirement — GSK must give written agreement before any AI System is used in their services or deliverables. GSK owns all AI inputs/outputs from their data, and any AI incident must be reported within 48 hours. GSK's position is that MLR materials must not contain AI-generated content — flag any internal AI use to the account team regardless.

Permitted

Internal workflows only (no GSK data)
LynxAI Enterprise
Research, planning, and internal drafting with HITL

Not permitted

AI in materials going through medical/regulatory review
AI-generated content in client-facing deliverables without disclosure
Processing GSK confidential data through any AI
Modifying or changing any AI system connected to GSK data without prior written notice

Tool-by-tool approval

LynxAI

Internal only; no GSK data

Conditional

AVA

Internal only

Conditional

Microsoft Copilot

Internal workflows only

Conditional

NotebookLM

Internal use; no GSK data

Conditional

Vermeer

AI imagery not for client materials

Not permitted

Vurvey

Not permitted for client use

Not permitted

ElevenLabs

Not permitted for client use

Not permitted

HeyGen

Not permitted for client use

Not permitted

Runway

Not permitted for client use

Not permitted

Consumer AI

Not approved for client use

Not permitted