Insights
Safe AI use at work starts with clear rules
Set rules for AI tools and the information staff enter, with a review process for anything the business will rely on.
Someone wants help rewriting an email. Another person wants to summarize a meeting. A manager is looking at an AI tool that can search company documents. These requests may all be described as “using AI,” but they need different decisions.
Staff need to know which uses are approved and which require a review. Begin with the tasks people want to do now. Add others as you assess them.
Approve the use as well as the tool
Keep a short list of approved services, the accounts staff should use and the tasks permitted in each one. Approval to draft public marketing copy should not automatically extend to uploading personnel files.
For each proposed use, ask what information will be entered, who can access it, how long it is retained and whether the provider may use it to improve its models. Check the actual service terms and settings. A familiar brand or paid subscription alone does not answer those questions.
Show people what to leave out
The Canadian Centre for Cyber Security warns that prompts can expose sensitive business or personal information. It also cautions that generated answers can be wrong.
Translate that into examples your staff recognize. For an ordinary drafting task, use an invented scenario instead of pasting a client email, patient record, payroll spreadsheet or confidential agreement. Removing a person's name may still leave enough detail to identify them.
For example, ask for a polite response to a delayed delivery using fictional details. Then add the real order information yourself in the approved business system. The AI service does not need the real client details to help with the wording.
Make review part of the task
Decide who checks the result before it is sent, published or used. They should verify facts, calculations, references and promises the organization would be making. A confident answer is not evidence that a statement is correct.
For hiring, healthcare, legal or financial decisions, ordinary proofreading is not an adequate review process. Put those proposed uses through a separate assessment with the appropriate professional, privacy and management input before approving them.
Canada's privacy commissioners' generative AI principles explain that applicable privacy obligations continue to apply when organizations use these tools, with particular concern for uses that significantly affect people.
Treat connected AI as a separate request
An assistant that can read a mailbox, change a record or send a message needs more scrutiny than a tool drafting text from an invented example. Review the permissions, limit access to what the task needs and decide which actions require human approval. Include a way to stop it if it behaves unexpectedly.
Give staff an easy route to ask for help
Your first policy can be brief. List approved uses, information that must stay out, the required review and a named contact for questions or accidental disclosure. Ask people to report mistakes promptly so the organization can assess and respond.
Review the rules when the tools or their use change. Ask staff which tasks the rules leave unclear and whether the approved process is difficult to follow.
Give your team clear rules for AI
Tell us which AI tools staff are using and what they want to do with them. We will review the risks and help you set the rules for their use.