Data privacy, policies, and responsible AI use

Open data examples:
[List examples]

Restricted data examples:
[List examples]

Prohibited data examples:
[List examples]

Original task:
[What you want AI to help with]

Information I was about to include:
[Paste or describe the information]

Rewrite this into a safer prompt by:
- Removing names, phone numbers, emails, addresses, account numbers, and unnecessary identifiers
- Replacing people with roles where possible
- Keeping only the details needed for the task
- Flagging any details that may still be sensitive

Output the safer prompt only.

# AI use policy

Business:
[Business name]

Policy owner:
[Name or role]

Version:
[Version number]

Last updated:
[Date]

Next review:
[Date]

## Purpose
This policy explains how our business uses AI tools safely, consistently, and responsibly.

## Approved tools
Only approved AI tools may be used for business work.

Approved tools:
1. [Tool name, owner, approved uses, allowed data categories]
2. [Tool name, owner, approved uses, allowed data categories]
3. [Tool name, owner, approved uses, allowed data categories]

New tools must be reviewed before business data is entered or uploaded.

## Data rules
Open data may be used in approved AI tools.
Restricted data may be used only in approved tools with appropriate controls and review.
Prohibited data must not be entered into AI tools unless a separate approved process exists.

Open data examples:
[Examples]

Restricted data examples:
[Examples]

Prohibited data examples:
[Examples]

## Approved uses
AI may be used for:
- Brainstorming and outlines
- Drafting public or internal content
- Summarizing approved documents
- Creating SOP drafts and templates
- Preparing project briefs
- Drafting customer responses for human review
- Supporting analysis where data is approved

## Restricted uses
AI may support these tasks only with human review and approved tools:
- Customer communications
- Proposals and client deliverables
- Financial summaries
- HR and employee documents
- Hiring materials
- Meeting transcripts
- Contract or policy summaries

## Prohibited uses
AI must not be used to:
- Enter passwords, API keys, government IDs, banking details, or sensitive records into unapproved tools
- Decide hiring, firing, promotion, credit, legal, tax, medical, or financial matters
- Send unreviewed messages to customers or applicants
- Publish factual claims that haven't been verified
- Upload confidential client files without approval

## Review requirements
Low-stakes outputs need a quick check.
Medium-stakes outputs need review for accuracy, completeness, and usefulness.
High-stakes outputs need full review and approval by the responsible person.

High-stakes outputs include:
[Examples]

## Disclosure
We disclose AI use when it affects the customer, employee, applicant, contractor, or client experience in a meaningful way, or when disclosure is required by law, contract, platform rule, professional standard, or our own trust expectations.

Disclosure examples:
[Examples]

## Incidents
If AI is used incorrectly or sensitive data is entered into the wrong tool:
1. Stop the issue from spreading.
2. Notify the policy owner.
3. Document what happened.
4. Identify the data involved.
5. Decide whether customers, employees, vendors, regulators, or professionals need to be contacted.
6. Fix the workflow or policy gap.

## Review cadence
This policy is reviewed quarterly or whenever a major tool, workflow, vendor policy, or legal requirement changes.

Review the draft below for factual claims that need verification.

Create a table with:
1. Claim
2. Why it needs verification
3. Suggested source type
4. Risk if wrong
5. Recommendation: verify, rewrite, or remove

Rules:
- Don't invent sources.
- Don't confirm a claim unless the source is included.
- Flag legal, financial, medical, compliance, pricing, and statistics claims as high risk.

Draft:
[Paste draft]

Incident date:
[Date]

Reported by:
[Name]

Tool involved:
[Tool]

What happened:
[Brief description]

Data involved:
[Open / restricted / prohibited / personal / sensitive / unknown]

Who may be affected:
[Customers / employees / applicants / vendors / clients / none / unknown]

Immediate containment:
[What was stopped, deleted, disabled, or corrected]

Who was notified internally:
[Names or roles]

Professional advice needed:
[Privacy/legal/HR/accounting/security/none]

External notification needed:
[Customer/regulator/vendor/client/none/unknown]

Root cause:
[Policy gap / training gap / tool setting / unclear workflow / mistake / other]

Fix:
[What changes now]

Follow-up date:
[Date]

Training length:
30 to 45 minutes

Agenda:
1. Why we use AI
2. What AI can help with
3. What AI must not be used for
4. Approved tools
5. Open, restricted, and prohibited data
6. Safe prompt examples
7. Unsafe prompt examples
8. Review requirements
9. Incident reporting
10. Questions and workflow examples

Practice exercise:
Give the team three example prompts and ask them to classify each one as safe, restricted, or unsafe.

Policy owner assigned:
[Yes/no]

Approved tools listed:
[Yes/no]

Data categories customized:
[Yes/no]

Review tiers defined:
[Yes/no]

Restricted and prohibited uses written clearly:
[Yes/no]

Disclosure decisions documented:
[Yes/no]

Incident path added:
[Yes/no]

Team or contractor training completed:
[Yes/no]

Policy stored in a shared location:
[Yes/no]

Quarterly review scheduled:
[Yes/no]