Compliance & risk
An AI use and data-handling policy
- Operational problem
- Staff use AI tools with no shared rules on data, review or disclosure.
- Type of AI solution
- Governance, not a tool: a short policy, an approved-tools list and a review rule for AI output.
Before
Each person decides what to paste and what to check.
After
Clear rules on data, approved tools, required human review and incident reporting.
Human checkpoints
- Named policy owner
- Quarterly review
Data you need
- Inventory of tools in use
- Data classification
- Client and contract obligations
- Deployment pathway
- Configure
- Set up templates, rules, prompts or permissions inside a tool you already use.
- Complexity
- Low
Safeguards
- Cover privacy, accuracy, fairness and confidentiality
- Train everyone, not only adopters
KPIs to baseline, then measure
- Share of staff trained
- Incidents reported
- Tools inventoried
A small pilot
- Draft in two weeks, test with one team, then adopt
Evidence status: Illustrative design
Design pattern for planning. No published outcome is cited; measure your own baseline.