Before your team brings AI into the workflow

Begin with the job, not the tool

Name the task you want AI to support: drafting, research, coding, summarizing or customer service. Identify who will check the result and what a mistake would cost. An internal first draft and an automated customer decision need very different controls.

Decide what information belongs there

Before a team uses a service, review its terms, retention settings and access controls. Identify whether prompts or uploaded files may contain customer information, employee information, credentials or confidential business material. Do not assume a paid account automatically makes every use appropriate.

Keep a person responsible

Generated answers can be wrong, incomplete or misleading. Assign a person to review consequential output. Check source material rather than relying on confident phrasing, especially for legal, financial, safety or security decisions.

Build a small, usable policy

Record:

• Approved tools and permitted tasks.
• Information that must never be entered.
• The review needed before output is used or published.
• Who can approve a new tool or integration.
• How staff should report a mistake or unexpected disclosure.

The policy should be easy to find and realistic enough that people can follow it.

Run a bounded pilot

Start with low-risk work and a defined group. Compare the time saved with the review work created. Record useful results and failures, then decide whether the process should expand.

Governance is an operating practice, not a guarantee of legal compliance. Get advice specific to the information, industry and jurisdiction involved when the stakes require it.