Start with the work, not the tool
You need to turn a messy document into a clear update before a meeting. An AI assistant could help. The first decision is what you can let it see and do.
This course is for people using AI in everyday professional work: administrators, analysts, marketers, managers and other employees. You do not need to code or buy an AI subscription. Every exercise uses fictional information and includes a worked answer, so you can practise without uploading work files.
By the end, you will be able to identify sensitive company information, check whether a tool is approved for a task, prepare a smaller input, review the result and raise a concern through the right channel. You will also make a one-page plan for a task in your own role.
Download the workplace AI safety toolkit to keep your decisions and exercises together. Complete it in an approved document system; do not put real company information into public examples or this website.
Five questions that change the decision
| Check | Ask yourself | If you cannot answer |
|---|---|---|
| Task | What useful result do I need, and is AI allowed for this use? | Clarify the task or use the normal process. |
| Data | What would the prompt, attachment or connected source reveal? | Use fictional material while the owner checks. |
| Tool | Is this exact account, workspace and feature approved for that data? | Ask the designated IT, security or data contact. |
| Action | Can the tool only draft, or can it send, edit, delete or share? | Keep actions off until their scope is approved. |
| Review | Who checks the result, and who is allowed to receive it? | Name the reviewer and audience before proceeding. |
Being able to open a company file does not automatically give you permission to send it to an external service. A manager wanting a fast result does not by itself settle the organisation's data rules. Ask the person who has authority for that decision.
A small example
Fictional task: create a checklist for organising a public workshop. The published event page contains the date, venue and agenda. An internal spreadsheet also contains attendees' contact details and access requirements.
A useful first request needs the public event details and a generic checklist structure. It does not need the attendee spreadsheet. You still check that the tool and use are permitted, then review the checklist before using it.
Worked decision: draft from the published event information only, in the approved workspace, without connecting the attendee folder. Keep sending invitations as a separate human action. The organiser checks the date, venue and missing tasks.
That is a bounded task: clear inputs, a limited action and someone checking the result. The NCSC's AI security overview describes risks including incorrect answers, bias and manipulated instructions. These five questions are a practical way to begin checking your own workflow; they are not a guarantee that a tool is secure.
Checkpoint
Choose a fictional workplace task. Write its permitted input, approved tool, allowed action and reviewer before drafting a prompt.
Know what completion means
Your employer's rules and designated approval process govern real work. This course does not approve a tool, certify legal compliance or authorise a data transfer. The certificate records lesson completion; it is not an accredited qualification.
If you set policy for other people, continue afterwards with Safe AI Adoption for Teams. This course concentrates on the decisions employees make while doing the work.
๐ Quiz
Swipe right if this answers the question correctly, left if it does not.
You can open an internal file. What does that establish?
โIt is public informationโ
Is this the right answer?