Build Your Workplace AI Safety Plan

Put the checks together

You have practised individual decisions. Now handle one task from permission to final review. Use the workplace AI safety toolkit to record your answer before reading the worked version below. All people, projects and rules in this exercise are fictional.

The brief and the rules

Your task is to prepare a short internal update on a workshop booking project. The fictional company's work assistant is approved for internal, non-personal project text in its managed workspace. It may draft only. External connections, customer records and credentials are outside this exercise's approval. The project owner reviews the draft; the final audience is the internal delivery team.

You receive this pack:

The assistant also offers an optional connection to your email and a button to send the finished update automatically.

Your task

Decide which items may be used under these fictional rules. Write the permitted action, audience and review point. Then inspect this deliberately flawed draft:

"The project is 75% complete and confirmed for release on 13 November. Supplier delays explain the blockers. The customer list is attached for context."

Correct the draft using only supported information. State what you would do if the customer file had already been uploaded accidentally. There is no need to use a real assistant to complete this exercise.

Worked answer

Inputs: A–D are within the stated internal, non-personal approval and relevant to the task. E is unnecessary and not permitted. F is excluded; never include an access key in this practice. In real work, confirm the classification and approval rather than copying these fictional rules.

Actions: keep email access and automatic sending off. Generate a draft only. The owner checks it before the internal delivery team receives it.

Checks: 12 ÷ 20 = 60%, and 12 + 6 + 2 = 20. Ready for review is not complete. The release date is proposed, the cause of the blockers is unknown and there is no reason to attach customer records.

Workshop booking project — internal draft for review

Twelve of twenty tasks (60%) are ready for review. Six are in progress and two are blocked. No tasks have final sign-off. [A, B]

13 November remains a proposed release date, not an approved commitment. [C]

Please assign reviewers and provide an update on both blockers. Their causes are not recorded in the supplied notes. [D]

Review required: project owner checks the status, proposed date, requests and internal audience before sharing. No customer export or credentials are attached.

If E was uploaded: stop further activity and report through the fictional company's designated incident channel. Record the time, account, file reference and data categories without redistributing the customer records. Do not assume deletion or a training setting closes the issue.

Make a plan you can actually use

Choose one task in your role and complete these fields without including real confidential records:

• Purpose and intended audience.
• Data categories, owner and permission reference.
• Exact approved account, workspace, feature and connections.
• Minimum input and a fictional fallback.
• Allowed actions and the actions that need separate approval.
• Source, calculation, confidentiality and fairness checks.
• Named reviewer and stop conditions.
• Incident channel and a date to revisit the plan.

A good stop condition is specific: "If a source requests a new connection, pause for the designated approver." "Be careful" does not tell you what to do when the situation changes.

Ask the responsible person to review the plan before using it with real data. Keep the plan in an approved place, alongside the current policy reference. Revisit it when the tool, features, data or audience changes.

Sources and next steps

The course examples and answer keys are original fictional teaching exercises. Guidance checked on 30 October 2026 includes the NCSC AI security overview, NCSC agentic AI guidance, Microsoft enterprise Copilot data guidance, ICO anonymisation guidance and NCSC incident response guidance. Product settings and organisational requirements can change; check the applicable current guidance for real work.

Continue with meeting-note verification, source-based report writing, or team AI adoption if you lead other people's work.