- Confidentiality: what public AI tools do with what you paste in — client data, employee data, deal data, the categories that stay out, and why even "trusted" vendors don't eliminate the risk
- Accuracy: AI sounds certain when it's wrong — verify before you send, especially numbers, names, dates, citations, anything with legal or financial consequence
- Disclosure: when to tell people you used AI — internal vs. external, regulated vs. unregulated. The rule of thumb: if you'd be uncomfortable saying "AI wrote this," that's your answer
- Shadow AI: using personal accounts for work tasks, routing around firm-approved tools — why this is an integrity issue, not just a security one, and why it gets people fired
- Data quality as the underlying thread: AI is only as good as what you give it. Garbage in, confident garbage out
- Why governance is professional self-protection, not corporate compliance theater
Look back at the prompts you built in Episode 2 and the use cases you mapped in Episode 3. Run them through this 4-question self-audit:
Does this input contain anything I wouldn't want outside the company? Am I relying on this output without verifying it? Would I be comfortable disclosing I used AI for this? Am I using an approved tool?
Discuss the gray areas, habits, and questions that came up in this week's self-audit.
Gray areas where the policy doesn't clearly say yes or no. Cases where approved tools are slower or less capable than personal tools you might already be using — that's a shadow AI risk worth surfacing upward. Honest answers about habits you want to pressure-test.
- How do I know if my use of AI needs to be disclosed?
- Default to yes in client-facing work. Default to transparency with your manager when uncertain. If a situation isn't covered by policy, that's the flag to raise, not the reason to proceed quietly.
- What if I've already done something that might have crossed a line?
- Raise it with your manager. The risk of a past mistake is almost always lower than the risk of continuing without saying anything.
Send us the gray areas your team raised that the current policy doesn't clearly address. These aren't individual failures — they're program design inputs. The central team will aggregate and respond.