Practical AI guidance for work, business and home

Client data and confidentiality

Prompts, uploads, screenshots, recordings and connected applications can contain personal or confidential information. Understand what the service receives, why it is necessary, who may access it, where it is processed, how long it is retained and whether it may be used to improve the service.

Removing a name does not automatically anonymise detailed financial, tax, payroll, health or identity information.

Human review and verification

Generative AI can produce fluent material that is incomplete, outdated, biased, incorrectly reasoned or fabricated. Review should reflect the consequence of error, using primary sources, recalculation, jurisdiction and date checks where appropriate.

Hallucinations and accuracy

Do not accept AI-generated citations, legislation, tax rules, calculations or professional conclusions without independent verification. Be cautious when an answer sounds certain without a reliable source, uses an unfamiliar authority or applies rules without confirming date and jurisdiction.

Choosing AI tools

Popularity is not enough. Consider purpose, information type, account controls, provider terms, training settings, retention, deletion, security, permissions, auditability, support and the consequences of error or unauthorised action.

Governance and policy

Identify who is responsible, which services and accounts are approved, what information may be used, which tasks need prior assessment, how results are reviewed and how unusual outputs or suspected disclosures are escalated.

Security and professional responsibility

An assistant that drafts text is different from a system that can send email, alter records, move money, submit forms or connect to other systems. More powerful access requires stronger controls. Responsibility remains with people.