Map the information the system will use
List the sources. Record what they contain, who the information relates to, why it is needed and who may see it. Distinguish between public information, internal documents, personal data and commercial information that must not be shared outside the organisation.
Use fictional or anonymised examples in an early prototype whenever possible. If real information is necessary for a valid test, agree the purpose, access and processing method first.
Find out what the supplier does with the information
The terms for a free chat service may differ from those for an enterprise agreement or API. Do not assume that every version of a product handles data in the same way.
- Where is content processed and stored?
- May the supplier use it to improve or train the service?
- Which subprocessors and countries are involved?
- How long are content and logs retained?
- Can you control access, deletion and permitted features?
Ask the people responsible for privacy, security and procurement to assess the answers before the system is opened to real data.
Give the system only the access it needs
A system that drafts an email usually does not need permission to send it. An HR search assistant does not need access to every document a manager can open. Limit sources, user groups and actions in the first version.
Apply familiar security principles: individual user accounts, least-privilege access, clear logs and a way to revoke access. This also makes testing and troubleshooting easier if something goes wrong.
Decide who checks, decides and stops
Name the role that checks suggestions before they are used. Agree who handles errors, who may change sources or instructions and who can switch the system off. Users must understand when they are looking at AI-generated content and what they are expected to verify.
If a suggestion affects a customer, an employee or an entitlement, a person with the appropriate authority must make the final decision. The interface must not present an uncertain suggestion as an approved decision.
Involve the right specialists before decisions become expensive
An AI adviser or designer can describe data flows, access and user responsibilities in a concrete prototype. Formal legal assessments and security approval must be carried out by the people responsible in your organisation or by an external specialist.
I can make the proposed system specific enough for privacy, security and legal specialists to assess, then incorporate the required limits and checks into the system.