Rules and data when using AI

Rules help people understand which tool they can use, what data they may enter and when they need to check a result or ask for help. Start with actual work and keep existing practices that work well.

Understand current use and open questions

• AI inventory — tools, purposes, data and people.
• Initial assessment and gap analysis — what is already addressed and what needs work.
• Legal context — questions to assess for the particular purpose and organisational role.

Result: a view of AI use and specific questions to resolve. A questionnaire score alone does not establish legal compliance.

Prepare rules people can use

• Governance and responsibilities — who decides, prepares evidence and follows up.
• Rules for AI use — permitted uses, output checks and change approval.
• Personal data and security — inputs, access and information protection.
• Incident handling — reporting problems internally and deciding what happens next.

Result: rules adapted to your work, with an owner, approval and review date. Templates need to be completed and reviewed before use.

Put the rules into practice and review them

Use examples from people’s work. Check that they know where to ask for help and can follow the rules in the tools they actually use.

• Training and records — what to teach and how to record the work.
• Ongoing review — checks prompted by changes and findings.
• Supplier dependencies — service changes, exports and exit options.
• Documents and their purpose — what the final materials should make clear.

For help with preparation, see assessment and rules for your organisation, including the process and deliverables.