Data privacy and acceptable-use policy: Updating which existing policy area most directly addresses this

Updating data-privacy and acceptable-use policy to govern data entered into external AI directly addresses the exposure.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Corporate travel and expense policy, to control how staff request approval and reimbursement when they attend external conferences about generative-AI tools and vendors.

   Plausible but wrong: travel policy has no bearing on customer-data exposure through AI tools.
2. Physical badge-access policy, to determine which employees may enter secured areas of the building where generative-AI experimentation and prototyping typically take place.

   Plausible but wrong: badge access does not control data entered into external LLMs.
3. Data privacy and acceptable-use policy, to restrict what customer data may be entered into external AI tools and define approved, compliant handling of such data. ✓

   Correct: governing what data staff may input to external AI directly addresses the leakage of customer records.
4. Brand and marketing-style policy, to standardize the tone and formatting of the customer responses that employees ultimately draft with the help of the external tool.

   Plausible but wrong: style guidance does not prevent sensitive data from being sent externally.

How to remember it

Updating data-privacy and acceptable-use policy to govern data entered into external AI directly addresses the exposure.

More Understanding the Foundations of AI Governance questions

• Use-case assessment: Which AI life-cycle stage does this control primarily target? →
• Pre-contract due-diligence assessment: Which combination of third-party controls most completely addresses the →
• A general-purpose foundation model: Which term most precisely describes this system? →
• All 337 Understanding the Foundations of AI Governance questions →