Lesson 6 of 6 · 9 min
Choosing tools and reporting problems
How to tell whether an AI tool is ready for personal information, and what to do the moment something goes wrong.
A quick check for any AI tool
Before a school, nonprofit or team adopts an AI tool for personal information, these questions should have clear yes answers in writing.
- Is there a signed agreement that covers privacy and security?
- Does it say your data will not be used to train AI models?
- Does it say how long data is kept and how it is deleted?
- Does it ban selling data and targeted advertising?
- Does the company test for data leaks and hidden-instruction attacks?
- Does a person review AI output before it affects a decision about someone?
When something goes wrong
Mistakes happen: a file pasted into the wrong tool, an AI answer showing information it should not, a message sent to the wrong person. What matters most is speed. Report it right away to your privacy contact, IT team or manager, even if you are not sure it counts.
Do not try to quietly fix it yourself, delete evidence or wait to see if anyone notices. Organizations often have legal deadlines to notify people after a data incident, and those clocks can start when the problem is discovered.
You are part of the safety system
Policies and software controls only work when people use them. Asking whether a tool is approved, keeping identities out of prompts and reporting problems early are what turn a privacy policy into real protection for people.
Lesson quiz
Get 3 of 4 right to pass.