AIat workStart an enquiryEnquire

Guides

The boundary, drawnTwo columns. On the left, work that can safely be drafted with an AI tool. On the right, work that stays with a qualified person regardless of tool, tier or vendor.The line you cannot crossThe boundary, drawnThe right-hand column does not move with the tool, the tier or the vendor.Draft it with AIYou still check it. You always check it.Stays with a qualified personPermanently. Not a tier or a setting away.Tenders and submissionsPolicies and proceduresInduction and training materialStandard explanatory lettersReports from de-identified inputsFirst drafts of anything routineClinical judgementFinancial adviceTax positionsSafety sign-offLegal advice to a clientAnything a regulator would call your opinionA wrong output on the left costs you an edit. On the right it is a regulated harm.
The list to hand a team before they start, not after something goes wrong.

What never goes in an AI tool

Every business needs this list. Five categories, specific to you, written down. It takes about twenty minutes and it's the highest-value twenty minutes available.

By

The five categories

  1. Identifiable records about the people you serve. Names, records, case detail, anything that would identify someone to a person who knows them.
  2. Credentials and access. Passwords, keys, codes, account numbers — including inside screenshots, which is how it usually happens.
  3. Material held under someone else's terms. Client confidentiality clauses are often tighter than privacy law and rarely read before the tool arrives.
  4. Work where a wrong output is a regulated harm. Clinical decisions, advice, tax positions, safety sign-off, award interpretation.
  5. Anything you couldn't check. If nobody in the business can verify the output, it shouldn't be produced this way.

Write yours like this

Take the five above and make each one concrete for your business, using your own words for the things you hold. “No participant progress notes with names in them” is a usable rule. “Protect sensitive data” is not.

De-identifying without wrecking the document

  • Roles instead of names: the tenant, the participant, the referrer.
  • Ranges instead of dates and ages where precision isn't doing work.
  • Drop the geography when the geography narrows it to one person.
  • Keep the clinical, technical or factual detail — that's the part making the output useful.

The test

Would someone who knows your business be able to tell who this is? If yes, it isn't de-identified, regardless of whether the name is in there.

What to do when it's already gone in

It happens, usually on a personal free account, usually with good intentions. The useful response is to find out the extent, check whether your notifiable breach obligations are engaged, fix the account and tier problem, and write the rule. Treating it as a disciplinary matter first reliably produces incomplete information.

The two columns

Usually fine, once the rule names it

  • Tenders, capability statements, scopes of works
  • Policies, procedures, position descriptions
  • Induction and training material
  • Standard letters explaining a process, with no client in them
  • Job ads and internal summaries
  • Reports built from properly de-identified inputs

Never, regardless of tier

  • Client, patient or participant identifying information
  • Anything under a confidentiality obligation you can't vary
  • Credentials, keys, banking or payroll detail
  • Documents you haven't got the right to share
  • Anything where nobody will check the output
  • Regulated judgement: clinical, legal, financial, safety sign-off
The right-hand column doesn't move with the tool, the tier or the vendor.

Rewrite the left column using your own document names before you hand this to anyone. A list that says "participant plans" gets followed; a list that says "personal information" gets nodded at.

The question people ask next

What about the six months before we had a rule?

Establish which account, roughly when, and what kind of document. Fix the setting. Write the rule. Move on. Treating it as misconduct guarantees you never hear about the next one, and unreported use is the thing you're trying to eliminate — not honesty about it. There's more on how to run that conversation in this article.

If you'd rather the awkward questions came from outside the business, that's what a policy and audit engagement does.

Start an enquiry

The questions we get asked about this

Does the paid tier change this list?

It changes the left column's edges slightly. It does not change the right column at all.

Who should own this list?

One person, named on the document, with the authority to answer the cases it doesn't cover. A list without an owner stops being current within a month.

See what this looks like for your business. Nine questions, about four minutes, and a plan ordered for your own work. No account, and the full plan is shown before any email is asked for. Build your plan.

Start an enquiry

Tell us what's eating the week

One form, one reply from a person. We'll tell you which engagement fits, roughly what it costs, and if we're the wrong fit we'll say so.

Start an enquiry
Start an enquiry