Lesson 2.70: Governing the use of AI tools
Employees adopted generative AI tools faster than any policy could follow: chat assistants, code helpers, meeting transcribers, often on free personal accounts. Each one is a place company data goes, and some vendors use what you type to train their models. At the same time, laws such as the EU AI Act (in force since 1 August 2024) put obligations on certain uses, such as AI that screens job applicants. In the lab you compare Northwind's AI tool inventory with its policy, find where confidential data goes to tools that keep it, classify the uses by risk and write the actions.
17 min
You will learn to
- Explain the main risks of unmanaged AI tool use
- Check an AI tool inventory against a use policy
- Find confidential data sent to tools that train on inputs
- Classify uses with the EU AI Act risk categories
- Write proportionate governance actions
Key terms
- Generative AI
- AI that produces text, code, images or audio from prompts.
- Training on inputs
- A vendor using what users submit to improve its models.
- Shadow AI
- AI tools used for work without approval or oversight.
- EU AI Act
- EU regulation on AI, in force since 1 August 2024, with obligations phased by risk category.
- High-risk AI system
- A use listed by the AI Act (e.g. hiring, credit scoring) with strict requirements.
- ISO/IEC 42001
- International standard for an AI management system (2023).
← CIS Controls v8: an IG1 self-assessment · All lessons · Testing controls: design and operating effectiveness →