Safe GenAI Usage

What Is Safe GenAI Usage?

Generative AI is part of drafting, translating and reviewing work, and it is also a fast route for confidential data to reach a system your employer has no contract with. In this exercise a deadline pushes you to paste a client's whole email, account number and budget into a free consumer chatbot. DLP flags it hours later. You then learn the four rules: approved tools only, sanitize the prompt, never paste secrets, and verify the output before it goes out.

What You'll Learn in Safe GenAI Usage

• Distinguish between consumer AI chatbots (no Data Processing Agreement, prompts may be retained for training) and approved enterprise AI tools (audit-logged, contractually protected, DPA-covered)
• Sanitize prompts before sending: replace client names, account numbers, deal values, and other identifying details with neutral placeholders so the AI receives only what it needs to do the task
• Recognize the categories of data that must never enter any AI tool, including approved ones: passwords, API keys, access tokens, and customer credentials
• Re-personalize AI output inside a secure channel rather than asking the AI to handle sensitive details directly, keeping the audit log free of unnecessary PII
• Respond correctly to an accidental data leak into a consumer AI tool: preserve the conversation as evidence, report to IT Security immediately, and avoid the false comfort of deleting the chat

Safe GenAI Usage — Training Steps

1. A Busy Monday at Alderwood

   It's 9:14 AM. You're catching up on overnight client emails before the partner standup at 10:00. One subject line catches your eye — a Spanish-speaking client marked their message URGENTE.

2. Urgent Client Email

   An email from Diego Vargas, the CFO of Cresgrove Investments, lands in your inbox. He's chasing a quarterly report you owe him before his board meeting on Friday. The message is in Spanish and contains a lot of engagement details.

3. The Tempting Shortcut

   Your Spanish is rusty and the standup is in 45 minutes. Alderwood has an approved enterprise AI tool, but it requires SSO and you'd need to look up the link. Meanwhile a free chatbot — SmartGen AI — is one tab away in your bookmarks. Just one quick translation, you tell yourself.

4. Pasting the Whole Email

   You type a quick translation instruction, then paste the entire body of Diego's email straight after it and hit send. Translation in seconds — what could go wrong?

5. SmartGen AI Responds

   SmartGen AI returns a clean English translation in two seconds. Exactly what you needed. But something else is sitting at the top of the chat — a small amber banner you've never paid attention to before.

6. The Data Retention Notice

   That amber banner has a quiet, easy-to-miss message: 'Your conversation may be used to improve SmartGen AI.' On the free tier, that line is all the data protection you get.

7. What You Just Exposed

   Look at the prompt you actually sent. Every detail of Diego's message is now stored on a third-party server.

8. Replying to Diego

   You copy SmartGen AI's translation, switch back to email, draft a polite reply with a Friday morning commitment, and hit send. Crisis averted — at least, that's how it feels.

9. DLP Alert from IT Security

   Your inbox pings. The subject line makes your stomach drop: 'DATA INCIDENT: Confidential Client Data Sent to Unapproved AI Service' . Alderwood's Data Loss Prevention system saw the whole thing.

10. Opening the Refresher Portal

    You click the portal link in the email to start the GenAI Acceptable Use refresher.