Introduction

You will learn how to understand and apply your organization's AI use policies and guardrails--recognizing which uses are approved, what controls apply, and what requires escalation or approval before proceeding.

At the Assisted Use level, you are moving from understanding concepts to applying them with guidance. You will begin using AI tools under supervision, learning to evaluate their outputs critically and document your verification processes. This is where theory meets practice -- with appropriate guardrails in place.

This lesson is designed to be accessible to professionals at all experience levels while providing the depth needed for practical application. Whether you are encountering these concepts for the first time or building on existing knowledge, the material ahead will strengthen your ability to navigate AI governance challenges with confidence and competence.

Core Concepts

Anti-Patterns / Misuse Risks

Anti-Pattern 1: Ignoring the Policy "The AI policy seems strict, so I'll just use AI anyway and not mention it."

Risk: If discovered, you've violated organizational policy. This damages credibility and trust.

Safeguard: Follow the policy; escalate if you think a use should be approved even though it's not in the low-risk category.

Anti-Pattern 2: Misinterpreting the Policy "The policy says medium-risk uses need approval, but my use seems like it's probably fine, so I'll do it without asking."

Risk: "Probably fine" is not the same as "approved." You're potentially violating policy.

Safeguard: When uncertain, escalate and get clarification before proceeding.

Anti-Pattern 3: Over-Restrictive Interpretation "The policy seems like it prohibits all AI use, so I won't use AI at all, even for low-risk purposes."

Risk: Over-restriction prevents beneficial AI use and slows work unnecessarily.

Safeguard: Read the policy carefully. Most policies explicitly permit certain uses. Understand which uses are approved.

Anti-Pattern 4: Assuming Approval Is Implied "My manager said 'do whatever you think is best,' so I interpreted that as permission to use AI for anything."

Risk: General permission from a manager may not constitute organizational policy compliance.

Safeguard: General permission doesn't override organizational policy. Check the AI policy itself.

Anti-Pattern 5: Sharing AI Use Inconsistently "I use AI all the time, but I sometimes mention it and sometimes don't, depending on who I'm talking to."

Risk: Inconsistent transparency raises questions about why you sometimes hide AI use.

Safeguard: Be consistent: always document and communicate AI use per policy.

Human Judgment Checkpoints

Before using AI for a task, ask yourself:

• Policy Clarity: Have I read and understood the AI use policy?
• Use Classification: Do I know whether this use is low-risk (approved), medium-risk (approval needed), high-risk (escalate), or prohibited?
• Data Check: Am I handling sensitive data? Does the policy permit it?
• Approval Status: If approval is needed, have I obtained it?
• Documentation: Have I documented the AI use per policy requirements?
• Verification: If required, have I verified the AI output?
• Escalation: If I'm unsure whether this is permitted, have I escalated?
• Transparency: Am I being transparent about AI use, or hiding it?

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Traceability / Defensibility Considerations

Policy compliance is part of your professional practice:

What to Record: - The AI use policy and its classification of your use - Approval obtained (if required) - How you interpreted policy requirements - Verification steps taken - Documentation of AI use per policy

Why This Matters: - Auditors review AI use policies and practices - Regulators may ask how you comply with organizational policies - Leadership may question whether AI use is aligned with governance - Your compliance demonstrates professional responsibility

Responsible AI and Control Considerations

Responsible Policy Compliance: 1. Read the policy: Understand what your organization permits and requires 2. Classify your use: Know whether your intended use is low, medium, high, or prohibited risk 3. Ask when unsure: Escalate if classification is unclear 4. Follow requirements: If approval is required, get it; if documentation is required, do it 5. Be consistent: Apply policy uniformly; don't make exceptions for yourself

Control Considerations: - Organizational AI policies should be part of the control environment - Compliance with AI policies should be monitored and reviewed - Non-compliance should be addressed - Policies should evolve as AI use matures

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Practice / Reflection Prompts

• Read your organization's AI policy. Classify three tasks you do regularly: Are they low-risk (approved), medium-risk (need approval), high-risk (escalate), or prohibited? Document your classification.
• Identify a gray-area use. Find a task that seems like it might be approved but you're not sure. Draft an escalation email to your compliance officer asking for clarification.
• Track policy compliance. Over the next month, note every time you use AI. Classify each use per your policy. Are you in compliance? What needed approval that you got? What did you escalate?
• Discuss with colleagues. Ask three colleagues how they interpret the AI policy. Do you all understand it the same way? Where is there disagreement or confusion?
• Review a policy decision. If you've previously done something you now think violates policy, what would you do differently going forward?

Practical Application

Understanding concepts in the abstract is valuable, but the real test is whether you can apply them in professional practice. This section bridges the gap between theory and application with concrete scenarios drawn from oversight work.

Use Case 1: Understanding What You Can Use AI For Your organization has an AI policy that says: "AI can be used for summarization, drafting, and research support in low-risk contexts. Medium-risk uses (policy drafting, analyses) require compliance review and approval. High-risk uses (control decisions, regulatory interpretation) require executive approval."

You have three tasks: 1. Summarize a recent compliance update for your team (LOW-RISK -> Permitted without approval) 2. Draft a vendor management procedure based on interviews (MEDIUM-RISK -> Requires compliance review) 3. Interpret a new SEC rule for your control framework (HIGH-RISK -> Requires legal and executive review)

Analysis: - Task 1: You can proceed; document that AI was used for summarization - Task 2: You should draft with AI but get compliance approval before finalizing; policy work requires oversight - Task 3: You should NOT use AI for the final interpretation; get legal counsel to interpret the rule; AI can assist with research only

Use Case 2: Recognizing Data Handling Restrictions Your organization's AI policy says: "Do not input personal data, customer data, or confidential business information into AI systems without explicit approval."

You have a task to analyze customer complaints to identify themes. You want to use AI to help organize and categorize the complaints.

Question: Can you use AI for this?

Analysis: - Customer complaints likely contain customer personal data (names, account info) or confidential details - Per policy, you cannot input this into AI without explicit approval - Instead: You should ask for approval; if denied, you would need to use other tools or manual analysis - Or: You could anonymize/redact the complaint data first (remove customer identifiers) and then input the de-identified version to AI

Use Case 3: Escalating When Unsure You're working on a control assessment and want to use AI to help draft the control narrative. You're not sure if this falls under the policy's "medium-risk" category that requires approval, or if it's "low-risk" and permitted without approval.

Action: - Escalate to your compliance officer or policy owner - Ask: "I want to use AI to draft a control narrative. Does this require approval per the AI use policy?" - Wait for clarity before proceeding - Document the guidance you received

Detailed Examples

The following examples illustrate how the concepts from this lesson play out in real-world oversight scenarios. Each example is designed to help you recognize similar situations in your own work and respond with appropriate professional judgment.

Example 1: Policy Interpretation Decision Tree

Your Organization's AI Policy States: ``` APPROVED AI USES (No advance approval required) - Summarization of policies, regulations, reports - Drafting initial outlines, brainstorming, organizing information - Research and information gathering (with verification) - Routine communications and memos

MEDIUM-RISK USES (Require compliance review and approval) - Drafting policies, procedures, or control narratives - Risk assessments and analyses - Synthesis of audit findings or compliance data - Stakeholder communications about material topics

HIGH-RISK USES (Require legal and executive approval) - Interpretation of regulations or legal requirements - Final control design or control assessment decisions - External regulatory communications - Use with restricted or sensitive data

PROHIBITED USES - Providing legal advice or regulatory interpretation - Making final control decisions without human judgment - Sharing customer personal data, financial account data, or proprietary information - Using unapproved AI tools ```

Decision Tree Application:

Question 1: "Can I use AI to summarize the new SEC cybersecurity rule?" - Complexity: Medium (interpreting regulation vs. summarizing existing guidance) - Data sensitivity: Low (the rule is public) - Decision: This is at the boundary between approved and medium-risk - Action: APPROVED but with verification requirement (summarize with AI, verify against original rule before using) - Reasoning: Summarization is approved use, but AI interpretation of new rules might need verification

Question 2: "Can I use AI to draft a revised control procedure for user access reviews?" - Category: Procedure drafting - Policy classification: MEDIUM-RISK - Decision: Requires compliance review and approval - Action: Draft with AI, but get Compliance Officer sign-off before finalizing and implementing - Reasoning: Control procedures directly affect how controls operate; oversight is appropriate

Question 3: "Can I use AI to help organize customer complaints by theme for an analysis?" - Data type: Customer complaints (contain customer personal data) - Policy classification: PROHIBITED (unless data is de-identified) - Decision: Cannot use AI with original data; must first de-identify - Action: Redact customer identifiers, anonymize account info, then use AI on de-identified version - Reasoning: Policy protects customer privacy; de-identification removes the restriction

Question 4: "Can I use AI to interpret the GDPR requirements for our data governance policy?" - Complexity: Legal interpretation of regulation - Policy classification: HIGH-RISK - Decision: Requires legal and executive approval - Action: Have legal counsel review AI's interpretation; executive approves final policy - Reasoning: GDPR interpretation has legal implications; needs legal expertise

Example 2: Escalation When Unsure

Scenario: You want to use AI to synthesize findings from three compliance audits. The policy says medium-risk uses require approval. You're not sure if "findings synthesis" counts as medium-risk analysis or if it's routine research.

Escalation Process:

Email to Compliance Officer: ``` Subject: AI Use Approval Request - Audit Finding Synthesis

I'm planning to use AI to help synthesize findings from three compliance audits (2023-2025). I want to: 1. Use AI to organize findings by control area 2. Identify patterns and repeat findings 3. Create a matrix for leadership review

Question: Does this fall under medium-risk "analyses" that require your approval per the AI use policy, or is this routine research?

If medium-risk, I'd like to submit for approval before proceeding.

Thanks, [Your name] ```

Compliance Officer Response: ``` This is medium-risk analysis because: 1. It synthesizes compliance audit data 2. The results will inform leadership decisions about control remediation 3. Accuracy is critical

Please submit: 1. The audit reports to be analyzed 2. Your planned use of the AI synthesis (how will leadership use it?) 3. Your verification plan (how will you ensure accuracy?)

I'll review and let you know if approved. ```

You then proceed with the full submission, get approval, and document it.

Putting It Into Practice

At the Assisted Use level, implementation means beginning to incorporate these concepts into your supervised AI work:

• Practice with guidance: Use AI tools for low-stakes tasks with a mentor or supervisor available for review. Build confidence gradually before taking on more complex scenarios.
• Verify systematically: Develop a personal checklist for reviewing AI outputs. Even a simple three-point check (accuracy, completeness, appropriateness) dramatically improves output quality.
• Document your process: Record what AI tool you used, what prompt or input you provided, what output you received, and what verification steps you performed. This documentation habit is essential.
• Seek feedback: Share your AI-assisted work products with experienced colleagues. Their input helps calibrate your judgment about when AI outputs are reliable and when they require additional scrutiny.

Key Takeaways

Review the core concepts from this lesson and consider how each one applies to your professional practice.

As you continue through this credential program, you will build on the foundation established in this lesson. Each subsequent lesson adds new dimensions to your understanding and expands your capability to work effectively with AI in oversight roles.