D7 · Responsible and Safe Use

This domain is worth 10% of the mock – roughly 6 of 60 items, the lightest weighting, but it carries outsized real-world consequence: a single mistake here can breach confidentiality, expose personal data, or mislead an audience. It tests judgment about what you may put into ChatGPT, what you must check before acting on its output, and how to be honest about its use – especially in a workplace and in education.

What you need to know

Responsible use starts with data sensitivity: classify information before you paste it, and keep confidential, personal or regulated data out of tools and settings that are not sanctioned for it. Bias can appear in outputs and must be mitigated by neutral prompting, representative examples and human review. High-stakes, irreversible, regulated or external outputs require a human review gate. Disclosure – being transparent that AI was used, where honesty requires it – matters, and in education, academic integrity rules govern what students and educators may do. Organisational AI-use policy takes precedence over personal convenience.

Learning objectives

By the end of this page you should be able to:

1. Classify information by sensitivity and decide what may go into ChatGPT.
2. Protect PII and confidential data and choose sanctioned tools/settings.
3. Recognise and mitigate bias in outputs.
4. Apply human review gates to high-stakes work.
5. Judge when disclosure of AI use is appropriate.
6. Apply workplace policy and educator/student integrity norms.

7.1 Data sensitivity classes

Before pasting anything, classify it. A simple four-class scheme covers most workplaces.

before pasting: what class is this?
   public ──────────► fine
   internal ────────► check policy; use sanctioned tools
   confidential ────► sanctioned/enterprise settings only
   restricted/PII ──► do not paste unless explicitly permitted

Enterprise settings help: OpenAI states that business data is not used to train models by default on Enterprise, with controls like SSO, RBAC and data residency. But the setting only helps if you use the sanctioned workspace — pasting confidential data into a personal free account is the classic error.

7.2 PII and confidentiality

Personally identifiable information (names tied to data, contact details, IDs, health or payment data) and confidential business information deserve special care.

The safe default: minimise — include only the data the task genuinely needs, and de-identify when the specifics are not required.

7.3 Bias and fairness

Outputs can carry bias: skewed framing, unrepresentative examples, stereotyped assumptions, or asymmetric treatment of people or options.

Bias mitigation is shared: neutral prompting reduces it, representative inputs help, and human review catches what remains — especially for anything touching people or protected characteristics.

7.4 Human review gates

Certain outputs must pass a human before they are acted on — the same gate introduced in Domain 6, viewed through a responsibility lens.

Mandatory review when the output is irreversible, regulated (legal, medical, financial, HR/hiring), external-facing, touches personal data or protected characteristics, is required by policy, or is novel/high-uncertainty. For hiring, medical, legal or financial-advice content, a qualified human — not the model — makes the decision; the model drafts, the human owns.

7.5 Disclosure and honesty

Disclosure is being transparent that AI assisted, where honesty or policy requires it. It is context-dependent, not absolute.

The principle: do not create a false impression of authorship, expertise or effort. When in doubt in a professional or academic setting, disclose and follow the applicable policy.

7.6 Workplace policy and educator/student integrity

Workplace AI-use policy takes precedence over personal convenience. If policy names sanctioned tools, prohibited data classes, or required review steps, follow them even when an unsanctioned shortcut would be faster.

before acting on AI help at work or school:
   1. What does the policy say? ── follow it
   2. What data class is involved? ── protect it
   3. Does honesty require disclosure? ── disclose
   4. Does a human need to own the decision? ── route the gate

Decision framework

Use the CLEAR responsible-use check before you paste sensitive data or act on an output: Classify the data, Limit to what’s needed, Evaluate for bias, Authorise via policy/sanctioned tools, Review by a human where stakes require.

The value: it turns “is this okay to do with AI?” into five quick, answerable checks that catch the common breaches before they happen.

Common mistakes

Scenario challenge

Scenario. Marco, a recruiter, wants to speed up screening. He pastes 40 candidate CVs — full names, addresses, and one candidate’s disclosed disability — into his personal free ChatGPT account and asks it to “rank the candidates and tell me who to reject.” His company has an enterprise ChatGPT workspace and an AI-use policy that prohibits candidate PII in personal accounts and requires human decisions in hiring. The output confidently ranks everyone and recommends rejections.

Expert reasoning trace.

1. Classify the data. The CVs contain PII and a protected characteristic (disability) — restricted/regulated data. Pasting them into a personal account breaches both the data class rule and the company policy naming the sanctioned enterprise workspace.
2. Limit. He included far more than needed and highly sensitive specifics; the disability detail in particular should never have been included and risks discriminatory handling.
3. Evaluate for bias. An AI ranking that “recommends rejections” can encode bias, and doing so on data including a protected characteristic is exactly where unfair, and potentially unlawful, outcomes arise.
4. Authorise. Even the summarising help must happen in the sanctioned workspace under policy, not a personal account.
5. Review / decision ownership. Hiring is regulated and consequential: the model may assist (e.g., neutral summaries of stated qualifications), but a qualified human must make and own the decision — the model cannot “decide who to reject.”

Exam-correct outcome: stop; do not paste candidate PII into a personal account; move any assistance to the sanctioned enterprise workspace under policy; remove protected-characteristic and unnecessary data; use AI only for neutral, criteria-based support; and keep the hiring decision with an accountable human — with bias review before any adverse action.

Assessment traps

Practice questions

Key takeaways

• Classify data before pasting; keep confidential and regulated/PII data out of unsanctioned tools.
• Minimise and de-identify — include only what the task needs.
• Mitigate bias with neutral prompting, representative inputs and human review.
• Irreversible, regulated, external or personal-data outputs require a human review gate; a qualified human owns regulated decisions.
• Disclose AI use where honesty or policy requires; do not misrepresent authorship.
• Workplace policy takes precedence over convenience; sensitivity follows the data and its use, not the ‘internal’ label.
• In education, use AI to learn within academic-integrity rules; educators review everything with professional judgment.