AI and Information

AI is to be found in many places in business nowadays, from software that you purchase to help rung your business to developing your own AI workstream or using it to help with a document or article (although no AI has been used here except for the image). It can be very beneficial to productivity and freeing up time to help grow a business.

But AI needs information and may use personal data to provide the benefits to your business. There are some keys things to think about when looking at information and any personal data used in AI.

I have some questions that you may find useful when thinking about AI.

• Do you actually know what information, especially personal data is being used?
• Is the AI embedded into a system which automatically uses the data or information you enter?
• Do you enter or upload information into a popular AI tool or do you link one of these to your data?

You need to understand what information the AI is using and should ask questions of a supplier about this. This is important if the information is personal data of staff, clients or your customers. Think about how you can comply with GDPR and data protection where it is personal data.

Create a list of the AI solutions or tools that you use and what information or personal data you are entering into these (an information asset register).

• Is the information entered or uploaded in the AI solution or tool being used to train the AI model?
•  Is it being shared via the internet to help answer prompts or questions others may pose?

You need to ask the questions or do your research as it is your data and you are responsible for it. AI needs a lot of information to learn to provide responses to prompts and questions and you need to understand if your information is being used for this.

For some AI tools, especially those added onto popular software such as Microsoft’s CoPilot, you can ‘switch off’ the internet linkage. You may need to ask for support with this but it could help prevent sharing of your businesses information or personal data on the internet as this is generally not a good idea. If it is personal data you would need to tell people this is happening and without a suitable lawful reason, it is not likely to be lawful under GDPR.

• Do you use a transcription tool in your business, even if it is one of the add-ons to MS Teams or Zoom?
• Do you talk about a person(s) which is then transcribed (even initials of someone)?

Think about whether you are comfortable allowing these tools to record and transcribe the conversation or presentation. If on a meeting you may need to remind others that a transcription tool is being used, or event switch it off.

You will need processes in place to ensure that the transcript is accurate. You may need to verify the transcript or coding it may have done before the transcript is uploaded to another record. Can you rely on the accuracy of the transcript?

• Where is the data being stored when being use in an AI solution or tool?
• How is it secured?

Ask the supplier or do some research on this. You need to know if it is being stored in the UK, EU/EEA or somewhere else in the World. Where it is stored may mean you have to have extra security steps in place and you certainly need to tell people this in your privacy notice.

You want to know that any information you enter into the AI is safe and secure.

• How long is the information being retained for?

You will need to know how long the information is being retained (held) in AI. Once it has created the draft or updated a record ask the supplier if the data is automatically deleted or ensure you ‘program in’ a deletion process. But here you need to think about whether you need to keep data in AI for legal reasons?

• Do your staff know what AI solutions or tools you allow in your business?
• Do the staff know what information or personal data that can or can’t enter into AI?
• Do your staff have AI literacy? They know how to use the AI to get the best out of it?

In a business you should take time to ensure that staff have an awareness of AI and the business’ or your expectations. Some businesses find it useful to limit the use of or downloads of AI tools.

You may find it useful to get staff involved in developing a ‘prompt library’ that details how prompts can be worded to get the best results from the AI solution or tool.

Writing an AI policy can help with setting expectations.

Remember, free AI solutions or tools still require some form of payment and it’s usually your information or personal data that is the payment - “If it’s free, you pay with your data”.

If you pay for an AI solution or tool, or it is embedded into a system you use, you are likely to have more control over the use or retention of the information or personal data that you enter.

I hope that this has given you something to think about as you are planning use of AI. This is not an exhaustive list of questions or suggestions but a few to help you on your AI journey. We just need to use AI responsibly.