Module 02 / 10 · 40 planned minutes

Work safely from the start

Make and explain an input-permission and review decision, including when to stop or escalate.

Use AI01's distinction between a draft and an action to make a safe-use decision. The target is recognising permission and review questions, not becoming a privacy or professional-ethics specialist.

First pass: apply P01 to one proposed upload. Move on when your decision identifies the information, approved environment, allowed action, review owner and a reason to stop.

Learn 14 planned minutes

Permission comes before the prompt

A task can be useful and still be inappropriate in a particular tool. Before entering information, check your organisation's approved-tool policy and the actual account/workspace. Ask what approval covers: a public example, internal material, personal data, confidential matter documents or something more sensitive? Do not infer that approval for one category covers another.

Client confidentiality, legal professional privilege and data protection are different questions. A document may be confidential without being privileged. Removing a name may not remove identifying facts, metadata, comments or the combination of details that identifies someone. Replacing a name with a code is not automatically anonymisation. For this course, use synthetic documents only; do not try to make a real client file “safe enough”.

Settings are not the whole answer

Training use, retention, human access, storage location, subprocessors, sharing links, memory and connected-service permissions are separate checks. Turning off model training does not prove that information is never retained or accessed. A paid account, “enterprise” label or a statement in your prompt does not settle contractual safeguards or applicable law. Obtain the relevant organisational and vendor information; if you cannot, stop rather than guess.

Even a public source may be unsuitable to upload wholesale because of licences, use restrictions or personal information. Use lawful access and the smallest relevant extract. Do not enter credentials, client identifiers or confidential facts into a public search query while researching the issue.

Responsibility stays with the professional

In its 17 August 2026 warning notice, the SRA discusses inaccurate AI-generated material and confidentiality risks for the firms and individuals it regulates. It does not exempt professional work because a tool produced it. That is an England-and-Wales regulatory reference, not a worldwide rule. SRA

For US comparison, ask a qualified reviewer to obtain and read the applicable professional rules and relevant ethics material. ABA Formal Opinion 512 is listed as a follow-up reading lead, but the attempted source access was blocked in this research session; its text has not been used to teach a rule here. Do not teach “all AI use always needs consent” or “AI use never needs disclosure” as universal answers. ABA

In actual practice, discuss the relevant professional duties, engagement terms, court rules and client communication with the responsible lawyer. Record tool use and time honestly. Do not represent generated material as independently checked or charge fictional hours. For Kenya-specific privacy questions, examine the applicable law and facts; client agreement alone is not an all-purpose substitute for that analysis. KEDPA

If something goes wrong

Stop further processing or sharing. Notify the designated supervisor or security/privacy contact promptly under the relevant procedure. Preserve a minimal, access-controlled record of what happened, when, which system was involved and who was told. Do not forward exposed material to a group or delete evidence in an attempt to hide the incident. Notification duties and deadlines require the actual jurisdictional and incident assessment; the course supplies no universal deadline.

Worked example

A fictional colleague has a paid personal AI account and offers to summarise a client's witness statement. The firm's approved training rule permits synthetic files only.

Decision: do not upload. The account's price does not expand the approved data category. The colleague should use a fictional training example or seek the firm's proper review of a real-use environment. Adding “keep this confidential” to the prompt is not the missing approval.

A sound explanation distinguishes usefulness from permission and gives a practical alternative.

Practise 20 planned minutes

Guided practice

Under P01, classify three requests: summarise C01; upload an actual client file with its name removed; connect a personal mailbox to find a training email. Choose proceed, ask/stop or manual alternative and explain each choice. No actual file or account connection is needed.

Feedback — compare after your attempt

C01 is supplied synthetic material and may be used only through the approved training or simulation route. The real client file remains outside P01 even after a name is removed. The personal mailbox also falls outside the exercise. A good decision identifies the boundary; it does not speculate that another product would necessarily be safe.

Practice assignment

Complete A02 in no more than 150 words. Include the proposed task, permitted input, environment, allowed action, reviewer, stop condition and a manual/simulation alternative. If a real organisation has not named a reviewer, mark this as an unresolved owner rather than inventing an approval.

Participation

Explain to a colleague why “read-only” and “safe to disclose” are different. Solo alternative: give one sentence about each and a practical example.

Keep your work: complete A02, including its participation check. Open A02 in the workbook →

Check 6 planned minutes

Two formative checks. Choose an answer, then check it or open the comparison. Retry freely; this is not an award or an observed-skill record.

1. Your colleague has a paid personal AI account. The exercise permits synthetic files only. May you upload a real client statement with the name removed?

No; neither price nor name removal expands the exercise's permission Yes, because paid accounts are approved for client work Yes, because removing a name guarantees anonymity

Compare answer 1 and feedback after your attempt

Answer: No; neither price nor name removal expands the exercise's permission

The permitted category remains synthetic data. Confidentiality, identifiability, account safeguards and organisation approval are separate checks.

2. A setting says the provider will not use your input for model training. What remains to check?

Nothing; the setting guarantees no one can access or store the input Only whether the prompt says confidential Retention, access, sharing, contractual safeguards and the actual permitted use

Compare answer 2 and feedback after your attempt

Answer: Retention, access, sharing, contractual safeguards and the actual permitted use

Training use is one issue. It does not by itself settle storage, access, disclosure, contracts or applicable professional duties.

Source study and completion check

Optional pointer: SRA, “Our concerns” and the confidentiality considerations. Identify why price alone is insufficient. Kenya extension, outside the core time: compare KEDPA section 2's anonymisation and pseudonymisation definitions with section 25; obtain local review before applying them. Complete AI02's two checks.

Before moving on, compare your artifact with the module feedback, correct material errors and keep its actual route label. This page does not record or certify completion.