Free tools and checklists

What not to paste into a chatbot

A simple test: would you be comfortable if a stranger read this text or it were forwarded to someone you know? If not, leave it out. Settings differ between services and change over time, so read the provider's current privacy policy for what it does with your chats.

• Passwords, recovery codes and keys. A chat is a record held by a service. Anything that unlocks an account should never sit in one.
• Identity and payment numbers. Social Security, passport, driver's licence, bank and card numbers can be misused by anyone who later sees them.
• Health details about you or someone else. Medical history is among the most private information there is, and a chatbot is not a clinician or bound by medical confidentiality.
• Other people's personal details. Names with addresses, school records, customer lists and staff reviews belong to those people, who did not agree to share them.
• Confidential work material. Unreleased figures, contracts, client data and source code, unless your organisation has approved that tool and its settings in writing.
• Anything you promised to keep private. Information covered by an NDA, a legal duty of confidence or a school's privacy rules.
• Photos of children or of people who have not agreed. Pictures can be stored and are hard to take back once uploaded.

A family AI safety card

Seven habits to agree on together. Print this page and stick it on the fridge. It is written for parents and carers; it is not aimed at children.

1. An answer can be wrong, confidently. Check anything that matters, such as facts for homework, health, money or safety, in a second source before acting on it.
2. Keep personal details out. No full name, school, address, phone number, passwords or photos in a chat with an AI tool.
3. A chatbot is not a friend or a keeper of secrets. It is software. For worries, feelings or anything frightening, talk to a trusted adult. In the United States, the 988 Suicide and Crisis Lifeline answers by call or text at 988.
4. Know the age rules. Many services set a minimum age in their terms. Read the one for each app your family uses and decide together what fits.
5. Agree a family code word. A cloned voice can sound like a relative asking for money. If a call or message feels urgent and strange, hang up and call back on a number you already have, and ask for the code word.
6. Never share or make images of a real person without their say-so. If an intimate image of you is shared without consent, StopNCII.org helps adults. If you are under 18 or it shows someone under 18, the NCMEC Take It Down service can help.
7. Tell someone, with no blame. Agree that anyone in the family can say "this felt wrong" about an AI tool, and the answer is a conversation, not a punishment.

A one-page AI risk checklist for a small team

Ten questions to answer before a team starts using a new AI tool. Write the answers down; a few lines each is enough. The structure follows the ideas in the NIST AI Risk Management Framework, in a much smaller form. It is not a compliance tool.

1. What exactly will this AI tool be used for, and who in the team will use it?
2. What kinds of information will go into it, and is any of it personal, confidential or regulated?
3. Have we read the provider's current privacy and data-use terms, and do the settings we chose match them?
4. Is anyone's work or a decision about a person (hiring, grading, lending, discipline, health) going to rest on its output?
5. Who checks the output before it is used, and what do they check it against?
6. What is the worst realistic mistake, and who would be harmed if it happened?
7. Is there a person a customer, student or colleague can ask to review a decision the tool influenced?
8. Do we keep a record of which tools are in use, who approved them, and when?
9. What will we do if the tool leaks data, produces something harmful or goes down?
10. When will we review this decision again? Set a date, because terms and tools change.

A starter AI acceptable-use policy

Copy this into your own document, put your organisation's name at the top, fill in the person responsible, and change anything that does not fit how you work. It is a starting point written by a reading guide, not a lawyer. Have your own counsel review it before you adopt it, especially if you handle health, financial, education or children's data.