# Internal AI Use Scenario

Read this file for employee productivity, internal copilots, drafting tools, coding assistants, internal search, or internal workflow automation.

## Typical Examples

- Employees using ChatGPT, Claude, Copilot, Harvey, Ivo, GC AI, CoCounsel, or similar tools
- AI-assisted coding, drafting, summarization, or research
- Internal assistants operating on company documents or internal knowledge bases

## Typical Risk Areas

- Confidential or privileged information leakage
- Unapproved model or tool usage
- Prompt and output retention by a vendor
- Inaccurate outputs used without review
- Security and access-control gaps

## Required Questions

- What internal teams or user groups will use the tool?
- What company, customer, employee, or privileged data may enter prompts or retrieval systems?
- Is the model vendor-hosted, self-hosted, or hybrid?
- Are prompts, files, or outputs retained or used for vendor model training?
- What human review is required before outputs are acted on?
- What testing, logging, and incident-response controls exist?
- Has an AI impact assessment been completed or required?
- What technical or system documentation exists?
- Is there a DPA, privacy review, or approved internal data-handling position?
- If a vendor is involved, what subprocessors are used?
- Will users know they are using AI and what warnings or instructions are provided?
- What red-team, abuse-resistance, and post-launch monitoring controls exist?

## First Intake Set

Use this grouped intake set first when facts are missing:
- What is the internal AI use case and which team will use it?
- What data may be entered into prompts, retrieval, or context windows?
- What model or vendor is involved and how is it hosted?
- What human review is required before outputs are used?
- What training, acceptable-use controls, and monitoring exist?
- Do you have an AI impact assessment, technical documentation, privacy review, or testing summary?

## Review Focus

- Data classification and usage restrictions
- Acceptable-use and training requirements
- Output-review expectations
- Retention, deletion, and access controls
- Procurement, security, privacy, and legal approvals where relevant