scenarios-internal.md

Internal AI Use Scenario

Read this file for employee productivity, internal copilots, drafting tools, coding assistants, internal search, or internal workflow automation.

Typical Examples

• Employees using ChatGPT, Claude, Copilot, Harvey, Ivo, GC AI, CoCounsel, or similar tools
• AI-assisted coding, drafting, summarization, or research
• Internal assistants operating on company documents or internal knowledge bases

Typical Risk Areas

• Confidential or privileged information leakage
• Unapproved model or tool usage
• Prompt and output retention by a vendor
• Inaccurate outputs used without review
• Security and access-control gaps

Required Questions

• What internal teams or user groups will use the tool?
• What company, customer, employee, or privileged data may enter prompts or retrieval systems?
• Is the model vendor-hosted, self-hosted, or hybrid?
• Are prompts, files, or outputs retained or used for vendor model training?
• What human review is required before outputs are acted on?
• What testing, logging, and incident-response controls exist?
• Has an AI impact assessment been completed or required?
• What technical or system documentation exists?
• Is there a DPA, privacy review, or approved internal data-handling position?
• If a vendor is involved, what subprocessors are used?
• Will users know they are using AI and what warnings or instructions are provided?
• What red-team, abuse-resistance, and post-launch monitoring controls exist?

First Intake Set

Use this grouped intake set first when facts are missing:

• What is the internal AI use case and which team will use it?
• What data may be entered into prompts, retrieval, or context windows?
• What model or vendor is involved and how is it hosted?
• What human review is required before outputs are used?
• What training, acceptable-use controls, and monitoring exist?
• Do you have an AI impact assessment, technical documentation, privacy review, or testing summary?

Review Focus

• Data classification and usage restrictions
• Acceptable-use and training requirements
• Output-review expectations
• Retention, deletion, and access controls
• Procurement, security, privacy, and legal approvals where relevant