Free practice quiz

Free AI policy quiz for employees

Check what you know about sharing data, reviewing AI output and using approved tools at work.

Read the questions Use with my team

The interactive test is coming soon. Explore the questions below.

Try the questions

Questions and answers

Try the test above, or check each answer below.

Question 1 · Approved use
Your employer approves an AI tool for public marketing copy. Does that also permit uploading employee health records?
1. Yes, provided the upload uses the same work account.
2. Yes, provided you do not ask the tool to name the employees.
3. No, because an AI tool can never process any personal data.
4. No, the intended use and data need their own approval.
Show answer for question 1
Correct answer
- No, the intended use and data need their own approval.
Approval for one use does not cover every use or dataset. Personal data may be processed in an authorised setup with the required safeguards.
Read more: ICO: internal AI use policy
Question 2 · Data minimisation
An approved AI tool needs a customer’s complaint text to draft a reply. Their payment details are not needed. What should you provide?
1. The complaint and only the details needed for the reply.
2. The whole customer record so the model has more context.
3. No personal data, even though this use has been approved.
4. The complaint plus all previous purchases in case they help.
Show answer for question 2
Correct answer
- The complaint and only the details needed for the reply.
Use the information needed for the approved task, without unnecessary details. More context is not a reason to include unrelated personal data.
Read more: ICO: data minimisation
Question 3 · Anonymisation
You remove names from staff feedback, but the comments mention unique job titles and incidents. Is the feedback necessarily anonymous?
1. Yes, removing names is enough to make any feedback anonymous.
2. Yes, provided the file is not labelled with the team’s name.
3. No, the remaining details may still identify people.
4. Yes, provided the AI does not include those details in its answer.
Show answer for question 3
Correct answer
- No, the remaining details may still identify people.
Someone may be identifiable from their role, events or other information. Anonymisation requires more than deleting names.
Read more: ICO: anonymisation
Question 4 · Coded records
You replace employee names with numbers and keep a separate list linking numbers to names. What is this?
1. Anonymisation; data protection no longer applies.
2. Aggregation; individual records have been removed.
3. Pseudonymisation; the records are still personal data.
4. Encryption; nobody can read the records.
Show answer for question 4
Correct answer
- Pseudonymisation; the records are still personal data.
The separate key lets you identify people again. Pseudonymisation can reduce risk, but it does not turn personal data into anonymous information.
Read more: ICO: anonymisation
Question 5 · Provider settings
You turn off an AI service’s “use my data for training” setting. What must you still check before uploading a confidential document?
1. Only whether the document uses your organisation’s branding.
2. Whether this use is approved and how the service stores, uses and shares the data.
3. Only whether a colleague has uploaded a similar document before.
4. Nothing further; opting out means the provider cannot retain the document.
Show answer for question 5
Correct answer
- Whether this use is approved and how the service stores, uses and shares the data.
A training opt-out addresses one use of the data. It does not by itself establish approval, retention periods or who can access the document.
Read more: NCSC: language model risks
Question 6 · Reviewing decisions
AI ranks job applicants for a recruiter. What makes the recruiter’s review meaningful?
1. Approving the ranking once the names look correct.
2. Checking that the ranking is presented in a clear format.
3. Reviewing the evidence and having authority to change the recommendation.
4. Asking the model to confirm that its ranking is fair.
Show answer for question 6
Correct answer
- Reviewing the evidence and having authority to change the recommendation.
A reviewer needs to assess the recommendation and challenge it when necessary. Rubber-stamping an AI ranking is not meaningful oversight.
Read more: ICO: AI systems and individual rights
Question 7 · Reporting concerns
You discover that an AI-generated document sent to a client contains incorrect figures. What is the best next step?
1. Raise it promptly through your organisation’s reporting process.
2. Quietly correct your own copy and take no further action.
3. Ask the model to confirm the figures before telling anyone.
4. Wait until the client asks about the discrepancy.
Show answer for question 7
Correct answer
- Raise it promptly through your organisation’s reporting process.
Report the error so the right people can correct the information and assess its impact. The reporting route depends on your organisation.
Read more: ICO: internal AI use policy
Question 8 · Accountability
A manager uses an AI recommendation to make a staff decision. Who remains responsible for the decision?
1. The software provider, because the manager used an approved tool.
2. The manager and organisation making it.
3. The team that wrote the prompt, instead of the decision-maker.
4. The employee, because they can challenge the outcome.
Show answer for question 8
Correct answer
- The manager and organisation making it.
Using AI does not transfer responsibility for a workplace decision to the model. The organisation must consider fairness and the consequences for people.
Read more: Microsoft Learn: responsible AI
Question 9 · Tool permissions
You connect an AI assistant to work systems. Why should it have only the permissions needed for its task?
1. Limited permissions reduce the harm from mistakes or malicious instructions.
2. Broad permissions are safer because the assistant will not need to ask for help.
3. Permission settings only matter when the assistant works outside office hours.
4. Read and write permissions are interchangeable if the assistant can explain its actions.
Show answer for question 9
Correct answer
- Limited permissions reduce the harm from mistakes or malicious instructions.
A tool-using assistant can act on connected systems. Restricting its access limits what a mistake or prompt injection can affect.
Read more: NCSC: prompt injection
Question 10 · Automation bias
A reviewer notices evidence that conflicts with an AI recommendation but accepts the recommendation without checking. Which risk does this illustrate?
1. Automation bias: giving too much weight to an automated recommendation.
2. Data minimisation: keeping only the information needed for a task.
3. Anonymisation: removing details that identify someone.
4. Prompt injection: a malicious instruction hidden in a document.
Show answer for question 10
Correct answer
- Automation bias: giving too much weight to an automated recommendation.
Automation bias is over-reliance on an automated result. Meaningful review requires checking conflicting evidence and being able to change the decision.
Read more: ICO: AI systems and individual rights

For your team

Get your team’s results

Use this to start a discussion about responsible AI use. It covers general principles, not your organisation’s policy. Replace or add questions about your approval and reporting process.

Use this template See how it works

Use these questions

Download and adapt them for your training.

Questions and answers TXT Questions for import CSV

Sources used for this quiz

We wrote these questions using the materials below. They are not official assessments from these organisations.

Practice quiz · Not a qualification

Privacy All free quizzes

Questions and answers

Your employer approves an AI tool for public marketing copy. Does that also permit uploading employee health records?

An approved AI tool needs a customer’s complaint text to draft a reply. Their payment details are not needed. What should you provide?

You remove names from staff feedback, but the comments mention unique job titles and incidents. Is the feedback necessarily anonymous?

You replace employee names with numbers and keep a separate list linking numbers to names. What is this?

You turn off an AI service’s “use my data for training” setting. What must you still check before uploading a confidential document?

AI ranks job applicants for a recruiter. What makes the recruiter’s review meaningful?

You discover that an AI-generated document sent to a client contains incorrect figures. What is the best next step?

A manager uses an AI recommendation to make a staff decision. Who remains responsible for the decision?

You connect an AI assistant to work systems. Why should it have only the permissions needed for its task?

A reviewer notices evidence that conflicts with an AI recommendation but accepts the recommendation without checking. Which risk does this illustrate?

Get your team’s results

Use these questions

Try another quiz

Workplace AI literacy

Workplace induction essentials