Free AI policy quiz for employees Content version 3 Choose your answers. Your score and explanations appear at the end. 1. Your employer approves an AI tool for public marketing copy. Does that also permit uploading employee health records? A. Yes, provided the upload uses the same work account. B. Yes, provided you do not ask the tool to name the employees. C. No, because an AI tool can never process any personal data. D. No, the intended use and data need their own approval. Answer: No, the intended use and data need their own approval. Approval for one use does not cover every use or dataset. Personal data may be processed in an authorised setup with the required safeguards. Source: ICO: internal AI use policy 2. An approved AI tool needs a customer’s complaint text to draft a reply. Their payment details are not needed. What should you provide? A. The complaint and only the details needed for the reply. B. The whole customer record so the model has more context. C. No personal data, even though this use has been approved. D. The complaint plus all previous purchases in case they help. Answer: The complaint and only the details needed for the reply. Use the information needed for the approved task, without unnecessary details. More context is not a reason to include unrelated personal data. Source: ICO: data minimisation 3. You remove names from staff feedback, but the comments mention unique job titles and incidents. Is the feedback necessarily anonymous? A. Yes, removing names is enough to make any feedback anonymous. B. Yes, provided the file is not labelled with the team’s name. C. No, the remaining details may still identify people. D. Yes, provided the AI does not include those details in its answer. Answer: No, the remaining details may still identify people. Someone may be identifiable from their role, events or other information. Anonymisation requires more than deleting names. Source: ICO: anonymisation 4. You replace employee names with numbers and keep a separate list linking numbers to names. What is this? A. Anonymisation; data protection no longer applies. B. Aggregation; individual records have been removed. C. Pseudonymisation; the records are still personal data. D. Encryption; nobody can read the records. Answer: Pseudonymisation; the records are still personal data. The separate key lets you identify people again. Pseudonymisation can reduce risk, but it does not turn personal data into anonymous information. Source: ICO: anonymisation 5. You turn off an AI service’s “use my data for training” setting. What must you still check before uploading a confidential document? A. Only whether the document uses your organisation’s branding. B. Whether this use is approved and how the service stores, uses and shares the data. C. Only whether a colleague has uploaded a similar document before. D. Nothing further; opting out means the provider cannot retain the document. Answer: Whether this use is approved and how the service stores, uses and shares the data. A training opt-out addresses one use of the data. It does not by itself establish approval, retention periods or who can access the document. Source: NCSC: language model risks 6. AI ranks job applicants for a recruiter. What makes the recruiter’s review meaningful? A. Approving the ranking once the names look correct. B. Checking that the ranking is presented in a clear format. C. Reviewing the evidence and having authority to change the recommendation. D. Asking the model to confirm that its ranking is fair. Answer: Reviewing the evidence and having authority to change the recommendation. A reviewer needs to assess the recommendation and challenge it when necessary. Rubber-stamping an AI ranking is not meaningful oversight. Source: ICO: AI systems and individual rights 7. You discover that an AI-generated document sent to a client contains incorrect figures. What is the best next step? A. Raise it promptly through your organisation’s reporting process. B. Quietly correct your own copy and take no further action. C. Ask the model to confirm the figures before telling anyone. D. Wait until the client asks about the discrepancy. Answer: Raise it promptly through your organisation’s reporting process. Report the error so the right people can correct the information and assess its impact. The reporting route depends on your organisation. Source: ICO: internal AI use policy 8. A manager uses an AI recommendation to make a staff decision. Who remains responsible for the decision? A. The software provider, because the manager used an approved tool. B. The manager and organisation making it. C. The team that wrote the prompt, instead of the decision-maker. D. The employee, because they can challenge the outcome. Answer: The manager and organisation making it. Using AI does not transfer responsibility for a workplace decision to the model. The organisation must consider fairness and the consequences for people. Source: Microsoft Learn: responsible AI 9. You connect an AI assistant to work systems. Why should it have only the permissions needed for its task? A. Limited permissions reduce the harm from mistakes or malicious instructions. B. Broad permissions are safer because the assistant will not need to ask for help. C. Permission settings only matter when the assistant works outside office hours. D. Read and write permissions are interchangeable if the assistant can explain its actions. Answer: Limited permissions reduce the harm from mistakes or malicious instructions. A tool-using assistant can act on connected systems. Restricting its access limits what a mistake or prompt injection can affect. Source: NCSC: prompt injection 10. A reviewer notices evidence that conflicts with an AI recommendation but accepts the recommendation without checking. Which risk does this illustrate? A. Automation bias: giving too much weight to an automated recommendation. B. Data minimisation: keeping only the information needed for a task. C. Anonymisation: removing details that identify someone. D. Prompt injection: a malicious instruction hidden in a document. Answer: Automation bias: giving too much weight to an automated recommendation. Automation bias is over-reliance on an automated result. Meaningful review requires checking conflicting evidence and being able to change the decision. Source: ICO: AI systems and individual rights References for this quiz Original questions by TestSetGo, based on the linked materials. No endorsement or certification is implied. ICO: internal AI use policy The ICO’s own policy covers approved tools, human review and reporting concerns. We use it as a policy example, not a rule for all workplaces. https://ico.org.uk/media2/u3ad0ucv/internal-ai-use-policy.pdf ICO: data minimisation Use enough personal data for the specified purpose, without including unnecessary information. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/ ICO: anonymisation Removing names does not necessarily make information anonymous. Coded records remain personal data if people can still be identified. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/ NCSC: language model risks Prompts can reveal information to a provider. Check how the service stores and uses information. https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk ICO: AI systems and individual rights Meaningful human review needs people who can assess and challenge the system’s output, rather than simply accept it. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-individual-rights-in-our-ai-systems/ Microsoft Learn: responsible AI Fairness and accountability need attention when an AI system affects people. https://learn.microsoft.com/en-us/azure/machine-learning/concept-responsible-ai NCSC: prompt injection Untrusted content can include malicious instructions. Connected tools increase the consequences of following them. https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection