Safe AI Use Guide for Staff (Free, Full Text)

1. Golden rules

Do	Don’t
Use only approved AI tools: [list approved tools].	Use personal or free AI accounts for work data.
Sign in with your company account (SSO).	Link personal email, storage or other accounts to company AI tools.
Check the data label before you paste or upload.	Paste passwords, API keys or tokens — ever.
Remove names and personal details you don’t need.	Upload customer lists, payroll, health or ID data unless your use case is approved.
Check AI answers for accuracy before you rely on or send them.	Treat AI output as fact, or let it make decisions about people on its own.
Say when content is AI-generated where required.	Present AI output to clients as fully human-written where disclosure is required.
Request new connectors or features through [request channel].	Install extensions, MCP servers or plugins yourself.
Announce an AI note-taker and get everyone’s agreement before it records.	Record HR, legal or board meetings with AI, or let outside note-taker bots join your meetings.

2. Data quick reference

Data	Personal / free AI	Approved AI [T1]	Hardened AI [T2]
Public	Green — OK	Green — OK	Green — OK
Internal	Red — No	Green — OK	Green — OK
Confidential	Red — No	Green — OK for work need	Green — OK
Restricted (personal data at scale, NRIC, health, client secrets)	Red — No	Red — No	Amber — approved use cases only
Secrets (passwords, keys, tokens)	Red — No	Red — No	Red — No

Not sure? Treat it as the higher label and ask [AI Governance Lead / data owner].

3. Connectors and browser agents — quick rules

Use only connectors already approved by [CLIENT NAME]. Ask before connecting anything new.
Read the confirmation before approving any action the AI wants to take (send, delete, submit, buy). If in doubt, decline.
Prefer a connector over letting an AI drive your browser.
Browser/computer agents: stay with it while it works; never let it enter passwords, make payments, accept terms or touch banking, HR or admin sites.
If the AI starts doing something you didn’t ask for — stop it and report it. It may be following hidden instructions in a web page or document.

4. AI note-takers — quick tips

Use only the note-taker approved by [CLIENT NAME]: [approved note-taker tool].
Say at the start: “This meeting will be transcribed by AI — any objections?” Tell external guests in the invitation. If anyone objects, switch it off.
Do not use AI note-takers for HR, legal, board or other Restricted meetings unless approved in advance.
Read the AI summary and fix errors before you send it — you are accountable for what it says.
Remove any unknown note-taker bot that joins your meeting.

5. How to report a problem

Shared something you shouldn’t have, or an AI took an unexpected action? Report it immediately to [IT Service Desk contact / email / phone]. Fast reporting limits harm — you will not be penalised for honest mistakes reported promptly.
Pasted a password or key? Report it and change it straight away.
Questions about AI use: [AI Governance Lead contact / channel].

Document	Relationship
AGK-POL-02 AI Acceptable Use Policy	The binding rules this guide summarises
AGK-STD-A02 AI Data Handling Standard	Full data matrix; meeting assistant rules (C21–C26)
AGK-TPL-07 AI Acceptable Use Acknowledgement	Staff attestation
AGK-GDL-A01-BM Panduan Penggunaan AI Secara Selamat untuk Kakitangan	Bahasa Malaysia version

7. Framework alignment

This document supports the following external frameworks and regulations. References are indicative; confirm against the current text before relying on them for compliance claims.

Framework / regulation	Reference
ISO/IEC 42001:2023	A.9 use of AI systems; clause 7.3 awareness
EU AI Act	Art. 4 AI literacy
Malaysia AIGE (2024)	Principles of safety, privacy and accountability