Privacy, copyright, confidentiality, and hallucinations

Treat four risk domains separately; one general warning is insufficient.

Privacy is about personal data; confidentiality about business information; copyright about protected material; hallucinations about invented or incorrectly linked content. One use case can affect all four.

Create per risk: scenario, likelihood, impact, prevention, detection, owner, and recovery. Pseudonymization sometimes lowers risk, but does not automatically make data anonymous.

Personal data
Trade secret
Usage rights
Factual error
Recovery

This is how you can use this

A quote assistant processes contact data, secret pricing rules, protected source text, and possibly invented terms.

Try this prompt

Build four risk registers for [use-case]: privacy, confidentiality, copyright, and incorrect output. Provide prevention, detection, owner, and remediation.

Your practical assignment

Analyze one data flow and assign an owner for each risk.

2.2

Classify data before use

Access to data does not automatically mean AI processing is permitted.

Classify as public, internal, confidential, strictly limited, and personal data. Add contractual or sectoral restrictions and determine per category the tool, storage, retention, and sharing.

Only use fields that the result requires. Check permissions and whether test data can be fictitious or synthetic.

Classification
Purpose restriction
Minimum fields
Retention
Access

This is how you can use this

A service report uses problem category and solution, but omits name and full file when they are not needed.

Try this prompt

Create a data classification for [workflow]. For each field, provide purpose, category, necessity, environment, retention, and a fictional test alternative.

Your practical assignment

Delete from an input set any field without demonstrable necessity.

2.3

Model choice per task

Choose based on task requirements and evaluation evidence, not on reputation or a single demo.

Establish modalities, tools, context, accuracy, and output format. Test writing, analysis, code, research, and images with different representative datasets where their requirements differ.

Change model names. Keep requirements, test set, and minimum score as a stable basis and retest when the model or prompt changes.

Task fit
Modality
Tools
Quality threshold
Retest

This is how you can use this

An imaging workflow and financial extraction process use different tests and possibly different models.

Try this prompt

Create a model selection protocol for [tasks]. Define requirements and test set; compare quality first and then speed and cost. Do not name a winner without measurement results.

Your practical assignment

Test two available options with five normal and two critical cases.

2.4

Speed, accuracy, context, and cost

Optimize only after minimum quality and safety limits have been met.

Latency affects usage; context determines available information; requests and tokens influence time and costs. More context can also add irrelevance and conflict.

Measure end-to-end time, correction work, and error costs. Shorter output, fewer requests, or a lighter model are only valid when the evaluation set quality confirms it.

Minimum quality
End-to-end time
Context
Volume
Error costs

This is how you can use this

An answer that is one second faster but requires more frequent correction is operationally slower.

Try this prompt

Design a matrix for [workflow] with minimum quality, p95 lead time, context requirement, volume, error costs, and budget. Propose three optimizations to test.

Your practical assignment

Carry out a baseline measurement of twenty executions including correction and repair.

2.5

ChatGPT, Work, plugin or API

The interface choice determines data flow, scale, review, and management.

Chat fits with defined dialogue; Work with larger reviewable deliverables; plugins with connected data or actions; API with own product integration, scale or structural logging.

Availability and permissions differ. Document identity, source rights, approval moment, and storage for each route.

Experience
Sources
Actions
Scale
Logging
Permissions

This is how you can use this

A periodic internal analysis can fit in Work; real-time processing in a client portal requires more of a managed integration.

Try this prompt

Compare Chat, Work, plugin, and API for [use-case] on data, identity, rights, review, logging, scale, and management. Mark unconfirmed availability.

Your practical assignment

Draw the data and consent flow for the chosen option.

2.6

Recording an architectural decision

Also record why you choose, under which assumptions, and when you reconsider.

Describe context, requirements, examined alternatives, choice, consequences, and owners. This way, a later team does not treat the choice as a law of nature.

Add review triggers such as volume growth, new sensitive data, model change, incident, or supplier. Link the decision to tests and risk register.

Context
Alternatives
Decision
Consequences
Proof
Trigger

This is how you can use this

An API choice is reviewed when volume doubles or a new data category appears.

Try this prompt

Write an architecture decision for [use-case] with context, requirements, options, choice, consequences, evidence, owner, and review triggers.

Your practical assignment

Have a technical and business owner review the same decision.

Risk, data, and solution choice

Privacy, copyright, confidentiality, and hallucinations

Classify data before use

Model choice per task

Speed, accuracy, context, and cost

ChatGPT, Work, plugin or API

Recording an architectural decision

Bring everything together