Writing a Workplace AI Acceptable Use Policy Quiz

Answers and explanations appear as you take the quiz.

1. Why does the guide recommend keeping the approved tools list as a separate living document?
   • Regulators require a separate file
   • Tools change often, so the list can be updated without rewriting the policy
   • It hides the list from employees
   • Separate documents cannot be edited
2. How should a policy define which information may go into which tools?
   • By linking to the organization's existing data classification levels
   • By letting each employee decide case by case
   • By banning all data from every tool
   • By relying on the vendor's marketing claims
3. What does the guide say tends to happen with a blanket ban on AI tools?
   • It removes all AI risk
   • It speeds up tool procurement
   • It improves employee training results
   • It pushes use onto personal devices where nobody can see it
4. Under the human review section, who is responsible for the accuracy of AI output?
   • The AI vendor
   • The IT department
   • The person who uses the output
   • Nobody, if the tool was approved
5. Which feature fits a Tier A tool in the guide's matrix?
   • A free consumer account with default settings
   • Contract terms excluding training on your data, plus single sign-on and audit logs
   • Any tool an employee installs personally
   • A tool with no retention controls
6. Which framework did NIST publish in January 2023 that can inform an AI policy?
   • The AI Risk Management Framework
   • ISO/IEC 42001
   • The General Data Protection Regulation
   • The SOC 2 standard
7. Why should the policy's scope include AI features built into software the company already uses?
   • Built-in features never process data
   • Built-in features are always illegal
   • Only built-in features need disclosure
   • AI features often arrive through routine updates to existing software
8. Which item belongs on a vendor review checklist?
   • The vendor's office decor
   • The number of social media followers
   • Data retention periods and whether inputs are used for training
   • The color of the user interface