6.3 — Following Organisational AI Policies and Governance Standards

CCAO-F Domain 6 · Task 6.3

What You Need to Know

The rule is short: use the workspace your organisation provides.

Why the Sanctioned Workspace Is Substance

When an organisation provides Claude, the arrangement governs how its data is handled. The customer is Controller; Anthropic is Processor on the customer’s behalf. By default Anthropic will not use inputs or outputs from commercial products to train its models. Agreement, administration and data handling all attach to the sanctioned workspace.

Personal Accounts Are Different

A personal account sits under the individual’s own consumer relationship with Anthropic. The employer does not administer, see or govern any of it. A paid personal plan with careful settings changes nothing — the question is whose agreement governs the data.

The Shadow-AI Response Has Two Halves

1. Do not copy the workaround, however pressing the deadline
2. Raise it with whoever owns the policy or the data

Deleting chats or closing the account is after-the-fact tidying. The disclosure has already happened.

Policy Silence and Working Habits

A policy’s silence means the question has not been answered. Ask the policy’s owner. When policy conflicts with convenience, the policy wins. When the policy is genuinely wrong or too slow, get its owner to change it rather than work around it.

Key Concept: The keyed answer does both halves of the shadow-AI response. Candidates reliably miss the second.

Exam Traps

• Fixing only half of the shadow-AI situation
• Offering deletion as remediation for material already disclosed
• Treating policy silence as permission