Decision inputs
Facts that change the policy answer
The request sits in marketing and communications and connects verified incident facts and an approved response plan with a holding statement or stakeholder update. That context distinguishes it from a generic permission to use AI.
- 1Task and owner
- Communications director wants to draft a crisis response. Record the person who will stand behind a holding statement or stakeholder update after the tool has finished.
- 2Information involved
- Verified incident facts and an approved response plan. Include attachments and connected sources when deciding the highest information classification.
- 3Tool and account
- An approved company account. Approval must cover the account and its settings, not merely the product name.
- 4Intended result
- The expected result is a holding statement or stakeholder update. Its destination matters: private working material creates a different consequence from a sent, published or automated result.
- 5Consequence if it is wrong
- Speed and incomplete facts can turn generated language into a false public statement. A familiar task still needs escalation when this consequence becomes plausible.
- 6Human review
- incident communications owner should inspect, change, reject or stop the result. A final glance after an automatic action would not give that owner meaningful control.
Possible policy routes
The task name alone cannot decide it.
A published workplace policy can return different answers for the same task. These are the practical branches worth encoding.
A routine policy route may be possible
A routine route is easier to justify when the exact account is approved, only the minimum sensitive incident information is used, a holding statement or stakeholder update remains within the stated purpose, and incident communications owner reviews it before use.
Approval may be required
Send the request for approval if the account or data handling is uncertain, speed and incomplete facts can turn generated language into a false public statement, or a holding statement or stakeholder update reaches people or systems beyond the requester’s authority.
The request may need to stop or change
Do not continue unchanged when restricted information would enter an unapproved service, the output would act before incident communications owner can intervene, or use only confirmed facts and require explicit approval immediately before release cannot be maintained. Consider less information, a controlled account or a non-AI process.
Request checklist
Questions to ask before using the tool
- 01
Has the company approved this account configuration for draft a crisis response, rather than only approving the product?
- 02
Who is permitted to expose verified incident facts and an approved response plan to this tool and for this purpose?
- 03
Who receives a holding statement or stakeholder update, and what will they do with it?
- 04
Who replaces incident communications owner when the request falls outside ordinary expertise?
- 05
When must the employee stop and run the policy check again?
Worked request
What the employee should submit
This example supplies decision facts without pasting the underlying material into the approval record.
- requester
- communications director
- task
- Use AI to draft a crisis response.
- information
- verified incident facts and an approved response plan
- tool
- An approved company account
- frequency
- Recurring work
- region
- Where the work and affected people are located
- purpose
- Draft or analyse
- impact
- Public statement
- review
- Complete human review
- owner
- incident communications owner
Useful safeguards
Controls that fit this request
- ✓
Use only confirmed facts and require explicit approval immediately before release
- ✓
Keep whole files, mailboxes and datasets out of the prompt when a short part of verified incident facts and an approved response plan is enough.
- ✓
Set an expiry or review point when recurring work turns into a permanent process.
- ✓
Keep the submitted facts, incident communications owner’s decision and the exact published policy version.
Questions people ask
About this AI use
Is using AI to draft a crisis response automatically allowed?
Even an ordinary draft a crisis response request can change route when it involves restricted information, an external audience or weak review.
How specific should the workplace AI request be?
Describe a holding statement or stakeholder update, identify verified incident facts and an approved response plan, name the exact tool and account, explain who will receive or rely on the output, and state how incident communications owner will review it.
How much of the request should the company retain?
Keep the submitted facts, incident communications owner’s decision and the exact published policy version. A classification and controlled reference may be enough when copying verified incident facts and an approved response plan would create unnecessary risk.