Before You Use Generative AI at Work: Issues Raised in Public Guidance

The questions to ask first are fairly consistent

Public bodies that have published guidance on AI tend to raise the same handful of issues: what information you feed in, how accurate the output is, who is responsible, and what records you keep. These documents are written for large organizations, but the same questions work as a first checklist for a solo operator or a small company.

Two sources are used here. One is the AI Risk Management Framework released by the U.S. National Institute of Standards and Technology (NIST) in 2023. The other is the AI Guidelines for Business, published in 2024 by Japan's Ministry of Internal Affairs and Communications and Ministry of Economy, Trade and Industry. This article does not summarize each requirement. It translates the themes into practice. For exact wording and current revisions, read the originals on the agencies' sites.

Output can be wrong

Generative AI can produce fluent text that contains errors. Public guidance treats accuracy, including the chance of false statements, as a core concern.

In practice, the safest habit is not to publish AI output as it comes. A person checks numbers, names, legal or regulatory statements, and quoted sources against the original. Decide who does that checking, and how you will record it, before you start.

For work where mistakes are costly, keep AI to drafts and idea generation, and let a person make the final judgment and the final version.

What you put in

The second theme is what you enter. Customer names, contact details, contracts, and unpublished material may be stored or used to improve a service, depending on the settings and terms of the tool you use.

Before entering anything, read the provider's terms and data settings. Check whether there is an option to opt out of training use and whether business plans handle data differently. These details differ by provider and change over time, so rely on current official explanations.

Then write an internal rule on one page listing what may and may not be entered. Personal data is covered by law, so if you are unsure, consult an attorney.

Responsibility and transparency

The third theme is accountability. If you send out a proposal or publish a text that AI helped draft, the responsibility is yours. The Japanese guidelines divide duties between those who develop or provide AI and those who use it.

Guidance also encourages being able to explain, when asked, where you use AI. Keep a short internal note listing which tasks use AI and which do not.

Output that resembles someone else's copyrighted work is another recognized concern. Before publishing images or text, check that they do not closely copy existing material. Copyright questions are specialized, so ask a professional when in doubt.

Start small and keep a record

NIST's framework describes a cycle of identifying, measuring, and managing risk, and repeating it. For a small business, that translates to trying AI on a small task, noting problems, and adjusting your rules.

Do not begin with customer-facing work. Start with internal research or first drafts, where an error does limited harm. Write down briefly what worked and what failed, and review your rules every six months.

Turning this into an internal rule

Keep the rule short enough to fit on one page. A workable outline:

• The purpose of using AI and the tasks where it is allowed.
• Information that must not be entered.
• Who checks output and what they check.
• Who to contact if something goes wrong, and how to stop using it.

If you have staff or outside contractors, share the same rule with them. Leaving it to individual judgment produces uneven handling.

Rules are developing abroad as well. In the European Union, a regulation on AI took effect in 2024, with obligations that scale with the level of risk. Japan's Agency for Cultural Affairs also published its view on AI and copyright in 2024. If your customers are overseas, or if you publish images or text, it is worth keeping an eye on these developments.

When to review your rules

AI services update their features and terms often. What you understood when you started may be out of date a few months later. Reread the terms and data settings of the services you use at least every six months, and reflect any changes in your own rules.

Whenever you extend AI to more of your work, check again what you enter and how you verify the output. More tasks mean more kinds of problems that can arise.

When in doubt, ask yourself who bears what responsibility if this output goes out. The heavier the answer, the more thorough the human check should be.

What to do next

1. Read the terms and data settings of the AI service you plan to use, and check whether your input can be used for training.
2. Write a one-page list of what you will and will not enter.
3. Name who checks AI output, and what they check: numbers, names, and statements about rules or laws.
4. Pick one low-risk task to start with.
5. After one month, record in three lines what went wrong and what you changed.

Official documents get updated, so check the latest versions from NIST and the Japanese ministries before you rely on them.