Digital Hub AI

AI Privacy and Risk Review Prompt

Review an intended AI task for sensitive data, unreliable outputs and human-approval needs before information is entered into a tool.

By DHZ Editorial Team
PromptsBeginnerSetup: 15–20 minutes
Works with:Platform Independent

Last tested:

Use this prompt before starting an AI-assisted task that may involve customer information, internal documents, analytics, research or automated actions. It creates a practical review checklist; it does not certify legal compliance or replace a data-protection professional.

What this prompt helps you do

The review separates the proposed task from the real data. It looks for information that should be removed or minimised, identifies ways an output could be wrong, and defines where a person must approve the result. This reflects the risk-management themes in the NIST AI Risk Management Framework and its Govern, Map, Measure and Manage functions.

Suitable audience

  • Content and marketing teams planning AI-assisted research or drafting.
  • Small organisations evaluating an AI workflow before connecting accounts or forms.
  • Editors and managers who need a repeatable human-review checkpoint.
  • Anyone who wants to test a task with fictional data before using real information.

Before you begin

  • Describe data types only. Do not paste real names, email addresses, passwords, customer records or confidential documents into the review prompt.
  • Find the official privacy, retention, training and administrator-control documentation for the product and plan you intend to use.
  • Decide who owns the task and who can stop it.
  • List any external action—sending, publishing, deleting, purchasing or changing access—that must remain behind human approval.

Copy the prompt

Act as a cautious AI task-risk reviewer. Review the proposed use before any sensitive material is entered into an AI service.

Task: [DESCRIBE THE TASK]
Information that may be used: [LIST DATA TYPES, NOT REAL DATA]
Intended users and affected people: [AUDIENCE]
AI product or service: [PRODUCT AND PLAN, IF KNOWN]
Connected tools or actions: [NONE OR LIST THEM]
Required human decision: [WHO REVIEWS WHAT]

Return:
1. A short task summary.
2. Data risks: personal, confidential, commercially sensitive, copyrighted or security-related information that should be removed, minimised or approved before use.
3. Output risks: likely errors, bias, missing context, stale knowledge or misleading confidence.
4. Action risks: anything that must not be sent, published, deleted, purchased or decided automatically.
5. Safer setup: redaction, synthetic examples, access limits, retention checks and a human-review point.
6. Verification plan: which claims or outputs require primary-source checking.
7. Stop conditions: circumstances in which the task should not proceed.

Do not provide legal advice or claim the task is compliant. If product data-handling terms are unavailable, say that they must be checked in the official documentation. Distinguish verified facts from assumptions and questions.

Example input

Task: Summarise themes from support enquiries for a monthly editorial meeting.
Information that may be used: Message text, enquiry category and submission date; no names or contact details.
Intended users and affected people: Internal editorial team and people who contacted the site.
AI product or service: [product and plan to verify]
Connected tools or actions: None.
Required human decision: An editor verifies themes and quotations before they enter the report.

How to review the response

  1. Confirm that every data type is genuinely needed for the stated purpose.
  2. Replace real records with synthetic examples for early testing.
  3. Check the product’s current official terms and account settings; do not rely on the model to describe its own data handling.
  4. Test incomplete, ambiguous and adversarial examples so uncertainty is visible.
  5. Document the human reviewer, the evidence they check and the actions they alone may approve.
  6. Keep a way to stop the workflow and recover from failures without duplicating messages or records.

Limitations

A prompt cannot inspect contractual terms, organisational permissions or technical controls unless accurate current material is supplied. It can also miss risks or describe them confidently. Treat the result as a structured conversation starter, not an approval decision.

For broader editorial checks, use the Editorial Quality Review Agent. The website accessibility audit checklist helps keep human-facing experiences in view, while the Readability & Content Clarity Checker runs locally in the browser.

Privacy and security cautions

  • Never include credentials, authentication codes or payment data.
  • Minimise personal data and remove direct identifiers before testing.
  • Use approved organisational accounts and access controls rather than shared personal accounts.
  • Review retention, model-training and data-location terms for the exact product and plan.
  • Do not allow the workflow to make consequential decisions about people without qualified human review.

Sources