IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
AI rules at work
Zara finds staff using more than 40 AI apps. Nobody approved them. Your goal: write AI rules people will follow.
🧪 Interactive lab — enable JavaScript to play with this one.
- A ban does not stop AI use. It hides it.
- Good rules are short. They say yes to safe uses.
- List every AI use, each with an owner.
- Start where value is high and risk is low.
Look before you block
Staff often use unapproved AI tools. This is shadow AI. Work data can end up on consumer terms, with no record. A ban rarely fixes this. People just hide their use. First, ask staff which tools they use, and for what. Promise no blame.
Rules people can follow
Short rules for using AI at work are an acceptable use policy (AI). Good ones fit on 1 or 2 pages. Most have 7 parts:
| Part | Rule |
|---|---|
| ✅ Approved tools | Which tools, and how to add one |
| 🗂️ Data classes | What data may go into which tool. Secrets go into none. |
| 👀 Human review | What a person checks before it goes out |
| 🏷️ Disclosure | When to say AI was used |
| 🙋 Accountability | Who owns the result |
| ⛔ Prohibited uses | What never to do |
| 📣 Reporting | How to report a mistake, with no blame |
Rules fail in 3 ways. They ban everything. They are too vague, like "use AI responsibly." Or they ask for review of everything, so reviewers stop reading.
Know what you run
A list of every AI tool and use is an AI inventory. Each entry has an owner, its data and a risk level. Include AI built into your apps.
Risk grows with private data, harm to people and mistakes you can't undo. It grows when AI acts on its own, not just drafts. Under the EU AI Act, screening job applicants or scoring credit is high-risk.
Now sort 8 AI ideas yourself.
🧪 Interactive lab — enable JavaScript to play with this one.
Go deeper: the EU AI Act
The EU's law also covers AI from other countries used in the EU. It sorts AI by what it is used for:
| Level | Examples | What it means |
|---|---|---|
| ⛔ Banned | Social scoring. Reading emotions at work or school, except for medical or safety reasons. Building face databases from the internet. | Not allowed |
| ⚠️ High-risk | Screening job applicants. Credit scoring. Scoring exams. | Strict duties, like human oversight |
| 💬 Transparency | Chatbots. Deepfakes. AI-made text, images and audio. | Tell people it is AI. Mark AI-made content. |
| ✅ Minimal | Spam filters. AI in video games. | No new duties |
As of October 2026, the bans have applied since February 2, 2025. Two more bans start on December 2, 2026. They cover AI that makes sexual images of real people without consent, or child abuse material. Transparency duties apply from August 2, 2026. Tools already on the market have until December 2, 2026 to mark AI content. A 2026 change moved the high-risk rules for hiring and credit to December 2, 2027.
The GDPR still covers personal data you put into AI. Other places use guidelines and older laws instead. India's 2025 AI guidelines are voluntary, for example. This is a map, not legal advice.
Go deeper: finding shadow AI
In a 2024 survey by Microsoft and LinkedIn, 75% of office workers said they used AI at work. 78% of them brought their own AI tools.
Much AI now comes inside apps you already pay for. To find it, check web logs, expense claims and which AI features are on. Make the busiest uses safe first.
Go deeper: owning the result
In February 2024, a Canadian tribunal ruled against Air Canada. Its website chatbot gave a customer wrong advice about a fare. Air Canada said the chatbot was responsible for its own actions. The tribunal said no. The company is responsible for all the information on its website, chatbot answers included.
So a good policy says: you own what you send, whoever wrote the first draft. AI agents need an inventory entry too, with their own identity, an owner and an off switch. See the agent registry.
Go deeper: two frameworks
A US government agency made a free guide for AI risk. It is the NIST AI RMF. It came out in January 2023, and using it is voluntary. It has 4 parts:
- Govern: set the policies, roles and culture. It runs through the other three.
- Map: what is the system for? Who could it affect? What could go wrong?
- Measure: test and track those risks, with numbers where you can.
- Manage: act on what you found. Fix it, add checks, accept the risk or stop.
As of October 2026, NIST is revising the framework. So check for a newer version.
An international standard for managing AI is ISO/IEC 42001. It came out in December 2023. Unlike the NIST guide, a company can get certified against it.
Go deeper: pilots and training
Start with a small test, called a pilot. Time tasks before and after, because feeling faster is not proof.
Keep training short and hands-on. Cover the paste rules, checking AI output and prompt injection. Show how to report a mistake.