Domain 6 · 15% of the exam
Governance, Risk, and Responsible Use
Use Claude within the rules: separate what it can do from what you may do, protect sensitive data, follow organisational policy, and take responsibility for ethical outcomes.
Task statements
- 6.1
Appropriate vs Inappropriate Use
Capability is not permission. Claude being able to do a task does not mean you are allowed to use it for that task, with that data, in that way. Know the limits of appropriate use and escalate when a need goes beyond the chat product.
- 6.2
Data Sensitivity, Privacy, and Regulation
Protect sensitive data before it reaches Claude. The reliable pattern is anonymise first, then analyse. Telling Claude not to retain or reuse information is not a control; removing the sensitive details beforehand is.
- 6.3
Organizational AI Policy
Your organisation's AI policy decides what is allowed. Read it before you paste anything, follow it even when it is inconvenient, and escalate when the policy is silent or ambiguous rather than guessing.
- 6.4
Ethical Implications
Using AI at work carries ethical duties. Be honest about when AI helped, keep a named person accountable for results, watch for bias, and keep humans in charge of decisions that materially affect people.