AI for Team and Tech Leads · 90 minutes
Set team rules for AI tools and company data
Write the rules a 30-person accounting team follows when it uses AI tools with client data. Classify the data, match each class to a tool by its data terms, give alternatives and an exception path, and handle client data that staff already pasted.
Scenario
1.5 h
Used in interview rounds:
Leadership Scenarios (Easy)1
Step 1: The question
Using the client accounts team scenario, write the AI rules you will propose to the managing partner. Classify the data, say which tool each class may go into and why, and apply your rules to T1 to T6, naming what staff do instead when a task is not allowed. Then cover the exception path, the client data already pasted into personal accounts, training, how you will check the rules are followed, and when you will review them.
Scenario: the client accounts team
Suppose you lead the client accounts team at a fictional accounting and tax firm in the EU with 150 staff. Your team has 30 people: 24 accountants and tax preparers who do bookkeeping, year-end accounts, and tax returns, and a 6-person payroll-services sub-team that runs monthly payroll for 85 client businesses. The managing partner has asked every team lead to propose team rules for AI tools within 2 weeks; a firm-wide policy will follow. All figures, contracts, and terms below are fictional.
What you found. Two staff mentioned in a team meeting that they use personal chat-assistant accounts to summarize client letters and draft emails. You ran a short anonymous survey:
| Question | Answer |
|---|---|
| Responded | 28 of 30, including all 6 payroll staff |
| Used a personal AI account for work in the last 3 months | 19 |
| Pasted text from a client document into a personal account at least once | 11, of whom 3 work in payroll |
| Most common uses | Summarizing client and tax-authority letters, drafting client emails, explaining tax rules, tidying spreadsheets |
The firm's information classes. IT set these for email and file sharing; they say nothing about AI. A file takes the class of the most sensitive item in it.
| Class | Examples |
|---|---|
| Public | Published tax-authority guidance, the firm's website articles |
| Internal | Procedures, templates, training notes, meeting notes with no client details |
| Client confidential | Anything that identifies a client or their affairs: names, letters, emails, accounts, fees, tax figures |
| Restricted | Tax IDs and other government ID numbers, bank account details, payroll records, health information such as sick-leave reasons, passwords and portal logins |
Client contracts.
- Accounting and tax engagement letters promise confidentiality, allow the firm to use IT service providers under confidentiality and data protection terms, and say the firm will publish nothing about a client without the client's written consent.
- Payroll contracts say the firm handles employee data only on the client's instructions and needs each client's written approval before any new subcontractor handles that data. No payroll client has been asked about an AI tool.
Other facts.
- The new-client checklist asks for photo ID and the last three bank statements.
- Client files are kept in the firm's document management system. Payroll for all 85 clients, including sick pay, runs in the firm's payroll software. Neither system has an AI feature.
Scenario: the two kinds of AI tool
Two kinds of AI tool are in use. Option B's terms come from the fictional trial contract. The DPO is the firm's data protection officer, who advises it on data protection law.
| Option A: personal accounts on consumer chat assistants | Option B: the firm's enterprise assistant (trial) | |
|---|---|---|
| Account holder | Each staff member, with a personal email | The firm; staff sign in with single sign-on (SSO: one firm login that IT removes when someone leaves) |
| Contract with the firm | None | 3-month trial for all 150 staff; this is week 1 |
| Use of inputs to train models | Depends on each user's settings and the provider's consumer terms | Not used (contract) |
| Retention | Set by the provider and the user; the firm cannot see, export, or delete chats | Kept until the user or an admin deletes them; deleted chats are removed from the provider's systems within 28 days |
| Storage location | Not known to the firm | EU (contract) |
| Admin controls | None | User list; a usage log of who used it and when, not chat content; switches for file upload and web search (both on) and third-party connectors (off); export and delete all firm data at contract end |
| DPO review | None | Approved for Public, Internal, and Client confidential data. Restricted data not yet reviewed; review booked for week 6 |
Scenario: six tasks from last month
Six tasks staff did with AI in the last month, with the data each one involves.
| Task | Who | Data involved |
|---|---|---|
| T1. Explain a newly published tax-authority guidance note on home-office expenses for the team newsletter | Tax preparer | The published guidance note only |
| T2. Draft a reply to a client who asks why their quarterly fee went up | Accountant | The client's name, the email thread, the fee figures |
| T3. Summarize a tax-authority letter about a client's late-filing penalty and draft a plain-language explanation for the client | Tax preparer | The client's name and address, tax ID, penalty amounts, and the client's bank account number for the direct debit (a scanned paper letter) |
| T4. Summarize three employees' sick-leave notes to work out sick pay for a payroll client | Payroll specialist | Employee names, salaries, tax IDs, sick-leave reasons |
| T5. Upload a 40-page scanned bundle a new client emailed and ask for a list of what is in it | Accountant | Unknown: nobody has opened the bundle yet |
| T6. Draft a case study about a client for the firm's website in a personal account, with the client's name removed "so it is anonymous" | Accountant | The client's business (the only organic bakery in a town of about 4,000 people), 14 staff, two years of revenue figures |
Constraints
- Use only the facts in the scenario; terms it does not state are unknown.
- Give no legal conclusions: where the law matters, say who decides (the DPO or counsel).
- Keep the staff rules to one page; the per-task part can be a table.
Deliverables
- The data classes you use and the class of each task
- Which tool each class may go into, with the terms that decide it
- The rule for each of T1 to T6, with a redaction step or an alternative where needed
- An exception path and the steps for data already in personal accounts
- Your decision on each tool, with training, checks, and a review date
2
Step 2: Hints
Optional. Each hint gives a little more away.
3
Step 3: Your answer
Kept in this browser. Saving your score below keeps a copy with it.
0 / 5000
4
Step 4: Reference answer
5
Step 5: Score yourself
Score each dimension 0, 1, or 2, then save the score to your history. Readiness thresholds are editorial estimates.
Grades your written answer against this rubric with your own AI provider key from Settings. It is a second opinion: the score you save is still yours.
What earns a 2: Classifies every task by its most sensitive item, including files nobody has checked and data with the name removed.
What earns a 2: Decides which classes each tool may hold from named terms (training use, retention and deletion, location, account holder, admin controls, review scope), not from the tool's name or reputation.
What earns a 2: Gives a rule for every task, with a redaction step where it makes a task safe and a named alternative for every task the rules refuse.
What earns a 2: Sets a no-blame way to report past use, escalates to the person who decides on reporting, and defines an exception path with an owner, a turnaround, and a record.
What earns a 2: States the decision for each tool with its reasons, backs it with role-based training and proportionate checks, and sets a review date and the events that trigger an earlier review.
0 of 10 · Scored 0 of 5 dimensions
Ready at 8 of 10, with no 0 in Data classes or Past exposure and exceptions or Decision, enforcement, and review
Kept in this browser until you sign up, then it moves to your account.
Complete this level when you can classify any task in the scenario without the guide, say which tool each class may go into and why, and walk through the first day after someone reports pasting client data into a personal account.
Your saved scores
Practice saves and mock interview answers on this question, newest first.
No saved scores yet. Score every dimension, then save.
6
Step 6: Follow-up questions
An interviewer may ask these next.
What is shadow AI, and what usually happens to it when an organization bans AI tools without offering an approved one?
Why are training use and retention separate questions in a tool's data terms?
What class does a document get when it mixes data of different classes?
Someone reports that they pasted client data into a personal AI account last month. Who decides whether it must be reported?
As of November 2026, what does EU AI Act Article 4 ask of an organization whose staff use AI tools for work?
7