An error here is a violation not an inconvenience. The FTC does not care that your rep was trying to be helpful.
Today we're looking at why Late Fee Media's customer support teambenefits from a clear Internal AI Acceptable Use Policy: what gets escalated toa supervisor or a specialist before the Company officially responds to acustomer.
If you're business-to-consumer, this is a priority. An error here is aviolation not an inconvenience. The FTC does not care that your rep was tryingto be helpful.
The Risk Late Fee Media's customer service star - Rosie used toescalate anything she couldn't find in the policies. Now she asks an AI chat.(Note that Late Fee Media bought the minimum enterprise seats for Engineeringonly. Rosie uses her consumer plan because she is resourceful.)
Here's Rosie's month: • She told a frustrated customer that the original notice about a missing credit wasn't sent by Late Fee Media. • She told the same customer that Late Fee Media doesn't have a separate notice address or portal for certain complaints, and to just email everything to the customer service. • She told another customer that Late Fee Media disclaimed warranty in the terms, because that's what the AI chat said.
What just happened? • Your company data and your customer's personal data went into a (free) consumer-tier tool, where retention and training posture are set by the consumer terms. Not the enterprise terms. Nobody negotiated anything here. If training is not off, the AI model may train on such data. Based on data retention, a third party has personal data beyond your privacy notice retention policies.
• A customer now believes there may have been a data breach, because someone writing from your letterhead knows they're a customer and knows their address, and your own rep said the notice wasn't yours.
• A customer has in writing that your company doesn't offer a required notice path. You do. Rosie didn't know that, and the model didn't either.
• A customer now believes your company is breaching its own terms of service, on your company's word.
Four sentences. None of them written by anyone who had the facts.
The fix?
An internal AI Acceptable Use Policy that specifies: 1. What questions escalate to a manager. 2. What questions escalate to a specialist function: DPO, compliance, legal, product. 3. What data may be entered into a model, and on what tooling. 4. Whatever else your industry and product demand, because the generic version of this document is the one that gets ignored.
If you already built the data map (003) and evaluated your vendors' AIfeatures (004), you're mostly done. It needs to be papered and communicated.Please fix!
Pre-AI, Rosie said "let me check," and you found out slowly. Now you find out when compliance reads it in a demand letter.
