Discuss your project

TOOLBOX · DOWNLOAD

Using generative AI safely.

AI assistants save time, but they also bring risks: confidential data in the wrong tool, convincingly worded errors, and hidden instructions in third-party content. This cheat sheet shows what may go into a prompt, how to check results and recognize prompt injection, what the AI Act requires, and when to report.

Download PDF (7 pages)What Is Inside

Free PDF · Cheat sheet

Using Generative AI Safely: Cheat Sheet for Employees

Topic
AI in Business
Format
PDF, A4
Length
7 pages
Size
100 KB
Updated
Oct 25, 2026
Sources
12
Usage
Redistribution in unchanged form permitted
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

What may go into a prompt, how to check results and recognize prompt injection, what the AI Act requires, and when to report.

  • All employees who use chat assistants, copilots, or writing, translation, or image tools
  • Employees who use AI assistants with access to their mailbox, files, or browser
  • Managers who share the cheat sheet, post it, or use it in training
  • IT, data protection, and information security teams who define approvals and reporting channels

7 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What May Go into a Prompt: the Data Classification Traffic Light

    The more confidential the data, the narrower the range of tools. Never credentials.

  • 02

    Approved Tools Only: Avoid Shadow AI

    Private accounts, free web services, and extensions without approval are shadow AI.

  • 03

    Check Results: Facts, Sources, Figures, Code

    AI answers sound certain even when they are wrong: check them and ask better questions.

  • 04

    Recognize Prompt Injection

    Hidden instructions in third-party content: warning signs and rules for AI agents.

  • 05

    Labeling and AI Literacy under the AI Act

    Art. 50 and Art. 4 of the AI Act as amended by Regulation (EU) 2026/1744.

  • 06

    Report an Incident: What, When, How

    What to do immediately, depending on the situation. Reporting is not an admission of guilt.

  • 07

    Checklists to Post

    Five questions each before sending and before using, as a TOMORIS recommendation.

EXCERPT

What May Go into a Prompt: the Data Classification Traffic Light

Data classification traffic light (TOMORIS recommendation, adapt to your company's data classes)
LevelExamplesWhere it may go
Green: publicPublished texts, general technical questions without reference to individuals or customersAll approved tools
Yellow: internalProcesses, templates, drafts without reference to individuals or customersApproved tools with a work account
Red: confidentialContracts, cost calculations, source code, trade secrets (§ 26b para. 1 UWG, Austrian Unfair Competition Act), customer and personnel data (Art. 4(1) GDPR)Only tools explicitly approved for this purpose, otherwise placeholders
Off-limitsPasswords, PINs, one-time codes, API keys; health data and other special categories (Art. 9(1) GDPR)Never credentials; special categories only if an exception under Art. 9(2) GDPR applies and data protection has approved the tool
  • Enter only what the task needs: personal data must be limited to what is necessary (Art. 5(1)(c) GDPR); the BSI advises handling sensitive data sparingly (M18).
  • Use placeholders such as [Customer A] instead of names. If the link can be restored with additional information, the data remains personal data (Recital 26 GDPR).
  • Uploads count as input (BSI R2); the model also reads metadata, annotations, and comments (BSI, baseline protection), text in screenshots, and text under redaction bars in PDFs (OWASP LLM02:2026).
Get the Full PDF

SOURCES

Supported
by Sources.

  1. AI Act, Regulation (EU) 2024/1689, consolidated July 27, 2026 (opens in a new tab)Art. 3(4) and (60); Art. 4, 50, 111(4), 113
  2. Regulation (EU) 2026/1744, Digital Omnibus on AI (opens in a new tab)Art. 1(5) (new Art. 4), Art. 4 (entry into force)
  3. European Commission: AI Literacy – Questions & Answers (opens in a new tab)As of October 20, 2026; question on documentation
  4. Regulation (EU) 2016/679 (GDPR), EUR-Lex (opens in a new tab)Recital 26; Art. 4(1) and (12), Art. 5, 9, 33
  5. UWG (Austrian Unfair Competition Act), § 26b (trade secret), RIS (opens in a new tab)§ 26b para. 1, version BGBl. I No. 109/2018
  6. OWASP Top 10 for LLM Applications 2026 (opens in a new tab)Numbers according to the 2026 PDF; individual pages on genai.owasp.org still use the 2025 numbers (LLM06, 09, 05)
  7. NIST AI 600-1: Generative AI Profile (July 2024) (opens in a new tab)Sections 2.2, 2.7, and 2.9
  8. BSI: Generative AI Models – Opportunities and Risks for Industry and Authorities, version 2.0 (opens in a new tab)Version 2.0 of January 17, 2025; R2 to R4, R6, R8, R28; M16 to M18, M20
  9. BSI: Baseline Protection against Indirect Prompt Injections in Document-Based LLM Chats, version 1.0 (opens in a new tab)Version 1.0 of September 14, 2026; introduction, section 2.5
  10. Anthropic: Reduce hallucinations (opens in a new tab)Basic strategies, best-of-N verification
  11. Anthropic: Mitigate jailbreaks and prompt injections (opens in a new tab)Section on indirect prompt injection
  12. Microsoft Learn: Data, privacy, and security for Microsoft Copilot (opens in a new tab)Organizational data; content that Copilot creates

An overview, not legal advice; the legal text in its current version is authoritative, in particular the AI Act including Regulation (EU) 2026/1744 and the GDPR. The traffic light and checklists are TOMORIS recommendations; your company's rules take precedence. Names and functions of the tools may change.

TOOLBOX

Explore
Further.

AI IN BUSINESS

More on
This Topic.

More free PDFs about AI in Business.
All AI in Business Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads