Domain 6 — Governance, Risk and Responsible Use (15%)

15% of the exam, roughly 9 questions — more than Prompting. This is the domain most candidates under-prepare and it is not hard to score on, because the answers are consistent.

6.1 The default posture

Three questions before pasting anything into any AI tool:

1. Does my organisation permit this tool for this kind of information? Company policy comes first and overrides personal judgement about what seems harmless.
2. Does this content need to be here at all? Names, account numbers, health details and identifiers can usually be removed or replaced without weakening the task.
3. Who is accountable for the result? If the answer is "nobody, really", the workflow is wrong.

6.2 Data handling and privacy

What you should know about how data is treated:

• On consumer plans (Free, Pro, Max), using conversations to improve models is opt-in — off unless you turn it on. Where a user has enabled it, data may be retained in de-identified form in training pipelines for up to five years. Deleting a conversation stops it being used going forward.
• Incognito chats are not saved to your history and are never used for model improvement, whatever the setting says.
• On commercial plans (Team, Enterprise) and the API, customer content is not used to train models by default — this is the distinction that makes them the appropriate choice for company work.

None of that changes the obligation to comply with the rules covering the data itself. If personal data is subject to GDPR, HIPAA, or a contractual confidentiality clause, those apply regardless of how the AI vendor handles retention. "The vendor doesn't train on it" is not consent to process it.

6.3 Uses that are simply prohibited

Anthropic's Usage Policy prohibits categories of use outright. You are not expected to recite the list, but you should recognise the shape of a prohibited request: generating malware or attacking systems; developing weapons; creating child sexual abuse material; inciting violence or targeting people for who they are; large-scale fraud, spam and phishing; impersonating a real person or passing AI output off as human when that deceives; producing disinformation or deceptive political content; and surveillance or tracking of individuals without consent.

6.4 High-risk uses that require a human in the loop

Distinct from prohibited use, and much more likely to appear on this exam, is the category of uses that are permitted with safeguards. Where the output affects someone's rights, livelihood, health or legal position, a qualified professional must review it and the use of AI must be disclosed to the people affected. The recognised domains are:

• Legal interpretation and advice
• Healthcare and medical decisions
• Insurance determinations
• Financial advice
• Employment decisions — hiring, promotion, termination
• Housing and lending decisions
• Academic assessment and testing
• Journalistic content

The examinable rule — in these domains, Claude prepares and a qualified human decides. An option in which Claude's recommendation is acted on directly is wrong even when the recommendation is sensible, and an option that discloses AI involvement but skips professional review is also wrong. Disclosure and review are both required, not alternatives.

6.5 Transparency about AI use

Consumer-facing chatbots must make clear that people are talking to an AI. Beyond that formal requirement, the exam favours candour: telling colleagues that a draft was AI-assisted, marking which parts of an analysis need verification, and not presenting generated content as independently researched. Passing AI output off as your own unreviewed human work is the failure mode these questions are built around.

6.6 Intellectual property and confidentiality

Two recurring traps. First, uploading material you are not licensed to share — another company's confidential document, a client's data covered by a contract, licensed content whose terms forbid it. Second, treating generated output as automatically safe to publish; it should be checked for inadvertent similarity to existing work and for claims you cannot substantiate.

← Previous: Domain 5 — Configuration and Knowledge Management  |  Next: Domain 7 — Troubleshooting and Optimisation →