Governance, Risk, and Responsible Use

What this domain tests

15% of the exam — the third-heaviest domain, roughly nine of sixty items. It exists because most workplace AI failures are governance failures, not capability failures: the model did what it was asked; the asking was the problem.

The character is judgment, not recall. First-hand reports describe the Associate exam as the least clear-cut of the four certifications — several options look defensible, and you pick the most appropriate one. Governance questions sharpen that further: the distractors are things reasonable-sounding colleagues actually say ("just anonymize it," "it's internal, so it's fine," "the tool made the error, not me"). The exam guide's own governance sample tests exactly this — anonymize regulated identifiers per policy beats upload-as-is, beats "instruct Claude not to retain it," beats abandoning the task.

Four official task objectives, each covered below:

1. Identify appropriate and inappropriate use cases
2. Apply data sensitivity, regulatory, and privacy considerations
3. Follow organizational AI policies and governance standards
4. Understand the ethical implications of AI usage

Theory outline

Objective 1 — Appropriate vs. inappropriate use cases

Think in three zones, because every use-case question sorts into one:

Red zone (Usage Policy prohibitions). Anthropic's Usage Policy — the successor to the Acceptable Use Policy, applying across claude.ai, the API, and Claude Code — prohibits, among others:

On the exam, a red-zone option usually sits beside three ordinary assisted-work options and should be instantly identifiable. The trap variant is a red-zone act dressed in business language ("competitive review seeding," "engagement amplification").

Yellow zone (high-risk domains). The Usage Policy singles out domains where Claude's output can materially affect a person's welfare or rights. In these, especially anything consumer-facing, two safeguards are required:

The pattern to memorize: high-risk ≠ prohibited. Claude may structure evidence, summarize records, and draft — but a qualified human holds decision authority, and affected people aren't deceived about AI's role. Any option where the model exercises final authority over a consequential human outcome is wrong, full stop.

The assist/decide line. The cleanest test for zone membership: does the option have Claude informing a human decision, or making the decision? Auto-reject, auto-deny, auto-approve, auto-publish — in high-stakes contexts these words mark the wrong answer.

Objective 2 — Data sensitivity, regulatory, and privacy considerations

Classify before you paste. Every data question begins with what the data is:

The sequence the exam rewards (order matters — this is the tested habit):

1. Classify the data.
2. Check the organization's AI data policy — is this category permitted in this tool?
3. Check the plan's data-handling terms — training use, retention, residency, who can access.
4. Minimize — remove or anonymize identifiers the task doesn't need (the analysis usually needs the pattern, not the names).
5. Proceed — or escalate if any gate fails.

Post-hoc rituals are the classic distractors: "delete the chat afterward," "instruct Claude not to retain it," "use incognito." None of these is a policy control. Deletion doesn't undo a disclosure that policy forbade; a prompt-level instruction to the model is not a data-processing term.

Consumer vs. commercial data handling. The exam expects you to know which contract you're actually under:

Practical consequence: an employee doing company work on a personal consumer account has moved company data outside every organizational control — regardless of how their personal training toggle is set. That's the substance behind shadow-AI questions.

Regulatory vocabulary you should recognize (concept-level; the exam is not a law exam):

• GDPR — EU personal-data regime: lawful basis, purpose limitation, data minimization, data-subject rights. For business use, minimization (step 4 above) plus a DPA with the vendor is the operative pattern.
• HIPAA — US health-data rules; PHI requires specific contractual arrangements (e.g., a Business Associate Agreement, available for eligible Anthropic commercial offerings). Absent that arrangement, PHI stays out.
• EU AI Act — classifies uses of AI by risk; employment, credit, and essential-services decisions land in high-risk, echoing the Usage Policy's human-oversight requirements.
• Sector rules — finance (FINRA/SEC record-keeping), legal privilege, PCI DSS for card data. The tested move is always the same: recognize regulated data, apply org policy, minimize, keep a human accountable.
• Vendor assurance — organizations verify a provider's posture through certifications (SOC 2 Type II, ISO 27001, ISO/IEC 42001) and its trust center. Knowing that this diligence exists and precedes rollout is exam-relevant; the certificate alphabet soup is not.

Sharing scope is a data control. Chat links, shared Projects, and published Artifacts each widen the audience. Least privilege is the norm: "anyone with the link" is effectively public, so confidential content doesn't belong on open links; a Project shared org-wide must contain only data the whole org may see.

Objective 3 — Organizational AI policies and governance standards

Policy becomes real through configuration. A written AI policy that no setting enforces is a poster. The exam likes the mapping:

Roles. Admins own the governance surface — membership, permitted features, connectors, data settings. Members work within it. When a question asks "who should change the org's retention/connector/access configuration," the answer routes through the admin role and the org's change process, not an eager individual.

Shadow AI. Employees using personal accounts for work data is a demand signal, not primarily a discipline problem. Bans and surveillance push usage underground and off every control listed above. The correct organizational response: provide sanctioned, admin-managed access with clear guidelines — convert shadow use into governed use. (Individual employees, meanwhile, are still expected to stop routing work data through personal tools once a sanctioned path exists.)

Consent and client commitments. If policy or a client contract requires consent before AI touches client materials, deadline pressure changes nothing: work without AI on that material and escalate the timeline risk. Cosmetic anonymization to dodge a consent requirement cures nothing — consent is about the relationship and the commitment, not about whether a name string appears.

Incident behavior. Wrong data pasted into the wrong tool? The professional sequence: stop, report through the org's incident/security process, and follow its remediation steps (which may include vendor deletion requests). "Quietly delete the conversation and move on" is the trap — it destroys the org's ability to assess exposure and meet any notification obligations.

Policy maintenance. AI policies date quickly. Good governance standards name an owner, set a review cadence, and update policy when tools, models, or regulations change — the same curation discipline the Configuration domain applies to knowledge bases, applied to rules.

Objective 4 — Ethical implications of AI usage

Five threads the exam pulls repeatedly:

1. Accountability is non-transferable. The human (or organization) that ships output owns its consequences. "Claude wrote it" is not a defense, an excuse, or a mitigation. This is why the Evaluation domain carries the heaviest exam weight: verification is what accountability looks like as a daily practice.

2. Transparency, calibrated. When AI meaningfully contributed and your org, client, or audience expects disclosure — disclose. Concealment where disclosure is expected is the violation. Blanket labeling of trivial assistance (spell-check-level) is not required; the exam tests calibrated transparency, and in high-risk consumer-facing domains the Usage Policy makes disclosure mandatory, not optional.

3. Fairness and bias. Models learn from human text and can reproduce its skews — in tone, in assumptions, in whose résumé sounds "polished." The operational ethic: test for it (same input with demographics varied should not yield systematically different output), keep humans in decisions about people, and treat detected bias as a fix-the-workflow event, not a shrug.

4. Human oversight scaled to stakes. Not every task needs a review board. Ethics questions reward proportionality: spot-checks for low-stakes volume work, full human review for anything consequential, human decision authority for anything about people's rights or livelihoods. An option that removes review "because it hasn't caught errors lately" misunderstands why the review exists.

5. Honest work product. Presenting AI-generated work as independent human expertise where that matters (credentials, expert testimony, journalism, academia) is deception even when the content happens to be accurate. Related: respect IP — don't use Claude to reproduce paywalled or copyrighted material wholesale, and follow your org's norms for attribution.

Worth one sentence of context: Anthropic operates its own governance stack — a Usage Policy for users, safety-tuned models, and a Responsible Scaling Policy for frontier-risk management. Provider-side governance complements organizational and personal responsibility; it never replaces the two layers you control.

Worked problems

Problem 1. A hospital operations team wants Claude to draft patient-facing discharge instructions from clinician notes, to cut turnaround time. Which implementation is appropriate?

A. Deploy it — the notes come from clinicians, so the source is already expert-verified. B. Claude drafts; a qualified clinician reviews and approves each set before it reaches the patient, and the program discloses AI assistance per policy. C. Don't use AI — healthcare content is prohibited under Anthropic's Usage Policy. D. Deploy with a general disclaimer on the printout ("AI-generated; consult your doctor").

Approach: Healthcare + patient-facing = yellow zone. High-risk domains are allowed with safeguards: qualified human review before use, plus disclosure. Look for the option containing both.

Why the others fail: A confuses source quality with output review — drafting can introduce errors the notes never contained, and no human checks the artifact the patient actually reads. C overcorrects: high-risk is not prohibited; assisted drafting with review is a canonical appropriate use. D substitutes a disclaimer for review — it shifts risk onto the patient instead of removing it, and a boilerplate warning is not a human-in-the-loop control.

Answer: B

Problem 2. An HR analyst on the company's Claude Team plan wants to analyze exit-interview transcripts from EU employees to find attrition themes. Transcripts contain names, teams, and health disclosures. Best course?

A. Upload as-is — the Team plan doesn't train on customer content, so the data is safe. B. Replace names with codes, strip health details and other identifiers the analysis doesn't need, confirm the activity fits the org's AI policy, then analyze. C. Use a personal Claude account so the analysis stays off company systems. D. Ask Claude to anonymize the transcripts as its first step after upload, then analyze them.

Approach: Regulated personal data (GDPR — and health disclosures are special-category). Run the sequence: classify → org policy → plan terms → minimize before upload. Attrition themes need patterns, not identities.

Why the others fail: A conflates training policy with permission — "not trained on" doesn't authorize processing personal data your policy or lawful basis doesn't cover, and minimization is still required. C is maximally wrong: personal accounts remove every organizational control and contract. D anonymizes after disclosure — the identifiable data, including health details, has already left the boundary; minimization must precede upload.

Answer: B

Problem 3. A 300-person financial-services firm is formalizing Claude usage. Compliance requires: company logins land in the managed workspace, usage is reviewable after the fact, and IT controls which integrations can touch company data. Which capability set answers the requirement?

A. A written AI policy circulated by email, with quarterly attestation. B. Pro subscriptions for each employee, expensed individually. C. An enterprise-grade deployment: SSO with domain capture, audit logs, and admin-managed connectors. D. A firewall block on all AI tools except during approved hours.

Approach: Translate each requirement into its enforcing mechanism: logins routed → SSO/domain capture; reviewable → audit logs; controlled integrations → admin-managed connectors. That's the enterprise-tier governance surface.

Why the others fail: A is policy without enforcement — a poster. B is the shadow-AI pattern with a receipt: individual consumer accounts have no admin surface, no audit trail, no central data terms. D is a time-lock, not governance — it controls when, not what data, by whom, reviewable how, and invites workarounds.

Answer: C

Problem 4. Claude drafts interview-feedback summaries for a hiring committee. A recruiter notices summaries of women candidates dwell on "communication style" while men's dwell on "technical impact," despite similar raw notes. What is the right response?

A. Nothing — the committee makes the final call, so summary skew is harmless. B. Flag the pattern, test it (comparable notes, varied names/genders), fix the workflow — tighten the prompt to evidence-based criteria, keep human review on every summary — and record the issue per org process. C. Stop using AI anywhere in hiring, permanently. D. Have Claude re-review its own summaries for bias and accept them once it reports they're fair.

Approach: Bias in an employment-adjacent workflow — high-stakes about people. The ethical response is detect → verify → remediate → document, with humans retaining judgment. Skewed inputs contaminate downstream human decisions even when humans decide.

Why the others fail: A ignores that biased summaries are the committee's evidence — garbage in, biased deliberation out. C may be a defensible org choice but is not the best response to a fixable workflow issue; the exam rewards remediation over abandonment when safeguards can work. D makes the model its own auditor; self-assessment is not validation, the same reason "ask Claude to rate its confidence" fails in the Evaluation domain.

Answer: B

Problem 5. Mid-analysis, an analyst realizes the spreadsheet he pasted into the sanctioned Claude workspace yesterday was the restricted M&A tracker, not the approved summary — a violation of the org's data-classification policy. What now?

A. Delete the conversation and use the correct file going forward. B. Report the incident through the org's security/incident process, identify what was exposed, and follow its remediation guidance. C. Ask Claude to forget the document, then continue. D. Continue working — the workspace is sanctioned, so no harm occurred.

Approach: Sanctioned tool, wrong data — still a policy incident. Incidents are reported, assessed, remediated; the org may have notification duties and needs to know scope. Individual cover-up destroys that.

Why the others fail: A hides the incident — deletion may be part of remediation, but only after report and assessment, not instead of them. C treats a chat instruction as a data control; "forget this" is not deletion under any data-processing term. D confuses tool approval with data approval — the classification policy governs which data, not just which tool.

Answer: B

Problem 6. A marketing lead asks an associate to have Claude write fifty first-person forum posts praising the product "from different customer perspectives" for the team to post under varied usernames. The associate should:

A. Comply, but add a small "sponsored" tag to a few posts. B. Comply — competitors do the same, and the claims about the product are accurate. C. Decline and explain: fabricated grassroots endorsement is deception at scale, which violates Anthropic's Usage Policy and likely law/platform rules — then offer legitimate alternatives (drafting genuine customer-story interviews, real testimonial campaigns). D. Ask Claude to write the posts in a way that doesn't sound AI-generated.

Approach: Astroturfing = fake personas presenting manufactured opinion as organic customers. Red zone: deception. No accuracy of underlying claims, no partial labeling, no stylistic laundering converts it. The strongest answers decline and redirect to the legitimate adjacent use.

Why the others fail: A labels a fraction of a deception, which is still a deception. B argues accuracy and peer behavior — neither is the test; the fake identities are the lie. D is aggravation, not mitigation: engineering undetectability deepens the deceptive intent.

Answer: C

Exam traps

• Post-hoc rituals as controls. "Delete the chat afterward," "tell Claude not to retain it," "anonymize the client's name and proceed" — every one of these appears as a distractor. A control operates before or during processing, contractually or in configuration; a cleanup gesture afterward is not a control.
• Prohibited vs. high-risk confusion. Both directions. Healthcare/legal/finance work is NOT prohibited — it needs human review + disclosure. Deception/impersonation/fraud IS prohibited — no safeguard package legitimizes it.
• "Not trained on" ≠ "permitted." Commercial plans' no-training default answers one question (model training), not the governance question (does policy allow this data in this tool for this purpose).
• Tool approval ≠ data approval. A sanctioned workspace doesn't authorize every classification of data into it.
• Abandonment as the false-safe answer. "Don't use AI at all" reads cautious but usually loses to the option that proceeds with the right safeguard (anonymize per policy; add human review). The exam guide's own sample makes skipping the analysis a wrong answer.
• Self-assessment as validation. Having Claude audit its own output for bias/accuracy/compliance is never the control the question wants.
• Accountability laundering. Any option locating fault in the tool ("the AI made the error") or in a disclaimer is wrong; the shipping human owns the output.
• Personal-account convenience. Whenever a personal/consumer account touches work data, that's the governance failure in the question — regardless of how good the output was.
• Deadline pressure as a waiver. Consent requirements, review steps, and policy gates all survive urgency. The right options escalate the timeline; the wrong ones absorb the violation quietly.