Module 7 — Developing Your Personal AI Safety and Security Plan
Learning outcomes: Explain the core concepts, recognize common risks, apply practical safeguards, and complete the ten-point self-check.
1. Why this module matters
Knowing the risks of AI is useful; deciding what you will actually do is more valuable. A personal AI safety plan turns general guidance into repeatable habits, clear boundaries and a response procedure for mistakes or scams.
This capstone module helps you create a one-page plan for your household or individual use. It brings together privacy, verification, fraud prevention, family support and connected-application security without requiring advanced technical knowledge.
The plan should also cover misinformation, accidental disclosure of sensitive information, unauthorized account access, unexpected actions by connected AI tools, identity impersonation and data loss. A written response sequence makes it easier to act calmly when time matters.
2. Assess your AI use and priorities
List the AI services you use, the accounts they connect to, the kinds of information you enter, and the decisions they influence. A service used only for recipes presents different risks from one that can send email, access bank statements or modify cloud files.
Rank activities by possible harm if an answer is wrong or information is exposed. Give the strongest safeguards to health, legal, financial, identity and safety-related tasks.
For each tool, ask: Who can access what I enter? Can the tool act outside the chat? Would an incorrect response cause inconvenience, financial loss or harm? Mark higher-risk activities for stronger verification and explicit human approval.
3. Set personal rules and verification thresholds
A practical policy might say: no passwords or identity documents in general AI chats; no automated payments; verify medical claims with a clinician; confirm any urgent family money request by calling a saved number.
Decide in advance which actions always need your approval. The plan should be simple enough to follow when you are busy or worried, not a complicated manual you never consult.
4. Prepare to respond and improve
An incident response plan names the first steps after a suspicious message, accidental upload, unauthorized action or account compromise. These may include stopping interaction, securing the account, contacting the service or bank, preserving evidence and reporting fraud.
Review your plan periodically and after any significant change in tools, family circumstances or permissions. A safety plan is a living document, not a one-time certificate.
Simple incident-response plan
| Situation | Immediate response | Follow-up |
|---|---|---|
| Suspicious message or deepfake | Pause; do not click, pay or share codes | Verify via a known contact and report if fraudulent |
| Sensitive data accidentally uploaded | Stop sharing; remove access where possible | Review provider controls; notify affected parties if necessary |
| Account compromise | Reset password through official site; revoke sessions | Enable MFA; review activity and recovery settings |
| Agent took an unauthorized action | Disable the connection or automation | Check destination system; reverse action if possible; document impact |
| Incorrect consequential AI advice | Stop relying on the answer | Check primary sources and consult a qualified professional |
| Lost or altered files | Stop further changes; preserve evidence | Restore from a verified backup and review permissions |
5. Ten key risks and why they matter
- Uninventoried tools: Forgotten accounts or apps may retain access to information.
- Inconsistent rules: Safeguards used occasionally are less effective under pressure.
- High-stakes reliance: AI suggestions may be mistaken for professional conclusions.
- Uncontrolled data sharing: Private information may enter a tool without prior review.
- Weak authentication: A single compromised password may expose connected services.
- Unverified emergencies: A convincing urgent message can bypass normal decision-making.
- Agent overreach: An assistant may act with more authority than intended.
- Poor recovery readiness: Missing backups or contact information can delay response.
- Household confusion: Family members may not know how to verify or report a problem.
- Outdated plans: New services and permissions can make old safeguards inadequate.
6. Practical actions for safer AI use
Practical actions turn good intentions into steps that can be checked, repeated and shared. Use the following templates as a starting point; customize them to your household and the actual services you use.
Create a short inventory with four columns: AI service, purpose, data it receives, and connected permissions. Identify which tools are essential and remove those you no longer use. Check that each important account has strong authentication.
Write five non-negotiable rules in plain language. Include privacy limits, independent verification for consequential claims, no sharing of authentication codes, confirmation before external actions, and a call-back procedure for urgent requests.
Define a response sequence: stop; preserve evidence; secure accounts; contact the relevant provider, bank or institution; report if appropriate; document what changed. Keep official support contact information somewhere accessible outside the AI service.
Choose a review date, such as every three months, and repeat the inventory after connecting a new agent or experiencing a security event. Share the relevant parts of the plan with household members while respecting their autonomy.
AI service inventory
| Service / tool | Purpose and data entered | Connected permissions | Risk / owner |
|---|---|---|---|
| Example: writing assistant | Drafts non-sensitive messages | None | Low / adult user |
| Example: calendar agent | Appointments and invitees | Read or edit calendar | Medium / account owner |
| Your service: ______ | ________________ | ________________ | ________________ |
Five non-negotiable rules
| Rule | My commitment |
|---|---|
| Protect private data | Do not enter passwords, IDs or sensitive records without a justified, approved need |
| Verify important claims | Check primary sources and professionals for consequential decisions |
| Protect authentication | Never disclose one-time codes, passkeys or recovery phrases |
| Approve external actions | Review recipients, amounts and changes before an agent acts |
| Verify urgent requests | Call back using a saved number before sending money or information |
Response procedures
| Step | Action |
|---|---|
| 1. Stop | End suspicious interaction and pause connected automation |
| 2. Preserve | Save messages, dates, screenshots and relevant records |
| 3. Secure | Reset affected passwords, revoke sessions and check MFA |
| 4. Contact | Use official channels for banks, providers and affected people |
| 5. Recover | Check transactions, restore clean backups and correct changes |
| 6. Learn | Record what happened and improve rules or permissions |
Set a calendar reminder to review this plan every three months. At each review, check the inventory, remove unused connections, confirm recovery contacts and test whether backups can be restored. Review immediately after adding a new connected agent or experiencing an incident.
7. Everyday examples
These scenarios illustrate how to turn the concepts into choices in ordinary life.
- Privacy rule: “I use placeholders rather than uploading bills or identity documents.”
- Verification rule: “I check medical and legal claims with authoritative sources and professionals.”
- Fraud rule: “I call a saved number before sending emergency money.”
- Agent rule: “No assistant sends, buys, shares or deletes without my approval.”
- Review rule: “On the first weekend of each quarter, I inspect AI app permissions.”
- New AI app: Record what it accesses before signing in.
- Medical answer: Check official guidance and discuss with a clinician.
- Urgent family request: Call a saved number before transferring funds.
- Shared photograph: Ask permission before uploading another person’s image.
- Quarterly check: Remove an unused connector and confirm backup recovery.
8. End-of-module checklist
- I maintain a list of the AI tools and accounts I use.
- I know which services can access my email, files or calendar.
- I set clear limits on personal information shared with AI.
- I protect accounts with unique passwords or passkeys and MFA.
- I independently verify high-stakes AI-generated claims.
- I use a trusted call-back process for urgent requests.
- I require approval before AI tools send, spend, share or delete.
- I have backup and recovery arrangements for important files.
- I know whom to contact and what evidence to preserve after an incident.
- I have scheduled a date to review and update my safety plan.
9. Further reading and authoritative sources
- US — CISA Secure Our World — Practical account and device security guidance.
- US — Federal Trade Commission, Consumer Advice — Scam, identity theft and consumer privacy guidance.
- US — IdentityTheft.gov — Identity theft reporting and recovery steps.
- EU — ENISA — European cybersecurity research and guidance.
- Japan — AI Safety Institute (AISI) — Japanese AI safety resources.
- US — NIST AI Risk Management Framework — Risk-based principles for trustworthy AI.
Copyright and Use
© 2026 Institute for AI Governance, Cybersecurity & Risk Management (IAIGCRM). All rights reserved.
These educational materials are provided for individual learning and personal reference. Except as permitted by applicable law, reproduction, redistribution, adaptation, commercial use, or incorporation into third-party training programs requires prior written permission.
For licensing and permissions, contact: stephen.buerle.phd@gmail.com.
Educational Disclaimer
These materials provide general educational information about artificial intelligence safety, privacy, cybersecurity, and responsible use. They do not constitute individualized legal, medical, financial, or professional cybersecurity advice.
Although reasonable care has been taken in preparing these materials, technologies, threats, regulations, and recommended practices may change. The Institute does not guarantee that the materials are complete, error-free, or suitable for every situation.
Readers should independently verify information relevant to consequential decisions and consult appropriately qualified professionals when necessary.