AI Ethics & Responsible Use for PMs

Section 1 - The three risks PMs actually need to care about

There are a lot of AI ethics concerns in the world. Most of them are not your problem as a PM using AI for growth and product work. Three of them are.

Risk 1: Data privacy - what you're allowed to paste

Every time you paste content into Claude, ChatGPT, or any AI tool, you are sending that data to a third-party server. For most day-to-day work this is fine. It is not fine when that data includes:

• Individual user data (names, emails, behaviour tied to identifiable people)
• Financial data covered by confidentiality agreements
• Unreleased product roadmaps or M&A information under NDA
• Employee performance data or HR records
• Any data covered by GDPR, HIPAA, or similar regulation

The test: would you be comfortable if this data appeared in a legal discovery? If not, don't paste it.

What you should do instead:

• Anonymise data before pasting (replace names/emails with "User A", "Company B")
• Use enterprise tiers with data processing agreements (Claude for Enterprise, ChatGPT Enterprise) for sensitive work
• Build local automations (n8n on-premise, self-hosted models) for workflows that touch sensitive data
• Know your company's AI data policy - if one doesn't exist, push for one

Risk 2: Hallucination at scale - automations that lie confidently

AI hallucination (generating plausible but false output) is a manageable risk in one-off use. It becomes a serious risk when you automate. An automation that generates incorrect product descriptions, wrong pricing, or fabricated statistics and publishes them without review is a trust and legal liability.

The rule: human review checkpoints are mandatory for any AI output that goes directly to users or external stakeholders.

This means:

• Don't automate customer-facing copy without a review step
• Don't automate data summaries to leadership without a sanity-check step
• Don't automate anything that would be embarrassing or harmful if wrong - without a gate

You are not being overly cautious. You are being a good PM.

Risk 3: Bias in, bias out

AI models reflect the data they were trained on. That data contains human biases - around gender, ethnicity, geography, economic background. When you use AI to generate copy, analyse user feedback, or make prioritisation recommendations, those biases can slip into your outputs silently.

Practical implications:

• User research synthesis: AI may underweight feedback from underrepresented user segments if they appear less frequently in the training data. Always sanity-check "whose voice is missing here?"
• Copy generation: Review AI-generated copy for language that implicitly assumes a particular user demographic
• Prioritisation: If you're using AI to rank feature requests or hypotheses, audit the methodology - AI rankings are not neutral

You can't eliminate bias. You can build review practices that catch it.

---

Section 2 - Strong opinions on what PMs should and shouldn't do

These are recommendations, not rules. But they're based on real failure modes - not theoretical ones.

You should:

• ✅ Use enterprise AI tiers for anything that touches company data. The free tiers of most AI tools train on your inputs by default. Enterprise tiers don't. If you're pasting internal strategy docs, user research, or financials - this matters.
• ✅ Be transparent with your team when AI contributed to work. Not "I used AI to write this so it doesn't count" - but "here's how I used AI, here's where I applied my judgment." Normalise it. Hiding it creates a culture of AI shame that slows adoption.
• ✅ Own the output, always. If you submit an AI-generated experiment brief, it's your brief. If it's wrong, that's on you. AI is a tool - you're the PM.
• ✅ Tell users when they're interacting with AI. If you're building AI-powered features that interact with users, clear disclosure is both ethical and increasingly legally required in many markets.
• ✅ Audit your automations for quality drift. AI models update. What produced good output in January may produce worse output in June. Check automations quarterly.

You shouldn't:

• ❌ Don't paste identifiable user data into consumer AI tools. This is not theoretical - it's a GDPR violation. Anonymise first, always.
• ❌ Don't use AI to make decisions about people. Hiring decisions, performance reviews, user bans - these require human judgment and carry legal weight. AI can inform, not decide.
• ❌ Don't ship AI-generated copy without reading it. Every word. Not because AI is usually wrong - because the one time it's wrong, it's your product that said it.
• ❌ Don't treat AI confidence as accuracy. AI sounds equally confident when it's right and when it's hallucinating. Confidence is not a signal of correctness. Verify anything that matters.
• ❌ Don't build AI features that users can't opt out of. Especially personalisation, automated communications, and anything that uses user data to make decisions about them. Give people a way out.

---

Section 3 - AI governance in practice (EU AI Act & friends)

Principles are no longer the whole story: AI use is now regulated. You don't need to be a lawyer, but you do need to know which bucket your use case falls into.

• Risk tiers. The EU AI Act sorts systems into prohibited (e.g. social scoring, most emotion recognition at work), high-risk (hiring, credit, education, essential services), limited-risk (transparency duties), and minimal-risk. Most internal PM workflows are minimal-risk - hiring and performance use cases are not.
• Transparency duties. Users must be told when they're interacting with an AI system, and synthetic media should be labelled. Bake this into copy, not into a footnote.
• AI literacy. Organisations deploying AI are expected to ensure staff are trained on its use and limits - one reason a course like this belongs in onboarding.
• Data residency & vendor terms. Check where the provider processes and stores data, whether your inputs train their models, and what the retention window is. Enterprise/API tiers usually differ sharply from consumer plans.
• Keep an inventory. A simple sheet - use case, tool, data types, owner, risk tier, human-review step - answers 90% of what legal and security will ask.

If a use case touches hiring, credit, health, children, or biometric data, involve legal before you prototype, not after.

Section 4 - The GDPR practical checklist for PMs using AI

This is not legal advice. It is a practical checklist for avoiding the most common mistakes.

Before pasting data into any AI tool, ask:

• ☐ Does this data contain names, emails, or identifiers tied to real people? → Anonymise first
• ☐ Is this data covered by an NDA or confidentiality agreement? → Check before pasting
• ☐ Does this tool have a data processing agreement (DPA) with my company? → Check with your legal/compliance team
• ☐ Is this tool's enterprise tier in use, or is data being used for training? → Know your contract
• ☐ If this data were leaked, would it harm a user, employee, or the company? → If yes, don't paste it

Before shipping an AI-powered feature:

• ☐ Is there a disclosure to users that AI is involved?
• ☐ Is there a human review step for AI outputs that affect users directly?
• ☐ Is there an opt-out mechanism for users who don't want AI-generated content or decisions?
• ☐ Have you audited the AI outputs for bias in a representative sample?
• ☐ Do you have a process for monitoring quality drift over time?