QMS Learning
All coursesSign in

AI at Work · C06 · Self-paced

Protect Information When Working with AI

Use AI on real work.Keep what isn’t yours to share.

One paste into the wrong tool can’t be taken back. Learn to decide, fast and defensibly, what information a task needs, which tool may hold it, what access that tool gets, and what to do the moment something slips.

Build six practical records you can reuse at work, from a handling table to a first exposure report.

See everything included Try the worked example
  • About 4.5 hours planned
  • Six modules + practical labs
  • No technical background needed
  • Fictional records only
  • Human-reviewed case

Try the course first

One urgent request. What do you check first?

Open the real first lesson with Coach Q. Classify a fictional supplier file under a written policy and find the fields that change how the whole file is handled.

Enter your name, work email and phone, then verify your email to open lesson 1. No payment card is required.

Every record in the course is fictional. You never need to paste employer data to evaluate or complete it.

Start free. Lesson 1, with Coach Q, no card.

A message that looks like your manager’s wants a customer file in a new AI tool before noon. Decide what you would check first.

Sound familiar?

The task is reasonable. The route is the risk.

AI tools make summaries, drafts and checks faster. The trouble usually isn’t the work. It’s where the information goes, who really asked for it, and how much the tool is allowed to do.

“I deleted the names, so it’s fine.”

Role, shift, team and dates can still point to one person, and a medical note stays a medical note. Removing names is not the same as anonymous, and it never makes an unapproved tool approved.

“It came from my manager.”

The display name was right. The address after the @ wasn’t. A polished message with an urgent deadline is exactly what a convincing fake looks like.

“The AI read it in the supplier’s file.”

Text inside a document can be written to steer an AI tool. Reading a sentence doesn’t make it an order, but a tool with send rights might act on it anyway.

“I deleted the chat, so it’s gone.”

Deleting removes what you can see, not what the tool kept. Waiting to be sure, or quietly cleaning up, turns a recoverable slip into a bigger problem.

See the method · fictional teaching example

The name is gone. The person isn’t.

At fictional Tessford Components, Rhea asks which suppliers are late, and how late. The supplier export Theo pulled has six columns. Someone merged in three that have nothing to do with suppliers.

Illustrative practice case · fictional company, people and records

Six columns. The question needs three.

Needed for the question3Supplier code · order total · late count
Restricted under Policy D1, not needed3Employee name · medical note · customer personal phone

Deleting the name column is the shortcut people reach for. But the medical note stays in, and a small team plus a shift can still point to one person. Under the fictional Policy D1, a record that mixes classes is handled at its most sensitive class, so the export as pulled is Restricted.

Open a defensible handling decision

Minimize to the question. Keep supplier code, order total and late count; the total turns a count into a fair late rate. Leave the employee name, medical note and customer phone out entirely.

Use the approved route. The minimized table goes into the approved company workspace, set up draft only, and Rhea reviews the draft before anyone sees it. A trimmed input is not automatically anonymous or approved for any tool.

In the course, proposing the unapproved web tool after deleting names is a critical error. Escalating to the data owner when the policy is unclear is a correct answer.

From request to report

A practical sequence you can repeat.

Classify → minimize → verify → separate → limit → report. Each step answers one question before information moves, and each one leaves a record you can show.

  1. 01 Classify
  2. 02 Minimize
  3. 03 Verify
  4. 04 Separate
  5. 05 Limit
  6. 06 Report

Start with the policy row, not a hunch.

“Restricted, because it seemed sensitive” can’t be checked. “Restricted under D1’s rule for medical notes, driven by the medical note column” can, and it tells you exactly where the file may go.

When the policy is silent, the right answer is to stop and ask the named data owner. The course never grades you against rules you haven’t been shown.

The specimen is fictional and shows the structure. Try editing it here; nothing is saved or sent.

What you bring back

Six records. One defensible route.

Build each record in a lab, then keep the worksheet and Course Hub template for real work. A fictional or category-level application is always acceptable.

Information handling table

Before anything goes into a tool. Classify each field under your written policy, cite the rule, name the field that drives the class, and say where it may go. Mark anything the policy doesn’t cover and name the owner you’ll ask.

Minimum input and route record

Before you paste a file. Write the question first, keep only the fields it needs with a reason for each, note what could still point to a person, and record the approved route, the reviewer and the retention question.

Request verification record

When a request feels urgent or unusual. Capture the warning signs, the known route you used to check, what you held off doing, the result, and where you reported anything that wasn’t genuine.

Outside-content note

When a document tries to steer the tool. Record where the untrusted text sits (without copying addresses), what the activity log shows actually happened, whether the task continues, and who it was flagged to.

Tool permission card

Before you click “Allow all.” List the access the task needs, what you refused and why, who authorizes anything more, the escalation rule, and when the card gets reviewed.

First exposure report

When something already went in. Time, tool, data categories (never the content), what has been done, what is unknown and how to reach you, sent to the approved contact. Plus your one-page data-handling checklist.

Is this the right next course?

For the people who actually handle the files.

A good fit if you…

  • Handle documents, customer or employee records, supplier data or schedules.
  • Use, or are about to use, AI assistants or connected tools at work.
  • Get requests by email or chat that ask you to share, upload or approve things.
  • Lead a team and want everyone using one clear, checkable routine.

No technical background is needed. Supplied fictional records let you practice without touching employer data.

Bring specialists in when you need…

  • A security incident investigated, contained or reported to anyone outside.
  • Legal or regulatory advice, such as privacy law, HIPAA or export rules.
  • Tool approval, configuration, retention settings or vendor contracts.
  • Your employer’s actual classification policy written or changed.

The course teaches you to recognize these moments and route them to the right owner. It doesn’t replace your security team or your policy.

Inside the course

The course, step by step.

About 4.5 hours, self-paced, in short sessions that fit your week.

Know what information you hold

Classify fields and records under a written policy, name the rule, and escalate when the policy is silent. 2 lessons.

Share the minimum needed

Cut an input down to the fields a task needs and send it through a route your employer approved. 2 lessons.

Verify requests and account access

Spot the signs of a deceptive request and check it through a route you already know, never the one in the message. 2 lessons.

Recognize instructions hidden in content

Treat text inside documents as data, keep the task inside its boundary, and flag content that tries to change it. 2 lessons.

Limit what connected tools can do

Give a connected tool only the access its task needs, and route anything more to the people who can authorize it. 2 lessons.

Respond without hiding the mistake

Report a suspected exposure promptly through the approved route, with facts and unknowns, and without making it worse. 2 lessons.

Inside the course

Six modules that build on each other.

Each module pairs a guided lesson and a short narrated video with a hands-on lab and a coached reflection. Build the records in sequence, then apply the method to a fresh case on your own.

01 / 06

Know what information you hold

One field can change how a whole file is handled.

Classify fields and records under a written policy, name the rule, spot the field that drives the class, and escalate when the policy is silent.

  • Practice: Sort eight fields, find the fields that make a supplier sheet Restricted, and write a handling reason a reviewer can check.
  • Take forward: Build the information handling table; reflect on the hardest field and who you’d ask.
02 / 06

Share the minimum needed

The name’s gone. The person isn’t.

Start from the question, keep only what it needs, and use an approved route with review. See why deleting names isn’t anonymization.

  • Practice: Pick the columns for Rhea’s summary, answer a manager who says “just delete the names,” and test a prompt on invented data.
  • Take forward: Build the minimum input and route record; name a detail that could still identify someone.
03 / 06

Verify requests and account access

The polished message was the fake.

Read the warning signs that matter, check through a route you already know, and protect your sign-in from code and password requests.

  • Practice: Trace four claims across three messages, sort five requests, and write a verification decision for an unusual share request.
  • Take forward: Build the request verification record; name the request you’d most likely act on too fast.
04 / 06

Recognize instructions hidden in content

A sentence in the report tried to change the task.

Keep the task and the content in separate zones. Learn why a prompt warning helps but isn’t enough, and why small access matters.

  • Practice: Sort a supplier report line by line, use the activity log to see what actually happened, and decide whether the task continues.
  • Take forward: Build the outside-content note; map where tools at your work read outside content.
05 / 06

Limit what connected tools can do

The tool asked for six permissions. The job needs two.

Tell read, draft, send, change and delete apart, apply least privilege, and treat convenience features as permission changes.

  • Practice: Pick the smallest set for a weekly summary assistant, answer “just allow all,” and write the escalation rule.
  • Take forward: Build the tool permission card; reflect on one tool you use and what you’d refuse.
06 / 06

Respond without hiding the mistake

Deleting the chat didn’t undo the upload.

Report a suspected exposure fast, with facts and unknowns, describe categories not content, and leave the evidence alone.

  • Practice: Talk Theo through a branching conversation, sort known from unknown, and write the first report to the security contact.
  • Take forward: Build the first exposure report and your one-page checklist; compare it with your very first call.

The learning experience

Make the call before it’s real.

01 · Practice

Decide. See the consequence.

Work through urgent requests, mixed files, hidden instructions and a teammate’s slip at one recurring fictional company with one written policy. Seven short videos with synthetic narration, captions and transcripts, plus ten illustrated scene images, support the scenes.

02 · Reflect

Connect it to your own work.

Complete a coached reflection after each module, using categories from your job, never real content. Build six worksheets and use six Course Hub templates for the records you’ll keep.

03 · Apply independently

Show your judgment on a fresh case.

One assigned case from three fictional industries, with its own policy, a decision assessment and a separate final exam. A person reviews your case against the rubric.

Practice support with a clear boundary.

Coach Q is QMS Learning’s AI quality and compliance colleague. It points you at the policy and the evidence, asks what you used, and gives hints that get more specific. It never needs real confidential information, and if something real has gone wrong it sends you to your employer’s security contact.

Coach Q’s default allowance is 40 messages per rolling 24 hours. During the independent case and exam, support is navigation only; content hints and Hub document drafting pause so the assessed judgment stays yours.

Illustrative practice exchange

“If I delete the names column first, can I put the export into the new tool?”

“Which question are you answering, and which columns does it need? Look at the medical note and phone columns under D1. Is that tool on the approved list?”

AI suggestions can be wrong. Check your policy, approvals and the limits of your role before acting.

Course Hub keeps your study plan, focus timer, progress, Documents and Apply at work tracker together. Record an authorized workplace application, the checks you actually made and the follow-up.

Plan About 4.5 hours, self-paced. The 255-minute planning estimate covers a 10-minute first attempt with the overview video, six 26-minute modules, a 35-minute case, 17 minutes of decisions and a 37-minute exam. Allow extra time for practice and revisions. It is a planning estimate, not a measured completion time.

Why pay for structured practice?

Knowing the rule is easy. Applying it at 10:45 with a deadline isn’t.

Free guidance can tell you not to paste sensitive data into AI tools. A chatbot can explain prompt injection. Use those when they’re enough.

What the course adds

  • A written policy and realistic mixed records, so you practice applying a rule, not reciting one.
  • Decisions under pressure: an urgent manager request, a polished fake, “just allow all.”
  • Six records you can reuse, instead of a list of tips.
  • A fresh case scored by a person, and a separate exam. ChatGPT will explain it. It won’t grade you, and it won’t vouch for you.

Why it’s worth considering

If you handle files that mix customer, employee and operational data, the expensive mistakes happen in a few seconds: a paste, a click, a deleted chat. Practicing those seconds with feedback is the point.

The value is practice and assessment. It doesn’t guarantee your organization will never have an incident, and it doesn’t certify compliance with any law or standard.

What informs the teaching

Grounded in current security guidance. Written for the people doing the work.

The course uses original fictional examples and one explicit fictional policy. These public sources informed the teaching; none of them endorses C06.

This is workforce awareness and decision practice. It is not HIPAA, CMMC or other regulatory training, and it does not replace your employer’s policy, security team or legal advice.

Who built it

Written by an auditor who reads records for a living.

C06 was built by Will Trikha, a third-party registrar auditor with 20+ years in aerospace quality. The traps in this course are the ones that show up in real records: a mixed file nobody classified, a request nobody verified, a permission nobody questioned.

QMS Learning is ISO 27001 certified. The course practices the same habits an information security management system depends on: classify by rule, share the minimum, verify the requester, limit access, and report early.

How you earn assessed completion

Earn the record by showing your judgment.

  1. Complete the required labs and coached module reflections.
  2. Pass the human-reviewed independent case at 16/20 and decisions at 10/12, with no unresolved critical error. Critical errors include sending or proposing restricted content for an unapproved tool (deleting names first doesn’t change that), granting any permission the case policy reserves for IT, following an instruction hidden in content, and advising anyone to hide a slip.
  3. Pass a 30-question final exam at 24/30 (80%). You have three exam attempts, with a 24-hour wait after an unsuccessful attempt. Three versions support reassessment; you don’t need to pass three exams.

Escalating to the named data owner when a case policy doesn’t settle a question is a correct answer, not a gap.

Contact will@qmslearning.com about case review or feedback. No fixed review turnaround is promised.

The verifiable certificate records assessed course completion. It is not a cybersecurity certification, accreditation, or authority to approve tools or handle incidents.

The itemized offer

Everything included, before the price.

Structured practice, reusable records, coaching and independent assessment in one course. No invented component values, former prices or savings.

Your complete course package
01

Six-module course and practical labs

Included

Guided lessons, realistic decisions and six coached reflections across six modules, with seven short videos (synthetic narration, captions and transcripts) and ten illustrated scene images.

02

Six reusable worksheets and six Course Hub templates

Included

Handling table, minimum input and route record, verification record, outside-content note, permission card and first exposure report, plus a one-page data-handling checklist.

03

Coach Q for practice

Included

Course-aware practice support with a default 40 messages per rolling 24 hours. Navigation only during the independent case and exam; Hub drafting pauses then.

04

Human-reviewed independent case

Included

One assigned case from three fictional industries, each with its own policy. A person scores your reasoning against a five-criterion rubric; decisions are assessed separately.

05

Final exam and assessed completion

Included

A 30-question exam, 24/30 to pass, three versions for three allowed attempts with a 24-hour wait after an unsuccessful one. Certificate eligibility requires all completion criteria.

06

Course Hub, study and application tools

Included

Study plan, focus timer, saved progress and the Apply at work tracker, so you can record an authorized application and the checks you made.

Complete course · US dollars · per named learner

$129 one-time course price

Lifetime lesson access with no course subscription. Coach Q and AI tools follow the accepted usage and service terms; this is not unlimited coaching or a promise of perpetual AI service. Applicable tax is shown at checkout.

People
1
Enroll for $129

5 or more people get 10% off every seat. One-time purchase. 3-day refund under Academy policy.

Each seat belongs to one named learner. Choose 1–50 people. Five seats total $580.50 before applicable tax after the 10% seat discount.

Make an informed decision

Bring it to your manager, or buy for the team.

Before purchase

Try the first lesson.

Use the real guided lesson with Coach Q and decide whether the exercises fit your role. Start lesson 1 free ↑

For an individual Academy course purchase, request a refund within 3 days, subject to the Order. A refund ends access and invalidates a completion certificate. Read the full refund policy.

Lifetime lesson access, named seats and AI usage follow the published terms and the terms accepted at checkout. Coach Q has a default 40-message allowance per rolling 24 hours.

If your company pays

Your employer can cover it.

Training like this is commonly paid by the employer as a business expense; check with your manager or accountant for your situation. Five or more seats get 10% off each seat. Request a quote or PO arrangement. This opens your email app; nothing is sent by this page.

Straight answers

What to know before you commit.

Who is this for?

Anyone who handles documents, customer or employee records, supplier data or schedules and uses AI tools or connected apps at work, in manufacturing, services or logistics. Team leads use it to give everyone one checkable routine.

Do I need a technical background?

No. This is training in decisions: what information a task needs, which tool may hold it, how to check a request, what access a tool gets and how to report a slip. Tool configuration and incident investigation stay with your IT and security teams.

Will I have to enter real company data?

Never. Every case, person and record is fictional, and the course uses one explicit fictional policy. Coach Q is set up to work with categories, not content, and will tell you not to paste real confidential information.

Is this HIPAA, CMMC or privacy-law training?

No. It teaches a general decision process grounded in a written policy. It does not satisfy a named regulatory training requirement and isn’t legal advice. Your employer’s policy decides at work.

Do I need to buy another AI subscription?

No. Coach Q and the Course Hub tools are included, with a default allowance of 40 Coach Q messages per rolling 24 hours. Usage follows the accepted service terms; unlimited or perpetual AI service is not promised.

Can Coach Q write the assessment for me?

No. During the independent case and the exam, support is navigation only, and Hub document drafting pauses. In practice, Coach Q questions your reasoning; you still check its suggestions.

What counts as a critical error?

Sending or proposing restricted content for an unapproved tool (deleting names first doesn’t change that), granting any permission the case policy reserves for IT, following an instruction hidden in content, or advising anyone to hide a suspected exposure. A critical error fails the case attempt regardless of score.

What do I need to pass?

Complete the required labs and coached module reflections; earn at least 16/20 on the human-reviewed case and 10/12 on decisions with no unresolved critical error; pass a 30-question final exam at 24/30 (80%).

What if I don’t pass first time?

You have three exam attempts, with a 24-hour wait after an unsuccessful one. Case feedback and any revision are handled through the reviewer workflow; contact will@qmslearning.com with questions.

How long does it take?

Plan About 4.5 hours, self-paced. The 255-minute estimate covers a 10-minute diagnostic, six 26-minute modules, a 35-minute case, 17 minutes of decisions and a 37-minute exam, plus time for practice and revisions. It is a planning estimate, not a measured completion time.

How long do I keep access?

A one-time purchase gives lifetime lesson access with no course subscription, subject to the accepted terms. Coach Q and AI tools remain subject to usage and service terms.

What is the refund policy?

For an individual Academy course purchase, request a refund within 3 days; the Order controls if it states different terms. Email will@qmslearning.com with “Refund Request” and the checkout email. A refund ends access and invalidates any completion certificate.

Is the certificate a cybersecurity certification?

No. The verifiable certificate records assessed course completion after all required work passes. It is not an accredited certification, proof of compliance, or authority to approve tools or handle incidents.

Can my company buy seats or use a PO?

Yes. Choose 1–50 named learners. Five or more seats get 10% off each seat; five seats total US$580.50 before applicable tax. Each person uses their own account. Contact will@qmslearning.com for a quote or PO.

Can I try a free lesson?

Yes. Enter your name, work email and phone in the free-lesson form, then verify your email to open lesson 1 with Coach Q. No payment card is needed.

Before the next paste

Say yes to the task. Choose a route you can defend.

Use AI on real work with a routine you can explain to your manager, your security team or an auditor.

  • Classify by the written rule, and ask the owner when it’s silent.
  • Share only what the question needs, through an approved route.
  • Check unusual requests through a route you already know.
  • Treat document text as data, keep access small, and report a slip fast.
Everything included · one time
$129 per person
Enroll for $129