What may an AI do in your office — and what never?

What may an AI do in your office — and what never? The line is simpler than most people think. Five pairs:

1. Sort mail: yes. Delete mail: never. A mail filed in the wrong place can be found again. A deleted one cannot.

2. File documents: yes. Send documents: never. Filing in the wrong folder is one click back. A document at the wrong recipient cannot be recalled.

3. Draft a reply: yes. Send it: never. The draft saves the time. Sending carries the responsibility — and that stays with a human.

4. Spot a deadline and flag it: yes. Decide whether it matters: never. The machine sees the date. Whether it is worth your weekend, only you know.

5. Look up a price in the contract: yes. Promise a price: never. Looking up is work. Promising is a deal.

The rule behind them: the machine may do anything that can be undone. Anything that leaves the building or binds you stays with a human. Our back office has run like this for months, and no mail has left the house without someone pressing “send”. What that looks like day to day is on the service page.

The line costs a few seconds per draft: someone reads it and presses “send”. That is intended. The one mail that should not have gone out costs more than all the seconds together.

Which pair would spark the most discussion at your company?

Why the boundary is also a privacy question

Each of the five «never» describes a moment in which data leaves the house or disappears for good: the mail to the wrong recipient, the document with the wrong customer, the deleted file. The Swiss Data Protection Act requires personal data to be protected by appropriate technical and organisational measures (Art. 8) and provides a duty to report breaches of data security when they create a high risk for the persons concerned (Art. 24). A dossier sent to the wrong party is exactly such a case.

The rule «everything that goes out stays with a human» is therefore not caution for its own sake. It is the organisational measure that is easiest to explain and easiest to verify.

The second boundary: who sees what?

The question of what an AI may do comes with the question of what it gets to see in the first place. With us, access is separated by mandate: whoever works for one company — human or machine — does not see the documents of the others.

Three questions for every provider

1. Which actions can the AI trigger without a human’s approval?
2. Can each of them be undone?
3. Who — and what — sees which documents?

If you do not get a clear answer to these, that is the answer.