Legal Ethics and Ethical Decision-Making

Introduction

Corporate compliance is not limited to identifying legal rules and checking whether an organisation has technically followed them. It also requires judgments about honesty, fairness, loyalty, confidentiality, professional independence and the responsibilities owed to different groups affected by corporate conduct. Legal ethics provides the principles by which those judgments can be made.

Corporate officers, directors, compliance professionals and legal advisers frequently encounter situations in which duties conflict. A lawyer may owe confidentiality to a company while employees, regulators or investors seek information. A director may owe duties to the company while also having personal, family or financial interests. A compliance officer may be expected to protect the organisation but must also escalate misconduct that threatens the public interest. These situations cannot always be resolved by relying on a single rule or by asking only whether conduct is technically lawful.

Ethical decision-making therefore involves disciplined analysis. The decision-maker must identify the relevant facts, duties, affected interests, legal constraints, possible consequences and character of the proposed action. This chapter introduces major ethical theories and applies them to recurring corporate problems.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the relationship between law, professional ethics and corporate governance.
2. Apply duty-based, consequentialist, virtue, justice, rights and stakeholder theories.
3. Analyse conflicts of interest, confidentiality, legal privilege, honesty and professional independence.
4. Resolve competing obligations through a structured ethical decision-making process.
5. Evaluate the role of corporate policies, reporting systems, technology and leadership in ethical compliance.
6. Communicate and document an ethically defensible professional decision.

1. Law, Ethics and Corporate Responsibility

Law establishes enforceable minimum standards. Ethics concerns standards of right conduct, including standards that may exceed legal requirements. An action may be lawful but ethically questionable—for example, exploiting a loophole, withholding material information from a vulnerable stakeholder, or designing a transaction to avoid the spirit of a regulation. Conversely, an ethically motivated action, such as disclosing serious wrongdoing, may create legal risks if confidentiality and reporting rules are ignored.

Professional ethics occupies the space between general morality and legal regulation. Professional bodies commonly impose duties of integrity, competence, confidentiality, independence, loyalty and avoidance of conflicts. Corporate ethics extends these concerns to the organisation as a whole. It includes the responsibilities of the board, senior management, employees, advisers and control functions.

A useful distinction is between three questions:

Legal compliance is the starting point, not always the conclusion. A strong compliance culture encourages people to identify risks early, ask difficult questions and escalate concerns without fear of retaliation.

Important terminology

• Duty: An obligation arising from law, contract, office, professional status or moral commitment.
• Fiduciary duty: A duty of loyalty and good faith owed by a person who exercises discretionary power for another.
• Conflict of interest: A situation in which personal or competing interests may improperly influence professional judgment.
• Confidentiality: The obligation to protect information received in a professional capacity.
• Legal professional privilege: A legal protection, subject to jurisdictional limits, for certain confidential communications made for legal advice or litigation purposes.
• Integrity: Consistency between professional commitments, statements and conduct.
• Independence: Freedom from improper influence, bias or conflicting interests.
• Whistleblowing: Reporting suspected wrongdoing through internal or external channels.
• Stakeholder: A person or group affected by, or able to affect, an organisation’s activities.

2. Major Ethical Theories

No single theory resolves every corporate dilemma. The theories below provide different questions and perspectives. Good professional reasoning often uses several of them together.

2.1 Duty-based ethics

Duty-based ethics, associated with deontological reasoning, assesses conduct by reference to principles and obligations rather than only outcomes. Duties may include telling the truth, keeping promises, respecting confidentiality, avoiding deception, obeying lawful instructions and treating persons as ends rather than merely as instruments.

A duty-based analysis asks:

1. What duties apply?
2. Who holds each duty, and to whom is it owed?
3. Are the duties legal, contractual, professional, fiduciary or moral?
4. Can the duties be performed simultaneously?
5. If they conflict, which duty has priority under applicable law and professional rules?

The strength of this approach is that it protects basic standards even when misconduct might produce attractive results. Its limitation is that duties may conflict. Absolute secrecy, for example, may be incompatible with a mandatory reporting obligation or with preventing serious and imminent harm.

2.2 Consequentialist ethics

Consequentialism evaluates an action by its likely effects. A decision is ethically preferable when it produces better overall consequences, such as reducing harm, protecting investors, preserving employment, preventing corruption or maintaining public trust.

Consequentialist analysis should consider:

• the magnitude and probability of benefits and harms;
• short-term and long-term consequences;
• who receives the benefits and who bears the costs;
• reversibility of the decision;
• effects on trust, reputation and institutional legitimacy; and
• foreseeable second-order effects.

Its strength is practical attention to real-world impact. Its limitation is the danger of sacrificing the rights of a minority for an alleged overall benefit. It can also be distorted by optimistic forecasts or by management’s tendency to value financial outcomes more heavily than human harm.

2.3 Virtue ethics

Virtue ethics focuses on the character of the decision-maker and the qualities required for excellent professional practice. Relevant virtues include honesty, courage, fairness, prudence, loyalty, humility, independence and practical wisdom.

The central question is not merely “What rule applies?” but “What would a trustworthy and responsible professional do in these circumstances?” Practical wisdom is important because ethical conduct requires sensitivity to context. Courage may be necessary to challenge senior management; humility may require recognising uncertainty and seeking advice.

Virtue ethics highlights culture and leadership. An organisation may possess detailed policies yet remain unethical if leaders reward concealment, punish dissent or celebrate results obtained through questionable methods.

2.4 Justice and fairness

Justice-based reasoning asks whether benefits, burdens, procedures and opportunities are distributed fairly. It also considers whether people are treated consistently and whether vulnerable groups receive adequate protection.

Corporate examples include:

• whether a restructuring places disproportionate burdens on low-income workers;
• whether disciplinary action is consistent across senior and junior employees;
• whether an investigation gives the accused a fair opportunity to respond;
• whether an algorithm discriminates against a protected group; and
• whether shareholders benefit while communities bear environmental costs.

Procedural justice concerns fair processes: notice, impartiality, opportunity to be heard, consistency and reasoned decisions. Substantive justice concerns the fairness of the outcome itself.

2.5 Rights-based ethics

Rights-based reasoning protects interests regarded as fundamental, such as privacy, equality, freedom from discrimination, due process, freedom of expression and property rights. Rights may be grounded in constitutions, statutes, human-rights instruments, contracts or professional duties.

Rights are not always unlimited. Privacy may be restricted by a lawful and proportionate investigation. Confidentiality may yield to a legally required disclosure. The proper analysis identifies the right, the interference, the legal basis, the necessity of the interference and whether less intrusive alternatives exist.

2.6 Stakeholder theory

Stakeholder theory treats the corporation as responsible not only to shareholders but also to employees, customers, suppliers, creditors, regulators, communities and, where relevant, the environment. The theory does not mean that every stakeholder receives an equal claim in every decision. It requires decision-makers to identify affected groups and give their legitimate interests serious consideration.

Stakeholder analysis is particularly useful where a decision creates externalities—costs or benefits imposed on people who are not parties to the transaction. It also supports long-term value creation because trust, employee commitment and social legitimacy can affect corporate performance.

3. A Structured Ethical Decision-Making Framework

Ethical reasoning should be systematic and documented. The following eight-stage framework is suitable for compliance, legal and governance decisions.

Stage 1: Establish the facts

Separate verified facts from assumptions, allegations and predictions. Identify missing information and preserve relevant documents. Avoid allowing the preferred outcome to shape the factual inquiry.

Stage 2: Identify the decision and affected parties

State the decision precisely. Identify the company, directors, officers, employees, clients, regulators, investors, communities and other stakeholders affected by each option.

Stage 3: Identify applicable rules and duties

Review legislation, regulations, case law, contracts, constitutional documents, professional codes, internal policies and board resolutions. Determine whether the organisation or professional has a mandatory reporting, preservation or disclosure duty.

Stage 4: Identify conflicts and constraints

Ask whether anyone has a personal interest, divided loyalty, confidential information or incentive that may distort judgment. Determine whether the adviser is authorised to act and whether independence has been impaired.

Stage 5: Generate realistic alternatives

Do not frame the choice as “do nothing” or “take the most extreme action.” Alternatives may include obtaining independent advice, recusing a decision-maker, delaying action to verify facts, making a limited disclosure, strengthening controls, negotiating a remedy or escalating through an independent channel.

Stage 6: Test the alternatives through ethical theories

For each option, ask:

• What duties does it respect or breach?
• What consequences are reasonably foreseeable?
• What would a person of integrity and courage do?
• Is the process and result fair?
• Whose rights are affected?
• Which stakeholders bear risks or benefits?

Stage 7: Decide, document and communicate

Select the option that is lawful, professionally proper and ethically defensible. Record the facts, advice received, alternatives considered, reasons for the decision and safeguards adopted. Communication should be accurate, proportionate and appropriately confidential.

Stage 8: Review and learn

Monitor implementation and outcomes. If the decision produces unexpected harm, revise it. Feed lessons into training, policies, controls and organisational culture.

A practical decision can be tested by the “publicity question”: would the decision remain defensible if its essential facts were reported to a court, regulator, affected employee or informed newspaper? This is not a substitute for legal analysis, but it can expose concealment and rationalisation.

4. Conflicts of Interest

A conflict exists when a personal, financial, relational or competing professional interest could influence—or reasonably appear to influence—judgment. Actual conflict is not required in every legal system; an apparent or potential conflict may be sufficient to require disclosure or withdrawal.

Examples include:

• a director considering a transaction with a company owned by a relative;
• a lawyer advising both a corporation and an executive whose interests have diverged;
• a compliance officer investigating a department whose performance bonus depends on avoiding findings;
• accepting substantial gifts from a supplier; and
• acting for competitors in related matters while holding confidential information.

A sound conflict-management process includes disclosure, assessment, informed consent where permitted, safeguards, independent review and recusal where necessary. Consent is not automatically valid. It must normally be informed, voluntary and legally permissible. A client or board cannot consent to a conflict that makes competent and loyal representation impossible.

Conflicts registers, annual declarations, transaction approvals and independent committees are useful controls. However, forms do not eliminate conflicts; they merely help identify them. The decision-maker must assess materiality and the appearance of compromised judgment.

5. Confidentiality, Privilege and Information Governance

Confidentiality protects information obtained through employment, office or professional engagement. It may continue after employment or representation ends. Information should be accessed, used and disclosed only for legitimate purposes and on a need-to-know basis.

Legal professional privilege is narrower and jurisdiction-dependent. It commonly protects confidential communications between a client and a qualified legal adviser made for the purpose of obtaining or giving legal advice, and certain communications made for actual or contemplated litigation. The precise requirements differ among jurisdictions. Privilege generally belongs to the client, not personally to the lawyer, and may be waived by careless disclosure.

The following distinctions are important:

Not every document prepared by a lawyer is privileged. Business advice, public information, underlying facts and communications made for commercial rather than legal purposes may fall outside privilege. Copying a lawyer into an email does not automatically create privilege.

Ethical confidentiality is also subject to exceptions. These may include client consent, legal compulsion, defence of the professional, prevention of serious harm, regulatory obligations and reporting of specified misconduct. The professional should disclose no more than necessary, verify the legal basis and consult an independent adviser where possible.

Modern information governance creates additional risks. Email forwarding, cloud storage, collaboration platforms, personal devices, metadata, automated transcription and generative AI tools may expose confidential material. Before using an AI system, an organisation should assess data retention, training use, access controls, jurisdiction, accuracy, vendor terms and whether the tool can preserve privilege. Confidential documents should not be entered into an unapproved public system.

6. Honesty, Candour and Professional Independence

Honesty requires accurate statements and prohibits deliberate deception. Candour requires correcting material errors and avoiding communications that create a misleading impression through selective omission. A statement can be literally true yet misleading if it omits information that makes the statement materially false in context.

Legal and compliance professionals should not knowingly mislead a court, regulator, board, client or colleague. They should distinguish facts from allegations, legal advice from business judgment and certainty from probability. Where an error occurs, prompt correction is generally preferable to concealment.

Professional independence means exercising judgment without improper pressure from a client, employer, superior, fee arrangement or personal interest. Independence does not mean isolation: a professional may consider commercial objectives and receive instructions, but must not allow those objectives to distort legal or ethical judgment.

Threats to independence include self-interest, self-review, advocacy, familiarity, intimidation and conflicts. Safeguards may include independent reporting lines, rotation, second opinions, separate approval authority, recusal and direct access to the board or audit committee.

7. Competing Corporate Obligations

A corporation may owe different obligations simultaneously. It may owe duties to shareholders, creditors, employees, customers, regulators and communities. Directors may have duties to act in the company’s interests, exercise care and skill, avoid conflicts and comply with statutory obligations. When insolvency is probable or present, creditor interests may receive increased legal significance in many jurisdictions.

The phrase “the company’s interest” should not be treated as a permission to ignore law or stakeholders. A lawful long-term corporate interest may include preserving trust, protecting employees and avoiding systemic harm. Yet ethical reasoning must remain legally grounded: stakeholders cannot be used to justify an action prohibited by statute or court order.

A practical hierarchy is:

1. Do not commit or facilitate unlawful conduct.
2. Protect fundamental rights and comply with mandatory duties.
3. Identify and manage conflicts of interest.
4. Preserve independence, confidentiality and procedural fairness.
5. Compare foreseeable consequences for all materially affected stakeholders.
6. Select and document the least harmful lawful option that meets legitimate corporate objectives.

This is not an automatic legal hierarchy for every jurisdiction. It is a professional reasoning guide that must be adapted to applicable law and facts.

8. Illustrative Case Study: The Delayed Safety Disclosure

The following is a fictional illustrative case.

Background

Northbridge Components Ltd manufactures industrial control equipment. Its internal testing identifies a possible defect that could cause overheating in a small percentage of units. No injury has yet been reported. The chief executive proposes delaying disclosure until the next quarterly results because an immediate recall could breach loan covenants and cause substantial job losses. The general counsel is asked to prepare a statement saying that the company has “no confirmed safety issue.”

Problem

The legal team must decide whether the proposed statement and delay are acceptable. The board is concerned about investors, employees, customers, lenders and regulators. The head of engineering believes the risk is uncertain but recommends immediate technical investigation.

Analysis

A duty-based analysis identifies duties of honesty, product safety, regulatory compliance, preservation of evidence and protection of customers. If reporting rules require prompt notification, delay may be unlawful regardless of financial consequences.

A consequentialist analysis considers injuries, recall costs, business interruption, loss of trust, regulatory penalties and employment effects. Delay may reduce immediate financial pressure but increase the probability and severity of harm.

A rights-based analysis recognises customers’ rights to safety and accurate information. Investors also have an interest in material, non-misleading disclosure. Justice requires that customers not bear an undisclosed risk merely to protect current shareholders or management incentives.

Virtue ethics asks whether a responsible and courageous leadership team would investigate openly, correct uncertainty and protect affected users. Stakeholder theory requires consideration of customers, employees, lenders, investors, regulators and the community rather than only quarterly earnings.

The proposed statement is ethically problematic because “no confirmed safety issue” may create a misleading impression if the company knows of credible evidence requiring investigation. Uncertainty does not justify false certainty.

Approach and solution

The company should preserve all technical records, obtain an independent engineering assessment, consult product-safety counsel, review mandatory reporting periods and inform the board’s risk or audit committee. It should suspend distribution where proportionate, notify regulators if legally required and prepare a customer communication that accurately explains the known facts and uncertainty. The general counsel should refuse to approve a misleading statement and document the reasons. If management persists, escalation to the independent directors and, where legally required, an external reporting channel may be necessary.

Outcome

The independent assessment confirms a significant risk in one product line. Northbridge conducts a targeted recall, reports to the regulator and establishes a compensation process. The short-term financial impact is substantial, but the company avoids injuries, preserves evidence of responsible conduct and improves its testing and escalation controls.

Learning points

1. Uncertainty is not permission to mislead.
2. Financial pressure does not remove safety and honesty duties.
3. Independent technical and legal review reduces biased decision-making.
4. Early escalation can reduce long-term harm.
5. Ethical decisions should be documented, not merely asserted.

9. Governance, Culture and Controls

Ethical conduct depends on systems as well as individual character. Effective governance arrangements include a board-approved code of conduct, clear responsibility for compliance, protected reporting channels, anti-retaliation measures, conflict registers, training, investigation protocols and proportionate disciplinary procedures.

A speak-up system should provide confidentiality where legally possible, alternative reporting routes, prompt triage, independence from implicated managers and feedback to reporters. Investigations should preserve impartiality, avoid premature conclusions and protect both complainants and respondents from retaliation.

Incentive systems require particular attention. Unrealistic sales targets, bonuses based only on short-term results and promotion of leaders who suppress bad news can create ethical risk. Performance measures should include compliance behaviour, customer outcomes, control effectiveness and quality of escalation.

Ethical culture can be assessed through employee surveys, hotline data, audit findings, repeat incidents, investigation duration, disciplinary consistency and evidence of management response. Metrics must be interpreted carefully: a rise in reports may indicate either worsening misconduct or improved trust in reporting channels.

10. Limitations and Contemporary Challenges

Ethical theories simplify complex realities. Consequences are difficult to predict; duties may conflict; virtue assessments may be culturally contested; stakeholder lists can become indefinite; and rights may require balancing. Ethical frameworks do not eliminate judgment. They make judgment more transparent and disciplined.

Global corporations face differences in law, professional regulation, culture and enforcement. A practice accepted in one jurisdiction may breach another’s rules. Organisations should apply a defensible global baseline while obtaining local advice.

Artificial intelligence creates additional issues involving confidentiality, bias, explainability, accountability and professional competence. A lawyer or compliance officer remains responsible for reviewing AI-generated content. Fabricated authorities, inaccurate summaries and hidden bias can produce serious harm. Human oversight should be proportionate to the risk, and high-impact decisions should not be delegated without meaningful review.

The ethical use of data requires purpose limitation, data minimisation, security, accuracy, retention controls and respect for individual rights. Surveillance of employees or customers should have a lawful basis, a legitimate purpose and proportionate safeguards.

Best-Practice Checklist

Before finalising a difficult corporate decision, ask:

• Have the material facts been independently verified?
• What laws, professional rules and internal policies apply?
• Whose interests and rights are affected?
• Is there an actual, potential or apparent conflict?
• Does anyone need to recuse themselves?
• Are confidentiality and privilege being correctly distinguished?
• Is the proposed communication truthful and non-misleading?
• What are the foreseeable short-term and long-term consequences?
• Is the process fair and consistent?
• Would the decision withstand informed external scrutiny?
• Has the reasoning been documented and escalated appropriately?
• What controls should change after the decision?

Chapter Summary

Legal ethics guides professional and corporate conduct beyond minimum legal compliance. Duty-based ethics emphasises obligations and principles; consequentialism evaluates likely effects; virtue ethics focuses on character and practical wisdom; justice theory examines fair processes and distributions; rights-based ethics protects fundamental interests; and stakeholder theory considers all materially affected groups. These theories are complementary rather than mutually exclusive.

Conflicts of interest must be disclosed, assessed and controlled. Confidentiality is distinct from legal privilege, and neither is absolute. Honesty requires avoiding misleading impressions, while professional independence requires judgment free from improper influence. Competing corporate obligations should be analysed through law, rights, fairness, consequences and stakeholder impact. A structured process—fact finding, duty identification, alternative generation, ethical testing, documentation, escalation and review—supports defensible decisions. Strong governance, reporting systems, incentives, leadership and responsible technology use are essential to making ethical conduct operational.

Key Terms

Duty: An obligation arising from law, contract, office, professional status or morality.

Consequentialism: An ethical theory that evaluates conduct by its likely results.

Virtue ethics: An approach focusing on character and qualities of good professional judgment.

Justice: Concern with fair treatment, fair procedures and fair distribution of benefits and burdens.

Rights: Protected interests such as privacy, equality, due process and freedom from discrimination.

Stakeholder: A person or group affected by, or able to affect, an organisation.

Fiduciary duty: A duty of loyalty and good faith arising from a relationship of trust and discretion.

Conflict of interest: A situation in which competing interests may compromise judgment.

Confidentiality: The obligation to protect information obtained professionally.

Legal professional privilege: Legal protection for defined confidential legal communications.

Candour: Openness and correction of material errors or misleading impressions.

Integrity: Consistency between commitments, statements and conduct.

Independence: Freedom from improper influence or conflicting interests.

Recusal: Withdrawal from a decision or matter because of a conflict or lack of independence.

Whistleblowing: Reporting suspected wrongdoing through an internal or external channel.

Procedural justice: Fairness of the process by which a decision is made.

Externality: A cost or benefit imposed on a person not directly involved in a transaction.

Ethical culture: Shared organisational expectations and practices concerning responsible conduct.

Review Questions

5 Short Answer Questions

1. Distinguish law, professional ethics and general ethical reasoning.
2. What is the difference between confidentiality and legal professional privilege?
3. Identify three common threats to professional independence.
4. Explain why disclosure alone may not be sufficient to manage a conflict of interest.
5. What is meant by procedural justice?

5 Long Answer Questions

1. Compare duty-based ethics and consequentialism in the context of a product-safety disclosure.
2. Explain how virtue ethics and organisational culture influence corporate compliance.
3. Discuss the ethical and governance issues involved in using generative AI with confidential corporate information.
4. Analyse the relationship between shareholder interests and stakeholder responsibilities.
5. Describe and evaluate the eight-stage ethical decision-making framework.

3 Analytical / Application Questions

1. A compliance officer discovers that a senior executive has approved payments to a supplier owned by a close relative. Apply conflict-of-interest principles and at least three ethical theories to determine an appropriate response.
2. A lawyer learns that a client intends to publish a technically true statement that omits a known regulatory investigation. Analyse the duties of honesty, confidentiality and candour, and recommend steps the lawyer should take.
3. A company proposes employee monitoring using an AI system that may inaccurately classify workers as high risk. Evaluate the proposal using rights, justice, consequentialist and stakeholder approaches, and design appropriate safeguards.

Multiple Choice Questions with Answers

Question 1

Which ethical theory primarily evaluates an action by its likely consequences?

A. Duty-based ethics

B. Consequentialism

C. Virtue ethics

D. Rights-based ethics

Correct Answer: B. Consequentialism

Question 2

Which statement best distinguishes confidentiality from legal professional privilege?

A. Confidentiality applies only in litigation, while privilege applies to all business information.

B. Privilege is a broader concept than confidentiality in every jurisdiction.

C. Confidentiality is a professional or contractual obligation, while privilege is a defined legal protection.

D. They are identical and can always be used interchangeably.

Correct Answer: C. Confidentiality is a professional or contractual obligation, while privilege is a defined legal protection.

Question 3

Which response is generally most appropriate when a professional has a material conflict of interest?

A. Conceal it if the transaction appears profitable.

B. Disclose and assess it, apply safeguards, and recuse where necessary.

C. Transfer the conflict to a junior employee without disclosure.

D. Ignore it if no complaint has yet been made.

Correct Answer: B. Disclose and assess it, apply safeguards, and recuse where necessary.

Question 4

What is the central concern of procedural justice?

A. Whether the process used to reach a decision is fair

B. Whether the company maximises quarterly profit

C. Whether all stakeholders receive identical outcomes

D. Whether a decision is kept confidential

Correct Answer: A. Whether the process used to reach a decision is fair

Question 5

Which statement about legal professional privilege is most accurate?

A. Every document sent to a lawyer is automatically privileged.

B. Privilege generally protects all commercial communications involving directors.

C. Privilege is jurisdiction-dependent and commonly requires a qualifying legal purpose.

D. Privilege belongs personally to the lawyer and can never be waived.

Correct Answer: C. Privilege is jurisdiction-dependent and commonly requires a qualifying legal purpose.

Question 6

A compliance officer is investigating a department whose performance bonus depends on receiving no adverse findings. This most clearly creates a threat of:

A. Independence

B. Data minimisation

C. Procedural transparency only

D. Stakeholder equality

Correct Answer: A. Independence

Question 7

Why may a technically true corporate statement still be ethically unacceptable?

A. Truthful statements are never permitted during investigations.

B. Selective omission may create a materially misleading impression.

C. Only regulators are entitled to accurate information.

D. Corporate statements must always disclose every fact known to the company.

Correct Answer: B. Selective omission may create a materially misleading impression.

Question 8

Which approach best reflects stakeholder theory?

A. Considering only the interests of current shareholders

B. Treating every stakeholder’s claim as identical in every decision

C. Identifying and seriously considering the legitimate interests of materially affected groups

D. Giving priority to management preferences over external effects

Correct Answer: C. Identifying and seriously considering the legitimate interests of materially affected groups

Question 9

What is the primary purpose of recusal?

A. To remove a person from a matter where their impartiality may be compromised

B. To eliminate the need for documentation

C. To transfer legal liability to another person automatically

D. To prevent all stakeholders from receiving information

Correct Answer: A. To remove a person from a matter where their impartiality may be compromised

Question 10

Which is a sound safeguard when using generative AI with corporate information?

A. Entering confidential documents into any free public tool

B. Assuming the system’s output is accurate because it is automated

C. Assessing vendor data practices, access controls, retention and human review

D. Allowing AI to make all high-impact decisions without oversight

Correct Answer: C. Assessing vendor data practices, access controls, retention and human review