Ethics, Law and Responsible Crisis Communication

Introduction

Crisis communication is not merely the rapid distribution of information. It is the exercise of institutional judgment under conditions of uncertainty, harm, scrutiny and time pressure. Decisions made during a crisis affect safety, legal exposure, reputation, employee relations, investor confidence and the legitimacy of the organisation itself. For brand managers, the central challenge is to communicate in a way that is truthful, useful and humane while respecting legal constraints and protecting legitimate confidential interests.

Ethics and law overlap, but they are not identical. Law establishes enforceable minimum standards; ethics asks what an organisation ought to do, including what it should do when the law is silent or permits conduct that stakeholders may reasonably regard as unfair. A legally defensible statement may still be evasive, misleading or damaging to trust. Conversely, an emotionally compelling disclosure may breach privacy, prejudice an investigation or expose affected people to further harm.

Responsible crisis communication therefore requires a disciplined balance among transparency, confidentiality, accountability, duty of care, data protection and regulatory compliance. The objective is not to eliminate organisational risk—an impossible goal—but to make decisions that are defensible, proportionate and aligned with stakeholder welfare.

Learning Objectives

By the end of this chapter, learners should be able to:

1. Distinguish ethical obligations from legal requirements in crisis communication.
2. Explain transparency, disclosure, confidentiality, accountability and duty of care.
3. Apply a framework for deciding what information to release, when and through which channel.
4. Analyse tensions between legal defensiveness and stakeholder trust.
5. Identify key data-protection, regulatory and governance risks.
6. Design responsible communication protocols for contemporary and digitally mediated crises.

1. The Ethical Architecture of Crisis Communication

1.1 Ethics, law and legitimacy

Ethics concerns principles of right conduct, including honesty, fairness, respect for persons and prevention of avoidable harm. Law consists of rules created and enforced by legitimate authorities. Corporate legitimacy is broader still: it is the perceived right of an organisation to operate and to receive stakeholder cooperation.

These domains can be represented as three overlapping but non-identical questions:

• Legal: Is the proposed action permitted or required by applicable law?
• Ethical: Is the action truthful, fair, respectful and proportionate?
• Strategic and legitimacy-related: Will the action sustain justified confidence in the organisation?

Compliance is necessary but insufficient. For example, a company may lawfully publish a technically accurate statement that omits a known risk. If the omission creates a misleading impression, the communication may be ethically deficient and may still create legal exposure under rules concerning misrepresentation, consumer protection, market disclosure or negligent communication.

1.2 Stakeholder theory and the public-interest test

Stakeholder theory treats employees, customers, communities, regulators, suppliers, investors and other affected groups as parties whose interests deserve consideration. In a crisis, stakeholder analysis should not be reduced to identifying audiences for message targeting. It should identify who may suffer harm, who needs information to make a protective decision and who has a legitimate claim to explanation or remedy.

A useful public-interest test asks:

1. Who may be harmed if information is withheld?
2. Who may be harmed if information is released?
3. Is the information necessary for safety, informed choice or accountability?
4. Can the objective be achieved with less intrusive disclosure?
5. Is the timing appropriate, or would delay create greater risk?
6. Can the organisation explain its decision consistently to an independent reviewer?

This test does not replace legal advice. It improves the quality of decisions by making consequences and affected interests explicit.

1.3 Core ethical principles

Truthfulness and accuracy. Information should be factually correct, adequately qualified and updated when material facts change. A statement can be literally true yet misleading through omission, selective framing or unjustified certainty.

Transparency. Transparency means making relevant information accessible and understandable, including what is known, unknown, being investigated and expected next. It does not require unrestricted disclosure of personal data, privileged advice or security-sensitive details.

Respect for persons. Victims, employees, whistle-blowers and vulnerable groups must not be treated merely as instruments of reputation management. Images, names, quotations and personal stories require a legitimate basis and, where appropriate, informed consent.

Fairness and non-discrimination. Crisis decisions should not shift disproportionate burdens to less powerful communities or use different standards for high-status and low-status stakeholders.

Proportionality. The intrusiveness of a communication should be proportionate to the public-interest objective. Disclosure of a named individual may be unnecessary when an anonymised description would protect stakeholders equally well.

Accountability. Organisations should accept responsibility for decisions within their control, explain corrective action and provide avenues for complaint, remedy and independent review.

Do no avoidable harm. Communication should reduce foreseeable physical, psychological, financial, privacy and reputational harm rather than treating communication as a purely symbolic activity.

2. Transparency and Disclosure Under Uncertainty

2.1 What transparency requires

Responsible transparency is structured rather than indiscriminate. A crisis update should normally distinguish:

• verified facts;
• credible but unconfirmed information;
• material unknowns;
• actions already taken;
• actions under consideration;
• instructions for affected people; and
• the time or condition for the next update.

This structure prevents speculation from being presented as fact and gives stakeholders a basis for action. It also allows an organisation to communicate before every detail is known.

A useful disclosure threshold is materiality: information is material when a reasonable stakeholder would consider it important to a decision, safety response, financial judgment or assessment of organisational conduct. Materiality is context-dependent. A small technical issue may be material if it affects a vulnerable population; a large operational disruption may be less material to customers outside the affected area.

2.2 The danger of strategic ambiguity

Organisations often use phrases such as “isolated incident,” “no evidence of impact” or “we take the matter seriously.” Such language can be appropriate when carefully defined, but it may become strategic ambiguity when it substitutes reassuring tone for useful information. The question is not whether a phrase sounds cautious; it is whether a reasonable recipient can understand the risk and act appropriately.

For example, “we have not identified affected records at this time” is more responsible than “no customer data was affected” when forensic investigation is incomplete. The first statement communicates the current state of knowledge; the second may create false certainty.

2.3 Disclosure timing

The timing decision involves competing risks. Premature disclosure can spread inaccurate information, compromise an investigation or expose individuals. Delayed disclosure can prevent protective action, allow rumours to dominate and appear deceptive.

A practical decision sequence is:

1. Determine whether immediate safety or protective action is required.
2. Identify legally mandated notification triggers and deadlines.
3. Confirm the minimum verified facts needed for an initial update.
4. Consult relevant specialists without allowing consultation to become indefinite delay.
5. State what is unknown and establish the next update point.
6. Correct material errors promptly and visibly.

The first statement need not be complete; it must be accurate, useful and honest about incompleteness.

3. Confidentiality, Privacy and Data Protection

3.1 Legitimate confidentiality

Confidentiality protects information where disclosure could cause unjustified harm or undermine a legitimate process. Common categories include:

• personal and sensitive personal data;
• medical information;
• trade secrets and commercially confidential material;
• legal advice and litigation strategy;
• information supplied in confidence by whistle-blowers;
• security details that could enable further attack; and
• information whose release could prejudice an active investigation.

Confidentiality is not a general excuse for silence. An organisation should specify what cannot be disclosed, why it cannot be disclosed and what general information can still be provided.

3.2 Data-protection principles

Although legal requirements vary by jurisdiction, modern data-protection regimes commonly reflect principles such as lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Crisis communication does not suspend these principles.

Before publishing personal information, communicators should ask:

• What is the lawful basis for processing or disclosure?
• Is the purpose specific and legitimate?
• Is each data element necessary?
• Has the information been verified?
• Could direct or indirect identifiers re-identify a person?
• How long will the information remain available?
• What safeguards protect the data in transmission and publication?

Data minimisation is especially important in social media updates, where a screenshot, name or location may be copied permanently beyond the organisation’s control. Public interest may justify disclosure of aggregate facts without revealing identities.

3.3 Breach communication

A data breach creates at least two communication duties: communication with regulators where required and communication with affected individuals where the risk warrants it. A responsible notification should explain the nature of the incident, likely consequences, protective steps, support channels and how the organisation will provide further updates. It should avoid technical jargon and should not shift the burden of understanding onto affected people.

The organisation should not publish exploit details, passwords, full identity records or other information that increases risk. At the same time, vague statements such as “a cybersecurity event occurred” may be inadequate if individuals need to change credentials, monitor accounts or take other protective action.

4. Accountability and Duty of Care

4.1 Accountability beyond apology

Accountability has at least four dimensions:

1. Answerability: explaining what happened and why decisions were made.
2. Responsibility: acknowledging the organisation’s role where it contributed to harm.
3. Corrective action: reducing recurrence through operational and governance changes.
4. Remedy: repairing harm through refunds, support, compensation, restoration or other appropriate measures.

An apology may be ethically important, but it is not a substitute for remedy. Nor should legal concerns automatically prevent humane recognition of suffering. Carefully drafted language can express concern and commitment without making unsupported factual or legal admissions.

4.2 Duty of care

Duty of care refers to the obligation to take reasonable steps to prevent foreseeable harm. In communication, this includes giving clear warnings, avoiding panic-inducing speculation, providing accessible instructions and considering people with disabilities, language barriers or limited digital access.

A company that knows a product may be unsafe cannot treat communication as a branding choice. It should coordinate recall or safety instructions with competent authorities, distributors and customer-service systems. The message must be sufficiently prominent and specific to support protective action.

4.3 The apology problem

A credible apology generally contains four elements: recognition of harm, acceptance of responsibility appropriate to the facts, expression of concern or regret, and commitment to corrective action. “We regret any inconvenience” may be technically cautious but can appear to minimise serious injury. Conversely, claiming responsibility for facts not yet established may be imprudent.

A calibrated formulation might be: “We are sorry that people were placed at risk. We identified failures in our review process, have suspended distribution, and are cooperating with the investigation. We will provide further findings when verified.” This combines empathy, factual restraint and action.

5. Law, Regulation and Governance

5.1 The regulatory environment

Crisis communication may engage multiple legal and regulatory regimes, including consumer protection, product safety, securities and market disclosure, employment law, privacy and data protection, environmental regulation, health and safety, advertising standards, competition law and sector-specific licensing rules.

Requirements differ by jurisdiction and industry. Therefore, this chapter provides a governance framework rather than jurisdiction-specific legal advice. Organisations should maintain access to qualified counsel and regulatory specialists.

5.2 Legal privilege and review

Legal review can identify defamation, admission, disclosure and litigation risks. However, routing every message through lawyers may produce delay, unreadable prose and a defensive tone. Privilege should support sound decision-making, not become a mechanism for avoiding accountability.

A strong protocol separates questions:

• What must be disclosed by law?
• What should be disclosed ethically?
• What may be withheld for a defined and defensible reason?
• What wording accurately describes uncertainty?
• What operational remedy accompanies the statement?

The final communication should be understandable to its audience. Legal precision and public clarity are not opposites; they require editing and disciplined explanation.

5.3 Market-sensitive and regulated information

Public companies and regulated entities may face duties concerning timely disclosure of material information, fair access to information, accuracy of investor statements and preservation of records. A crisis team should establish a disclosure committee or escalation route involving communications, legal, risk, compliance, operations and senior leadership.

No single function should dominate every decision. Communications specialists understand public interpretation; lawyers understand legal exposure; operational leaders understand facts and feasibility; compliance professionals understand regulatory expectations; executives carry accountability for governance choices.

5.4 Records and auditability

Responsible crisis communication requires a decision record. It should show the information available at the time, alternatives considered, approvals obtained, legal and ethical rationale, stakeholder impacts and subsequent corrections. Records support learning, regulatory cooperation and fair evaluation of decisions made under uncertainty.

6. Legal Defensiveness versus Stakeholder Trust

Legal defensiveness typically seeks to minimise admissions, preserve litigation positions and limit discoverable statements. Trust-oriented communication seeks candour, empathy, explanation and visible action. These aims can conflict, but they are not inherently incompatible.

The conflict becomes acute when an organisation:

• says nothing until all facts are proven;
• uses passive language to conceal agency;
• denies a problem on the basis of incomplete evidence;
• blames contractors before investigation; or
• gives different audiences inconsistent accounts.

Stakeholder trust is not created by uncontrolled disclosure. It is created by reliable conduct over time: accurate updates, consistency between words and action, fair treatment, correction of errors and meaningful remedy. A legally cautious message can still build trust if it explains limits honestly and provides practical support.

A useful principle is maximum useful truth subject to legitimate constraints. “Maximum” rejects unnecessary secrecy; “useful” prioritises information that enables decisions; “truth” excludes manipulation; “legitimate constraints” recognises privacy, security, due process and legal obligations.

A decision matrix

7. A Responsible Crisis Communication Framework

A practical framework can be organised as the CLEAR protocol:

• C — Confirm the situation: establish facts, uncertainty, affected groups and immediate hazards.
• L — Locate obligations: identify legal, regulatory, contractual, ethical and governance duties.
• E — Evaluate harm and necessity: assess harms of disclosure and non-disclosure; apply proportionality and data minimisation.
• A — Act and communicate: provide clear instructions, acknowledge impact, explain action and state what remains unknown.
• R — Review and repair: monitor consequences, correct errors, report progress, provide remedy and capture lessons.

The protocol is iterative. New evidence may require revision, and revision should not be framed as inconsistency when it reflects transparent learning.

Message architecture

A high-quality initial message normally contains:

1. a direct description of the event;
2. the time, location or scope, if verified;
3. known and unknown impacts;
4. immediate instructions for stakeholders;
5. actions taken to control the problem;
6. support and contact channels;
7. relevant confidentiality explanation; and
8. the timing of the next update.

The message should be accessible across channels. A website may carry detail; social platforms may direct people to the authoritative update; call-centre scripts should match public statements; employees should receive information before or at the same time as external audiences where feasible.

8. Applied Case: The Northstar Health-App Incident

This is an illustrative fictional case.

Background

Northstar, a digital health company, discovered that an analytics configuration had exposed appointment-related metadata through a third-party service. The data did not include clinical notes, but some records could reveal clinic visits, approximate locations and user identifiers. The investigation was incomplete. Northstar’s legal team recommended waiting until forensic analysis established the full scope.

Problem

The company faced several tensions. Early disclosure could alarm users and complicate the investigation. Delay could prevent users from changing credentials or understanding privacy risks. Naming the third-party supplier could be premature and potentially unfair. Publishing affected user records would clearly create additional harm.

Analysis

The crisis team applied the CLEAR protocol. It confirmed the exposure mechanism, separated verified facts from estimates and identified vulnerable stakeholders, including people using clinics for sensitive conditions. It mapped privacy obligations, regulatory notification requirements, contractual duties and the ethical need for protective guidance.

The team concluded that waiting for perfect certainty was unjustified because users could take low-cost protective measures immediately. It also concluded that publishing exact records, technical exploit details or unverified numbers was unnecessary. The first update therefore needed to communicate the category of data, the investigation status, protective steps and support arrangements.

Approach and solution

Northstar issued an initial notice stating that an analytics configuration had allowed limited appointment metadata to be accessible to an unauthorised service; clinical notes and treatment content were not involved based on evidence then available. It stated that the review was continuing, disabled the configuration, engaged independent investigators, notified relevant authorities where required and created a dedicated support line. Users were advised to reset credentials as a precaution, while the company clarified that credential compromise had not been confirmed.

The company did not identify the supplier until contractual and forensic facts were verified. It provided a timetable for updates and later published a plain-language investigation report, a description of corrective controls and a remediation programme for affected users.

Outcome

Some users criticised the initial notice as incomplete, but subsequent updates were consistent and specific. Regulators noted the company’s prompt protective action and documentation. Trust did not return immediately; however, independent review and tangible remediation reduced further damage. The case illustrates that responsible communication is not a single perfect statement but a process of truthful updating, protection and repair.

Learning points

1. Uncertainty should be disclosed rather than hidden.
2. Privacy protection does not justify silence about meaningful risk.
3. Technical facts must be translated into practical user guidance.
4. Legal review is valuable when it improves accuracy, not when it creates indefinite delay.
5. Accountability requires operational correction and remedy, not only sympathetic language.

9. Technology, AI and Contemporary Developments

Digital platforms accelerate both communication and misinformation. Screenshots can remove context, algorithms can amplify emotional claims, and synthetic media can imitate organisational leaders. Crisis teams should maintain verified channels, authentication controls, rapid monitoring and a correction protocol. Monitoring should not become unlawful surveillance or the collection of unnecessary personal data.

Generative AI can assist with translation, accessibility, scenario analysis, question clustering and draft comparison. It should not independently determine whether a fact is true, whether a person’s data may be disclosed or whether an apology is legally and ethically appropriate. AI-generated content may hallucinate facts, reproduce bias, expose confidential information or produce a tone that trivialises harm. Human approval, source verification, access controls and an audit trail are essential.

Contemporary governance increasingly emphasises resilience, cyber incident reporting, supply-chain accountability, environmental and social claims, and disclosure of material risks. Organisations should avoid treating these developments as merely reporting burdens. They create opportunities to integrate crisis communication with enterprise risk management, privacy governance, internal audit and stakeholder engagement.

10. Challenges and Limitations

No framework can resolve every crisis automatically. First, laws vary across countries, and a global organisation may face conflicting notification rules. Second, the facts may remain genuinely ambiguous, making any public account vulnerable to later revision. Third, stakeholders may disagree about what counts as material, fair or proportionate. Fourth, transparency can itself create risks, including privacy invasion, copycat attacks or market instability.

There is also a power imbalance in organisational communication. A company may describe a process as transparent while affected communities lack the resources to challenge it. Independent oversight, accessible complaint mechanisms and consultation with affected groups can reduce this imbalance.

Finally, reputation metrics should not replace ethical judgment. Positive sentiment, media volume or share-price movement cannot establish that a communication was responsible. Evaluation should include whether people received actionable information, whether harm was reduced, whether promises were fulfilled and whether governance changed.

Best-Practice Checklist

Before issuing a significant crisis communication, ask:

• Are the facts verified and clearly separated from assumptions?
• Have immediate safety and protective needs been prioritised?
• Is the information material to affected stakeholders?
• Have privacy, confidentiality and security risks been minimised?
• Have applicable legal and regulatory duties been identified?
• Does the language accept appropriate responsibility without speculation?
• Is the message understandable, accessible and consistent across channels?
• Does it explain what is unknown and when the next update will occur?
• Are support, complaint and remedy mechanisms available?
• Is the decision recorded for later review and learning?

Chapter Summary

Ethical crisis communication exceeds minimum legal compliance. It requires truthfulness, transparency, respect, fairness, proportionality, accountability and prevention of avoidable harm. Transparency means communicating material facts, uncertainty, actions and next steps—not publishing every piece of information. Confidentiality and data protection are legitimate constraints, but they must be specific, proportionate and explained where possible.

Disclosure decisions should consider the harms of both release and silence, the needs of vulnerable stakeholders and the importance of timely protective action. Accountability involves answerability, responsibility, correction and remedy. Duty of care requires communication that enables people to protect themselves, including those facing accessibility or vulnerability barriers.

Legal review should improve accuracy and protect legitimate interests without becoming a pretext for indefinite delay or evasive language. The CLEAR protocol—Confirm, Locate obligations, Evaluate, Act and communicate, Review and repair—offers a practical governance method. Ultimately, stakeholder trust is sustained when communications are consistent with conduct, limitations are candid, errors are corrected and commitments lead to measurable action.

Key Terms

Ethics: Principles concerning right and responsible conduct.

Crisis communication: Planned and unplanned communication during events that threaten people, operations, legitimacy or reputation.

Transparency: Making relevant information accessible, understandable and appropriately complete.

Disclosure: The communication of information to stakeholders, authorities or the public.

Materiality: The significance of information to a reasonable stakeholder’s decision or assessment.

Confidentiality: Protection of information from unauthorised disclosure.

Data minimisation: Collecting, using or disclosing only the personal data necessary for a legitimate purpose.

Accountability: The duty to explain decisions, accept appropriate responsibility, correct failures and provide remedy.

Duty of care: The obligation to take reasonable steps to prevent foreseeable harm.

Proportionality: Matching the intrusiveness of an action to its legitimate objective.

Legal privilege: Protection for certain confidential communications made for obtaining or giving legal advice.

Regulatory compliance: Conformance with applicable laws, rules, standards and supervisory requirements.

Stakeholder theory: The view that organisations should consider the interests of parties affected by their actions.

Remedy: Action taken to repair, compensate for or reduce harm.

Strategic ambiguity: Vague or selective language that may obscure rather than clarify material facts.

Data breach: Unauthorised access to, disclosure of, alteration of or loss of protected information.

Informed consent: Agreement given with sufficient understanding of the relevant purpose, risks and alternatives.

Legitimacy: Perceived justification for an organisation’s authority and continued operation.

CLEAR protocol: A crisis communication process based on Confirm, Locate obligations, Evaluate, Act and communicate, Review and repair.

Review Questions

Short Answer Questions

1. Why is legal compliance necessary but insufficient for responsible crisis communication?
2. What is meant by materiality in a crisis disclosure decision?
3. Identify four legitimate categories of confidential information.
4. What are the four dimensions of accountability described in this chapter?
5. Explain the principle of data minimisation.

Long Answer Questions

1. Discuss the relationship among transparency, uncertainty and stakeholder trust.
2. Explain how duty of care influences the design of a crisis message.
3. Analyse the tension between legal defensiveness and ethical accountability.
4. Describe the CLEAR protocol and explain how it can guide a data-breach response.
5. Evaluate the role of legal counsel, communications professionals and operational leaders in crisis governance.

Analytical / Application Questions

1. A company discovers that a product may be unsafe, but the evidence is incomplete. Design an initial public statement and justify what you would disclose, withhold and promise.
2. A hospital wants to publish the name and photograph of a patient affected by a service failure to demonstrate transparency. Apply ethical and data-protection principles to recommend an approach.
3. Analyse the Northstar case from the perspectives of privacy, duty of care, accountability and long-term brand legitimacy. Propose one improvement to its communication plan.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes legal compliance from ethical crisis communication?

A. Legal compliance always guarantees stakeholder trust.

B. Ethical communication requires no attention to law.

C. Legal compliance establishes minimum obligations, while ethics also considers fairness, harm and responsibility.

D. Ethics applies only after legal proceedings end.

Correct Answer: C. Legal compliance establishes minimum obligations, while ethics also considers fairness, harm and responsibility.

Question 2

Which information should normally be included in an initial crisis update when facts remain incomplete?

A. Only information that eliminates all organisational liability.

B. Verified facts, material unknowns, protective actions and the timing of the next update.

C. All available personal data about affected individuals.

D. Unverified rumours if they are widely discussed online.

Correct Answer: B. Verified facts, material unknowns, protective actions and the timing of the next update.

Question 3

What does data minimisation require?

A. Deleting every record immediately after an incident.

B. Publishing all available data to demonstrate transparency.

C. Using or disclosing only the personal data necessary for a legitimate purpose.

D. Collecting additional personal data without informing stakeholders.

Correct Answer: C. Using or disclosing only the personal data necessary for a legitimate purpose.

Question 4

Which is not one of the four dimensions of accountability identified in the chapter?

A. Answerability

B. Responsibility

C. Corrective action

D. Message popularity

Correct Answer: D. Message popularity

Question 5

A statement says, “No customer data was affected,” while forensic investigation is still incomplete. What is the principal communication problem?

A. It communicates excessive uncertainty.

B. It creates unjustified certainty and may mislead stakeholders.

C. It provides too much practical guidance.

D. It necessarily violates confidentiality.

Correct Answer: B. It creates unjustified certainty and may mislead stakeholders.

Question 6

Which action best reflects the principle of proportionality?

A. Publishing a victim’s identity whenever an incident is newsworthy.

B. Withholding every fact until the investigation is complete.

C. Using anonymised aggregate information when it achieves the protective purpose without exposing identity.

D. Releasing technical exploit details to prove expertise.

Correct Answer: C. Using anonymised aggregate information when it achieves the protective purpose without exposing identity.

Question 7

In the CLEAR protocol, what does the letter E represent?

A. Escalate all decisions to external counsel.

B. Evaluate harm and necessity.

C. Eliminate all uncertainty.

D. Expose confidential information.

Correct Answer: B. Evaluate harm and necessity.

Question 8

Why can an apology be insufficient as an accountability response?

A. Apologies are always legally prohibited.

B. An apology cannot replace corrective action and appropriate remedy.

C. Stakeholders prefer technical language to empathy.

D. An apology automatically reveals personal data.

Correct Answer: B. An apology cannot replace corrective action and appropriate remedy.

Question 9

Which practice is most appropriate when legal review is required?

A. Allow legal review to delay communication indefinitely.

B. Use legal review to improve accuracy while preserving clarity and timely protective guidance.

C. Remove all expressions of concern from the message.

D. Publish privileged legal advice to demonstrate transparency.

Correct Answer: B. Use legal review to improve accuracy while preserving clarity and timely protective guidance.

Question 10

Which use of generative AI is most responsible in crisis communication?

A. Allowing AI to decide whether personal data may be disclosed.

B. Using AI-generated facts without source verification.

C. Using AI for drafting or translation with human review, verification and confidentiality controls.

D. Uploading privileged investigation files to a public AI system.

Correct Answer: C. Using AI for drafting or translation with human review, verification and confidentiality controls.