Awareness tells them. The prompt box is where they listen.

Not into a public AI tool. Suppliers are bound by the security requirements in their contract and by the Contract Security Program, which only allow protected information to be processed on IT systems the program has approved and only by people with the right screening and a need to know. The Treasury Board guide on generative AI speaks to public servants rather than suppliers, but it points the same way and is a sensible floor for what a department will expect of its contractors.

Answer only what you can support with evidence. Renewal applications increasingly ask whether you know which AI tools staff use, whether a written AI policy exists, whether technical controls stop sensitive data from reaching those tools, and whether staff are trained. Gather the inventory, policy, training records, and control records before you fill in the form, and ask your broker how the insurer treats answers you cannot fully support.

Assume they will use AI, and plan for it from day one. Privacy law makes the host organization responsible for training the people who handle personal information and for safeguarding it, whether that person is a permanent employee or a four-month co-op student. Give interns a clear rule on what never goes into AI, an approved tool for ordinary tasks, and a safety net that catches sensitive data before it leaves.