Using AI safely as a business analyst on a real assignment

AI tools can save a business analyst time, and they can also put an unchecked claim into a document that a programme then builds on. The difference is mostly habit. This article sets out the rules I would follow on a financial-services assignment, with a worked example of checking output against sources.

Northgate Bank, its people and its documents are fictional.

Last reviewed: October 2026.

Rule one: check the firm's policy before the first prompt

Many regulated firms restrict external AI tools, or approve only an internal one. Some ban any use with work data. Read the policy, or ask the line manager or the information security contact. If there is no clear answer, assume that no client, customer or internal data goes into any tool.

Put the answer in your notes with the date. If you are a contractor, check your contract as well as the client's rules.

Rule two: know what not to paste

"Just the structure" is not a safe exception. A column list or a process outline can reveal how a firm works. If you want help with the shape of a document, describe it in general terms or use an invented example.

What is generally acceptable, subject to the firm's policy: public material, your own notes with names and figures removed, and invented scenarios.

Rule three: treat output as a draft from someone who has not read your sources

AI output reads confidently whether or not it is right. It does not know which of your project's documents is authoritative, and it may combine several into a statement that none of them makes.

Use it for:

• tidying notes you are entitled to process
• suggesting questions you may have missed, as a prompt for your own thinking
• reformatting a list into a table
• proposing edge cases for acceptance criteria, which you then judge

Be careful with anything that looks like a fact: a regulation, a threshold, a time, a name, a quotation.

Rule four: check every claim against a source

Here is a routine that takes about fifteen minutes for a page of output.

1. Split the output into single claims, one per line.
2. Find the source for each in your register and note the document ID and passage.
3. Mark each claim supported, supported by inference, unsupported or contradicted.
4. Remove the unsupported ones or turn them into questions for the owner.
5. Record what you asked, what you checked and what you changed.

A worked example. You ask a tool to summarise the settlement cut-off rules from some public scheme material and your own non-confidential notes. It returns:

Two of four claims would have gone into a requirement with nothing behind them. The contradicted one becomes a question: "Are late instructions held for the next day or rejected to the sender?" The unsupported ones become questions or are deleted.

Rule five: a person makes the decision

Decisions come from people with the authority to make them. Sources come from documents. AI output is neither.

• Never record AI text as a decision in your log.
• Never cite it as a source. Cite the document it came from, if there is one.
• Put your own name on what you submit, and be prepared to explain every line.
• If a stakeholder asks how a document was produced, tell them. If the firm requires disclosure, disclose.

If a model's suggestion changes a requirement, the owner still has to agree it. Write down who agreed and when.

Rule six: keep your prompts

Keep a short log of what you asked, the date, which tool, and what you did with the result. It is part of your audit trail if somebody questions how a document was produced, and it helps you notice which prompts waste your time.

Do not keep prompts that contain confidential data, because you should not have written them.

Common mistakes

Using a personal account for work content. Even with the best intentions, that is outside the firm's control.

Accepting a tidy summary. A neat paragraph is easy to believe. Check it as you would a colleague's first draft.

Asking for regulatory detail. Go to the regulator's own publication, or to the firm's compliance team.

Skipping the log. You will not remember in three weeks which wording came from where.

What to do on Monday

Find your firm's AI policy, write down the three things you will not paste, and set up a one-page log with columns for prompt, tool, checks and decision. Then try the routine on one short output.

Sources and further reading

These are reading routes, not statements of what applies to your firm. Check your own firm's policy first.

• Information Commissioner's Office, Guidance on AI and data protection: ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ (the ICO notes that this guidance is under review following the Data (Use and Access) Act, so check the page for the current position).
• Financial Conduct Authority, AI in financial services: good practice and areas for improvement (October 2026): www.fca.org.uk/publications/good-poor-practice/ai-financial-services
• Financial Conduct Authority, AI and the FCA: our approach: www.fca.org.uk/firms/innovation/ai-approach
• Bank of England, Prudential Regulation Authority, SS1/23 Model risk management principles for banks: www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss (see the note on scope in the first paragraph of the page, and ask your firm whether and how it applies to the tool you are using). The PRA's supervisory statement SS1/23 on model risk management applies to UK banks, building societies and PRA-designated investment firms with internal model approval. Whether and how it applies to a particular use of AI is for the firm to decide under its own model-risk policy, so ask your model-risk or compliance team whether and how it applies.

AI for BAs in Financial Services has 30 prompts, a review and audit checklist and an AI use log.

See AI for BAs in Financial Services