Page 399 - CyberSecurityEssentialsEnglish

8.12 Five Commitments and the Conclusion of the Book
Having moved through understanding AI, communicating with it, choosing its tools, using it
safely, building workflows, and applying it in education and research, we arrive at the

question of responsibility. Knowledge is not enough if it does not turn into practice, a policy
is not enough if it does not make good behavior possible, and productivity is not enough if
its price is the loss of trust, skill, or rights.

◆ Five practical commitments

• I use AI to increase understanding and productivity, not to conceal ignorance or
transfer responsibility.
• I protect people’s data and rights before I look for speed and reach.
• I ask for evidence proportionate to the impact of the decision, and I do not treat
convincing text as fact.
• I learn from the tools and redesign the work without losing judgment, skill, and the
human relationship.
• I make governance a means of trustworthy innovation, and I update it as the

technology and the context change.

The conclusion returns us to the case of the airline’s chatbot. The problem was not that an
organization used a digital tool, but that it did not keep its information consistent and could

not transfer responsibility to an automated interface. The wider lesson is that AI becomes
part of an organization when it enters its products, its messages, and its decisions. It must
therefore also enter the system of responsibility, learning, and improvement. A mature

organization is not the one that prevents every risk, nor the one that uses the newest model.
It is the one that knows why it uses it, measures what it delivers, understands who is
affected, has the courage to stop it or redesign it, and invests in the people who will carry

the responsibility. Technology changes quickly. The ability to ask the right question, gather
the evidence, respect the human being, and learn from error is the advantage that makes
change useful and sustainable.

▣ After the end of the book: the first thirty days
Week one: discover the actual uses.

Week two: choose one case and define its owner and its risks.
Week three: build a test, a short policy, and a register.
Week four: run a bounded pilot and measure time, quality, and risk, then take a
documented decision.
Do not start from procurement; start from capability.

“A mature organization is not the one that prevents every risk. It is the one that knows why

it uses a system, who is affected, and how to stop it.”

398