# AI at the CC Desk — Your Monday Cheat-Sheet

*PHINEO Workshop 2 · Smart Citizenship · take this with you*

> AI is a **lever** for social impact — this page is the **fulcrum**: the capability + guardrails that make you able to move it (**inward** on your own CC work, **outward** to nonprofits). AI advises; **you decide and you sign.**

**Where AI fits your CC chain:** partner research — *draft* · application scoring — *check* · CSRD/impact draft — *draft* · stakeholder comms — *draft* · grantee/funding decision — *you decide*
*draft & scan → human-in-the-loop → you decide (never delegate). CC stays the responsible-AI owner.*

---

## 1 · Which tool?

| If you… | Use | Why |
|---|---|---|
| …have Microsoft 365 at work | **Copilot** | Already paid for, inside your company data boundary — safest |
| …run on Google Workspace | **Gemini** | Same, inside your boundary |
| …need the strongest all-rounder | **ChatGPT / Claude** | Team/Enterprise tier only — never the free app for work data |
| …have Legal blocking everything | **Langdock** (DE) or **Mistral Le Chat** (FR) | EU-hosted, **GDPR-capable\*** — used by large German enterprises (Merck, BASF — vendor-stated, verify) |
| …need translation / polish | **DeepL / DeepL Write** (DE) | Easiest "yes" from Legal |
| …do ESG / CSRD or matchmaking | **Briink** (ESG/CSRD data), **SAP Joule** (if you run SAP) | CC-specific — pricing & maturity → Speaker 3 |

**Rule of thumb:** *Use what your company already pays for. If Legal is the blocker, the German answer is a hub like Langdock — same power, EU-hosted.*

> **\*GDPR-capable ≠ compliant out of the box:** it still needs a signed DPA + a DPIA, and staff-facing tools need Betriebsrat (works-council) sign-off. "EU-hosted" is the start, not the finish.

---

## 2 · Do / Don't

| Do | Don't |
|---|---|
| Use the approved tool | Paste confidential / personal / partner data into a free app |
| Treat every output as a **draft** | Trust names, numbers, legal claims unchecked |
| Give it role + audience + format | Assume it knows your context |
| Keep your signature on anything external | Send AI text to a stakeholder unread |
| **Own the decision** | Outsource judgment or accountability to the model |

---

## 3 · Pre-flight (before you type)
1. Approved tool for this data?
2. Stripping out anything confidential / personal?
3. Did I give it role + audience + format?
4. Did I paste the source material it needs?

## 4 · Post-flight (before you use it)
1. Facts, names, numbers, legal claims **verified**?
2. Any invented org / stat / source?
3. Sounds like **us**?
4. Nothing internal leaked?
5. Would I put my name on it? → send.

---

## 5 · 8 commands to steal

1. **Summarize a partner** — *"Here's a nonprofit's annual report. Give me: mission, who they serve, top 3 needs, red flags, 3 questions before partnering."*
2. **Score applications** — *"Here are 5 applications + our 4 criteria. Rank them, score each 1–5, flag the closest call."* → defensible first cut; **you still decide.**
3. **CSRD/ESG draft** — *"Turn these notes into 3 reportable impact paragraphs in CSRD language. Mark anything needing a real number."* → *illustrative payoff: a CSRD section ~3h → ~40 min — but the AI may invent a figure, so **verify every number** and measure your own baseline.*
4. **CFO business case** — *"Rewrite this as 5 bullets for a cost-focused CFO, each tied to ESG reporting, employer brand, or risk."*
5. **Rehearse your boss** — *"Act as my skeptical CFO. Give the 5 objections you'd raise, then help me pre-answer them."* → swap in your **General Counsel** or **CEO** to rehearse the room you actually fear.
6. **Stakeholder reply** — *"Draft a reply to this investor/rating-agency question in our cautious house tone. Flag anything I shouldn't commit to in writing."*
7. **Your AI position** — *"Draft a cautious one-paragraph internal line on how our CC function uses AI, aligned to the EU AI Act, in a German Mittelstand voice."*
   → **Starter to adapt:** *"Our CC function uses AI as an assistant, not a decision-maker — to draft and research faster, always with a named human reviewing and signing off, inside approved EU-hosted tools, in line with the EU AI Act. We don't use it for decisions about people or partners without human judgment."* **Who signs it:** align with Legal/IT — the final line isn't CC's alone to set.
8. **Scope before you build** — *"A partner says 'we want AI.' Ask me 5 questions to turn that into one bounded problem — and name the condition to say no."*

---

## 6 · Pitch it internally (get the tool approved)

> *"The **EU AI Act**'s staff AI-literacy duty (Art. 4) has applied since **Feb 2025** — we're likely non-compliant now — and the Act's penalty regime lands **Aug 2026**. Meanwhile people already paste company data into private ChatGPT. I propose an **8-week pilot**: [N] licenses of [Copilot / Langdock] for the CC team, measured on [hours saved on CSRD reporting]. ~€25/user/month. Owner: me."*
> <sub>sources: artificialintelligenceact.eu (Art. 4) · zew.de (shadow-AI)</sub>

---

## 7 · Point it outward — the social-impact lever

*Your company's AI capability, channeled to nonprofits. Don't build from scratch — these already run it.*

**Program in 5 steps (Breakout 1 Track A builds it out):** scope the problem → match a partner (below) → pilot-scope (days + liability boundary) → guardrail & Legal sign-off → measure as CSRD S3/S4.

- **Channel AI skills to an NGO:** MI4People (KIISS) · N3XTCODER (AI for Impact) · CorrelAid (Data4Good)
- **Find / match a partner:** Civic Coding-Accelerator · CorrelAid
- **Discounted tools for nonprofits:** Microsoft for Nonprofits (Copilot −15%) · Salesforce Agents for Impact (pro-bono)
- **Free upskilling (team / NGO):** KI-Campus · DRK Lernplattform · vhs.cloud
- **EU AI Act help:** ARIC Hamburg

---

*Sources: artificialintelligenceact.eu · zew.de · langdock.com — verify before quoting externally.*
