A risk gauge or dial, representing the three-tier risk sorting system

Sorting them into 3 tiers makes the review process fast instead of exhausting.

Tier 1: Low risk. Internal drafting only, first drafts and brainstorming, not the final product. No member data, no financial systems. A staff member using ChatGPT to rough out a newsletter would qualify, since a person still reviews and finalizes it before it goes anywhere. Approval: quick sign-off from a manager, logged in the registry, done.

Tier 2: Medium risk. Member-facing content, no personal data involved. Think social posts, email copy, website text. The output reaches the public, but no names or member records touch the tool. A branch coordinator drafting an Instagram caption sits here. Approval: a short review from marketing leadership before it goes live.

Tier 3: High risk. Anything touching member data, financial systems, or HR records. The newsletter story from post 1 belongs here, member names and complaint details pasted into a tool with no oversight. Approval: sign-off from IT and legal, not just a manager. This tier moves slower on purpose.

The tiers aren’t about slowing everyone down. Most requests land in tier 1, and a quick sign-off clears them the same day. The friction belongs where the risk actually sits.

Next post: how legal, IT, and marketing actually talk to each other before a tool gets approved, and what that conversation looks like in practice.