[{"data":1,"prerenderedAt":1853},["ShallowReactive",2],{"article-\u002Farticles\u002Fseisei-ai-shanai-rule-sample":3,"article-series-m365-copilot":1813},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"updated":10,"category":11,"series":12,"seriesNo":13,"seriesLabel":14,"author":15,"thumbnail":16,"tags":17,"faq":22,"body":38,"_type":1807,"_id":1808,"_source":1809,"_file":1810,"_stem":1811,"_extension":1812},"\u002Farticles\u002Fseisei-ai-shanai-rule-sample","articles",false,"","生成AIの社内ルールの作り方【サンプル条文付き】｜Microsoft 365 Copilot時代の利用ガイドライン","生成AIの社内ルール（利用ガイドライン）を、萎縮も暴走もさせない形で作る方法を解説します。入力してよい情報を機密区分と紐づける表、承認済みAIサービスのリスト管理、個人アカウント利用の禁止、申請・審査フロー、そのまま使えるサンプル条文までまとめました。","2026-10-14","M365 Copilot導入","m365-copilot",5,"第5回（前編）","K.S.ロジャース株式会社","\u002Fimg\u002Fcontents\u002Fnews\u002Fthumb123.jpg",[18,19,20,21],"Microsoft 365 Copilot","生成AI ガイドライン","AIガバナンス","社内規程",[23,26,29,32,35],{"q":24,"a":25},"生成AIの社内ルールには何を書けばよいですか？","最低限、目的と適用範囲、使ってよいAIサービス（承認済みリスト）、入力してよい情報の範囲（機密区分との対応）、出力の確認と責任、個人アカウントでの業務利用の禁止、新しいAIを使うときの申請・審査、教育、違反時の対応、見直しの時期を書きます。禁止事項だけを並べると現場が萎縮するため、「この条件なら使ってよい」を先に示すのがポイントです。",{"q":27,"a":28},"中小企業でも生成AIのガイドラインは必要ですか？","必要です。ルールがない状態では、社員が個人のスマホや個人アカウントで無料のAIに業務情報を入れてしまう「シャドーAI」が起きやすく、規模が小さいほど1件の漏えいの影響が大きくなります。A4で数枚のひな形から始め、運用しながら直していく形で十分です。",{"q":30,"a":31},"社内ルールに使えるAIサービス名を直接書いてもよいですか？","条文にサービス名を直接書くのはおすすめしません。AIサービスは名称や仕様が短期間で変わるため、条文では「会社が承認したAIサービス」と定義し、具体的なサービス名と利用条件は別表の承認済みリストで管理します。リストの更新だけで済むため、規程改定の手間がかかりません。",{"q":33,"a":34},"公的な生成AIガイドラインで参考になるものはありますか？","総務省・経済産業省の「AI事業者ガイドライン」が代表的です。2026年3月31日に第1.2版が公表されており、AIを業務で使う事業者は「AI利用者」として位置づけられています。社内ルールのひな形としては、日本ディープラーニング協会（JDLA）の「生成AIの利用ガイドライン」も参考になります。",{"q":36,"a":37},"社内ルールはどれくらいの頻度で見直すべきですか？","年1回以上の定期見直しに加え、利用しているAIサービスの規約や仕様が変わったとき、新しいサービスを承認したとき、事故やヒヤリハットが起きたときに随時見直します。見直し日を承認済みリストに記録しておくと、期限切れに気づきやすくなります。",{"type":39,"children":40,"toc":1793},"root",[41,60,65,76,97,110,174,181,193,198,216,228,233,238,262,434,439,445,457,473,616,621,639,649,674,693,705,711,723,728,841,846,852,864,878,883,923,935,941,946,962,1006,1011,1096,1101,1117,1122,1128,1133,1137,1145,1155,1165,1188,1198,1208,1216,1234,1242,1265,1273,1296,1306,1334,1342,1360,1368,1381,1391,1401,1411,1421,1431,1441,1451,1454,1468,1473,1478,1493,1498,1503,1550,1562,1568,1573,1643,1655,1661,1666,1689,1702,1715,1720,1769],{"type":42,"tag":43,"props":44,"children":45},"element","p",{},[46,49,58],{"type":47,"value":48},"text","※ Microsoft 365 Copilot は、2026年8月から「Microsoft Copilot」に名称が変わりました（Copilot Chat は「Microsoft Copilot Chat」）。移行期間中は旧名称も併用されているため、本記事では広く使われている「Microsoft 365 Copilot」の表記で統一しています（出典：",{"type":42,"tag":50,"props":51,"children":55},"a",{"href":52,"rel":53},"https:\u002F\u002Flearn.microsoft.com\u002Fja-jp\u002Fcopilot\u002Fmicrosoft-365\u002Fmicrosoft-365-copilot-privacy",[54],"nofollow",[56],{"type":47,"value":57},"Microsoft Learn「Microsoft Copilot のデータ、プライバシー、セキュリティ」",{"type":47,"value":59},"）。",{"type":42,"tag":43,"props":61,"children":62},{},[63],{"type":47,"value":64},"「生成AIを使っていいのか、社員から聞かれるが答えられない」「とりあえず禁止にしているが、裏で個人のスマホから使われている気がする」——Microsoft 365 Copilot の導入を検討している会社から、必ずと言ってよいほど出てくる悩みです。",{"type":42,"tag":43,"props":66,"children":67},{},[68,74],{"type":42,"tag":50,"props":69,"children":71},{"href":70},"\u002Farticles\u002Fm365-copilot-donyu-roadmap\u002F",[72],{"type":47,"value":73},"第1回：非IT企業のMicrosoft 365 Copilot導入ロードマップ",{"type":47,"value":75},"では、導入の失敗パターンの3つ目として「ルールがなく、現場が萎縮するか暴走するかの二択になる」を挙げました。何を入れてよいか分からないから使わない、あるいは何でも入れてしまう。どちらもルール不在の症状です。",{"type":42,"tag":43,"props":77,"children":78},{},[79,81,87,89,95],{"type":47,"value":80},"本記事はシリーズ第5回（前編）として、この「生成AIの社内ルール（利用ガイドライン）」の作り方を扱います。入力してよい情報を機密区分と紐づける方法、承認済みAIサービスのリスト管理、個人アカウント利用の禁止、申請・審査フローを整理し、最後に",{"type":42,"tag":82,"props":83,"children":84},"strong",{},[85],{"type":47,"value":86},"そのまま使えるサンプル条文",{"type":47,"value":88},"を載せます。すでにある社内規則が Copilot を止めてしまっている場合の読み合わせ方は、",{"type":42,"tag":50,"props":90,"children":92},{"href":91},"\u002Farticles\u002Fcopilot-shanai-kitei-edp\u002F",[93],{"type":47,"value":94},"特別編：その社内規則、Microsoft 365 Copilotを禁止していますか？",{"type":47,"value":96},"で解説しています。",{"type":42,"tag":43,"props":98,"children":99},{},[100,102,108],{"type":47,"value":101},"本記事（前編）は、全社員が文章の作成や調べものに生成AIを使う場面を対象にしています。システム開発を外注していて、開発会社が自社のソースコードや仕様書を AI ツールに読ませる場面のルールは、",{"type":42,"tag":50,"props":103,"children":105},{"href":104},"\u002Farticles\u002Fkaihatsu-gaichu-ai-riyou-rule\u002F",[106],{"type":47,"value":107},"後編：システム開発を外注するときのAI利用ルール",{"type":47,"value":109},"で扱います。",{"type":42,"tag":111,"props":112,"children":113},"blockquote",{},[114,122],{"type":42,"tag":43,"props":115,"children":116},{},[117],{"type":42,"tag":82,"props":118,"children":119},{},[120],{"type":47,"value":121},"この記事の要点",{"type":42,"tag":123,"props":124,"children":125},"ul",{},[126,139,164,169],{"type":42,"tag":127,"props":128,"children":129},"li",{},[130,132,137],{"type":47,"value":131},"生成AIの社内ルールは「禁止リスト」ではなく、",{"type":42,"tag":82,"props":133,"children":134},{},[135],{"type":47,"value":136},"使ってよい条件",{"type":47,"value":138},"を決めるものです。条件を先に示すと萎縮が減り、線引きと手続きが暴走を防ぎます",{"type":42,"tag":127,"props":140,"children":141},{},[142,144,149,151,156,157,162],{"type":47,"value":143},"中核は3つです。",{"type":42,"tag":82,"props":145,"children":146},{},[147],{"type":47,"value":148},"承認済みAIサービスのリスト",{"type":47,"value":150},"、",{"type":42,"tag":82,"props":152,"children":153},{},[154],{"type":47,"value":155},"機密区分ごとの入力可否",{"type":47,"value":150},{"type":42,"tag":82,"props":158,"children":159},{},[160],{"type":47,"value":161},"出力は人が確認して利用者が責任を持つ",{"type":47,"value":163},"こと",{"type":42,"tag":127,"props":165,"children":166},{},[167],{"type":47,"value":168},"サービス名は条文に書かず別表のリストで管理し、個人アカウントでの業務利用を禁止し、申請・審査フローと年1回以上の見直しをセットにします",{"type":42,"tag":127,"props":170,"children":171},{},[172],{"type":47,"value":173},"当社の支援先では、プロンプトをそのままクラウドの AI に送れない会社や、AI に取り込みたい資料の利用規約で AI の学習への利用が禁じられていた例がありました。入力の前の確認と、取り込む資料の規約の確認もルールに組み込みます",{"type":42,"tag":175,"props":176,"children":178},"h2",{"id":177},"生成aiの社内ルールとは-禁止ではなく使ってよい条件を決めるもの",[179],{"type":47,"value":180},"生成AIの社内ルールとは ― 禁止ではなく「使ってよい条件」を決めるもの",{"type":42,"tag":43,"props":182,"children":183},{},[184,186,191],{"type":47,"value":185},"生成AIの社内ルールとは、",{"type":42,"tag":82,"props":187,"children":188},{},[189],{"type":47,"value":190},"社員が業務で生成AIを使うときに、どのサービスに、どの情報を入れて、出てきた結果をどう扱うかを定めた社内の決まり",{"type":47,"value":192},"です。「生成AI利用ガイドライン」「AI利用規程」「生成AI利用要領」など、会社によって呼び方は違います。",{"type":42,"tag":43,"props":194,"children":195},{},[196],{"type":47,"value":197},"ルール作りでよくある失敗は、懸念を並べて禁止事項だけのルールにしてしまうことです。",{"type":42,"tag":123,"props":199,"children":200},{},[201,206,211],{"type":42,"tag":127,"props":202,"children":203},{},[204],{"type":47,"value":205},"「機密情報を入力してはならない」とだけ書く → 何が機密か分からず、誰も使わなくなる",{"type":42,"tag":127,"props":207,"children":208},{},[209],{"type":47,"value":210},"「会社が認めたもの以外は使用禁止」とだけ書く → 何が認められているのか分からず、結局個人のスマホで使う",{"type":42,"tag":127,"props":212,"children":213},{},[214],{"type":47,"value":215},"「利用は自己責任とする」と書く → 判断を現場に丸投げし、事故が起きたときに誰も説明できない",{"type":42,"tag":43,"props":217,"children":218},{},[219,221,226],{"type":47,"value":220},"ルールの目的は、AIを止めることではなく",{"type":42,"tag":82,"props":222,"children":223},{},[224],{"type":47,"value":225},"安全に使える範囲をはっきりさせること",{"type":47,"value":227},"です。そのため、まず「この条件なら使ってよい」を明示し、そのうえで線引き（入れてはいけない情報）と手続き（新しいサービスを使うとき）を決める、という順番で組み立てます。",{"type":42,"tag":175,"props":229,"children":231},{"id":230},"萎縮も暴走もさせないガイドラインの構成",[232],{"type":47,"value":230},{"type":42,"tag":43,"props":234,"children":235},{},[236],{"type":47,"value":237},"社内ルールに入れる項目は、次の3層に整理すると抜け漏れが出にくくなります。",{"type":42,"tag":239,"props":240,"children":241},"picture",{},[242,244,252,253],{"type":47,"value":243},"\n  ",{"type":42,"tag":245,"props":246,"children":251},"source",{"media":247,"srcSet":248,"width":249,"height":250},"(max-width: 768px)","\u002Fimg\u002Fcontents\u002Farticles\u002Fseisei-ai-shanai-rule-sample\u002Fguideline-kosei-sp.svg",420,848,[],{"type":47,"value":243},{"type":42,"tag":254,"props":255,"children":261},"img",{"src":256,"alt":257,"width":258,"height":259,"loading":260},"\u002Fimg\u002Fcontents\u002Farticles\u002Fseisei-ai-shanai-rule-sample\u002Fguideline-kosei.svg","生成AIの社内ルールの構成：土台（目的と適用範囲・推進責任者）、中核（使ってよいAI・入れてよい情報・出力の扱い）、運用（申請・審査・教育・見直し）の3層",800,466,"lazy",[],{"type":42,"tag":263,"props":264,"children":265},"table",{},[266,290],{"type":42,"tag":267,"props":268,"children":269},"thead",{},[270],{"type":42,"tag":271,"props":272,"children":273},"tr",{},[274,280,285],{"type":42,"tag":275,"props":276,"children":277},"th",{},[278],{"type":47,"value":279},"層",{"type":42,"tag":275,"props":281,"children":282},{},[283],{"type":47,"value":284},"項目",{"type":42,"tag":275,"props":286,"children":287},{},[288],{"type":47,"value":289},"決めること",{"type":42,"tag":291,"props":292,"children":293},"tbody",{},[294,313,330,348,365,382,400,417],{"type":42,"tag":271,"props":295,"children":296},{},[297,303,308],{"type":42,"tag":298,"props":299,"children":300},"td",{},[301],{"type":47,"value":302},"土台",{"type":42,"tag":298,"props":304,"children":305},{},[306],{"type":47,"value":307},"目的と適用範囲",{"type":42,"tag":298,"props":309,"children":310},{},[311],{"type":47,"value":312},"何のためのルールか。社員だけでなく派遣社員・委託先も対象にするか",{"type":42,"tag":271,"props":314,"children":315},{},[316,320,325],{"type":42,"tag":298,"props":317,"children":318},{},[319],{"type":47,"value":302},{"type":42,"tag":298,"props":321,"children":322},{},[323],{"type":47,"value":324},"推進責任者",{"type":42,"tag":298,"props":326,"children":327},{},[328],{"type":47,"value":329},"判断に迷ったときに誰が決めるか。例外の承認者",{"type":42,"tag":271,"props":331,"children":332},{},[333,338,343],{"type":42,"tag":298,"props":334,"children":335},{},[336],{"type":47,"value":337},"中核",{"type":42,"tag":298,"props":339,"children":340},{},[341],{"type":47,"value":342},"使ってよいAI",{"type":42,"tag":298,"props":344,"children":345},{},[346],{"type":47,"value":347},"承認済みAIサービスのリストと、その管理方法",{"type":42,"tag":271,"props":349,"children":350},{},[351,355,360],{"type":42,"tag":298,"props":352,"children":353},{},[354],{"type":47,"value":337},{"type":42,"tag":298,"props":356,"children":357},{},[358],{"type":47,"value":359},"入れてよい情報",{"type":42,"tag":298,"props":361,"children":362},{},[363],{"type":47,"value":364},"機密区分ごとに、どのAIに入力してよいか",{"type":42,"tag":271,"props":366,"children":367},{},[368,372,377],{"type":42,"tag":298,"props":369,"children":370},{},[371],{"type":47,"value":337},{"type":42,"tag":298,"props":373,"children":374},{},[375],{"type":47,"value":376},"出力の扱い",{"type":42,"tag":298,"props":378,"children":379},{},[380],{"type":47,"value":381},"事実確認、著作権・個人情報への配慮、最終責任は利用者",{"type":42,"tag":271,"props":383,"children":384},{},[385,390,395],{"type":42,"tag":298,"props":386,"children":387},{},[388],{"type":47,"value":389},"運用",{"type":42,"tag":298,"props":391,"children":392},{},[393],{"type":47,"value":394},"申請・審査",{"type":42,"tag":298,"props":396,"children":397},{},[398],{"type":47,"value":399},"リストにないAIを使いたいときの手続き",{"type":42,"tag":271,"props":401,"children":402},{},[403,407,412],{"type":42,"tag":298,"props":404,"children":405},{},[406],{"type":47,"value":389},{"type":42,"tag":298,"props":408,"children":409},{},[410],{"type":47,"value":411},"教育・周知",{"type":42,"tag":298,"props":413,"children":414},{},[415],{"type":47,"value":416},"研修や確認テストを利用開始の条件にするか",{"type":42,"tag":271,"props":418,"children":419},{},[420,424,429],{"type":42,"tag":298,"props":421,"children":422},{},[423],{"type":47,"value":389},{"type":42,"tag":298,"props":425,"children":426},{},[427],{"type":47,"value":428},"見直し",{"type":42,"tag":298,"props":430,"children":431},{},[432],{"type":47,"value":433},"監査ログの確認、年1回以上の改定",{"type":42,"tag":43,"props":435,"children":436},{},[437],{"type":47,"value":438},"分量はA4で3〜5枚が目安です。細かい操作手順まで規程に書き込むと改定が追いつかなくなるため、手順は別のマニュアルやFAQに切り出します。",{"type":42,"tag":175,"props":440,"children":442},{"id":441},"入力してよい情報いけない情報を機密区分と紐づける",[443],{"type":47,"value":444},"入力してよい情報・いけない情報を機密区分と紐づける",{"type":42,"tag":43,"props":446,"children":447},{},[448,450,455],{"type":47,"value":449},"ルールの中で最も判断に迷うのが「どの情報を入れてよいか」です。ここは新しい基準を作るのではなく、",{"type":42,"tag":82,"props":451,"children":452},{},[453],{"type":47,"value":454},"すでに社内にある情報の機密区分",{"type":47,"value":456},"（情報管理規程や情報セキュリティ規程で定めている「極秘・秘・社外秘・公開」など）に紐づけるのが実務的です。社員は区分を見れば判断でき、情報管理規程と矛盾もしません。",{"type":42,"tag":239,"props":458,"children":459},{},[460,461,466,467],{"type":47,"value":243},{"type":42,"tag":245,"props":462,"children":465},{"media":247,"srcSet":463,"width":249,"height":464},"\u002Fimg\u002Fcontents\u002Farticles\u002Fseisei-ai-shanai-rule-sample\u002Fkimitsu-kubun-sp.svg",960,[],{"type":47,"value":243},{"type":42,"tag":254,"props":468,"children":472},{"src":469,"alt":470,"width":258,"height":471,"loading":260},"\u002Fimg\u002Fcontents\u002Farticles\u002Fseisei-ai-shanai-rule-sample\u002Fkimitsu-kubun.svg","機密区分ごとの生成AIへの入力可否：公開と社外秘は社内データ連携型の承認済みAIに入力可、秘は権限の整備後に指定業務のみ、極秘は原則不可。未承認AIと個人アカウントは業務利用しない",482,[],{"type":42,"tag":263,"props":474,"children":475},{},[476,507],{"type":42,"tag":267,"props":477,"children":478},{},[479],{"type":42,"tag":271,"props":480,"children":481},{},[482,487,492,497,502],{"type":42,"tag":275,"props":483,"children":484},{},[485],{"type":47,"value":486},"機密区分",{"type":42,"tag":275,"props":488,"children":489},{},[490],{"type":47,"value":491},"情報の例",{"type":42,"tag":275,"props":493,"children":494},{},[495],{"type":47,"value":496},"承認済み・社内データ連携型（例：Microsoft 365 Copilot）",{"type":42,"tag":275,"props":498,"children":499},{},[500],{"type":47,"value":501},"承認済み・その他のAI",{"type":42,"tag":275,"props":503,"children":504},{},[505],{"type":47,"value":506},"未承認AI・個人アカウント",{"type":42,"tag":291,"props":508,"children":509},{},[510,537,563,590],{"type":42,"tag":271,"props":511,"children":512},{},[513,518,523,528,532],{"type":42,"tag":298,"props":514,"children":515},{},[516],{"type":47,"value":517},"公開",{"type":42,"tag":298,"props":519,"children":520},{},[521],{"type":47,"value":522},"公開済みのWeb情報、カタログ",{"type":42,"tag":298,"props":524,"children":525},{},[526],{"type":47,"value":527},"入力してよい",{"type":42,"tag":298,"props":529,"children":530},{},[531],{"type":47,"value":527},{"type":42,"tag":298,"props":533,"children":534},{},[535],{"type":47,"value":536},"業務利用しない",{"type":42,"tag":271,"props":538,"children":539},{},[540,545,550,554,559],{"type":42,"tag":298,"props":541,"children":542},{},[543],{"type":47,"value":544},"社外秘",{"type":42,"tag":298,"props":546,"children":547},{},[548],{"type":47,"value":549},"社内規程、議事録、社内向け資料",{"type":42,"tag":298,"props":551,"children":552},{},[553],{"type":47,"value":527},{"type":42,"tag":298,"props":555,"children":556},{},[557],{"type":47,"value":558},"承認済みリストの条件による",{"type":42,"tag":298,"props":560,"children":561},{},[562],{"type":47,"value":536},{"type":42,"tag":271,"props":564,"children":565},{},[566,571,576,581,586],{"type":42,"tag":298,"props":567,"children":568},{},[569],{"type":47,"value":570},"秘",{"type":42,"tag":298,"props":572,"children":573},{},[574],{"type":47,"value":575},"顧客情報、見積・原価、個人の人事情報",{"type":42,"tag":298,"props":577,"children":578},{},[579],{"type":47,"value":580},"権限の整備後、指定した業務のみ",{"type":42,"tag":298,"props":582,"children":583},{},[584],{"type":47,"value":585},"入力しない",{"type":42,"tag":298,"props":587,"children":588},{},[589],{"type":47,"value":536},{"type":42,"tag":271,"props":591,"children":592},{},[593,598,603,608,612],{"type":42,"tag":298,"props":594,"children":595},{},[596],{"type":47,"value":597},"極秘",{"type":42,"tag":298,"props":599,"children":600},{},[601],{"type":47,"value":602},"未公表の経営情報、マイナンバー等",{"type":42,"tag":298,"props":604,"children":605},{},[606],{"type":47,"value":607},"原則入力しない（個別承認のみ）",{"type":42,"tag":298,"props":609,"children":610},{},[611],{"type":47,"value":585},{"type":42,"tag":298,"props":613,"children":614},{},[615],{"type":47,"value":536},{"type":42,"tag":43,"props":617,"children":618},{},[619],{"type":47,"value":620},"この表は一例です。区分の名前や数は自社の規程に合わせてください。ポイントは4つあります。",{"type":42,"tag":43,"props":622,"children":623},{},[624,629,631,637],{"type":42,"tag":82,"props":625,"children":626},{},[627],{"type":47,"value":628},"1. AIの種類で列を分ける。",{"type":47,"value":630}," 同じ「生成AI」でも、入力データの扱いはサービスと契約によってまったく違います。Microsoft 365 Copilot では、プロンプト・応答・Microsoft Graph 経由でアクセスしたデータは基盤モデルの学習に使われず、Microsoft 365 の他のコンテンツと同じ契約上の取り決めの下で処理・保存されます（出典：",{"type":42,"tag":50,"props":632,"children":634},{"href":52,"rel":633},[54],[635],{"type":47,"value":636},"Microsoft Copilot のデータ、プライバシー、セキュリティ｜Microsoft Learn",{"type":47,"value":638},"）。こうした条件を確認できたサービスと、確認できていないサービスを同じ扱いにする理由はありません。",{"type":42,"tag":43,"props":640,"children":641},{},[642,647],{"type":42,"tag":82,"props":643,"children":644},{},[645],{"type":47,"value":646},"2. 「秘」は条件付きにする。",{"type":47,"value":648}," Copilot は、ユーザーが少なくとも閲覧権限を持つデータしか表示しません。裏返すと、SharePoint の共有設定が緩いままだと、見えてはいけない資料が回答に出てきます。顧客情報や人事情報を扱う業務に広げるのは、権限の棚卸しと機密区分の設定が済んでからにします。",{"type":42,"tag":43,"props":650,"children":651},{},[652,657,659,664,666,672],{"type":42,"tag":82,"props":653,"children":654},{},[655],{"type":47,"value":656},"3. システム上は「置き場所」で区分を守る。",{"type":47,"value":658}," 規程に書いた区分を、システムの上でも守る仕組みが必要です。一般的な中小企業なら、「秘」「極秘」に当たる情報は、",{"type":42,"tag":82,"props":660,"children":661},{},[662],{"type":47,"value":663},"メンバーを限定した専用の SharePoint サイトやチームに置く",{"type":47,"value":665},"のが簡単で確実です。Copilot は質問した本人が閲覧できる情報しか使わないため、置き場所で見られる人を絞れば、それ以外の社員の回答には出てきません。業界の規制や取引先の要求で、ファイル1つ1つに区分を付けて管理する必要がある会社は、Microsoft Purview の秘密度ラベルを使います。どちらが必要かの判断は、",{"type":42,"tag":50,"props":667,"children":669},{"href":668},"\u002Farticles\u002Fcopilot-security-settei-chusho\u002F",[670],{"type":47,"value":671},"第4回（前編）：中小企業に秘密度ラベルとDLPは必要か",{"type":47,"value":673},"で整理しています。",{"type":42,"tag":43,"props":675,"children":676},{},[677,682,684,691],{"type":42,"tag":82,"props":678,"children":679},{},[680],{"type":47,"value":681},"4. 規制や契約で「クラウド不可」の情報を分けておく。",{"type":47,"value":683}," 防衛・原子力・輸出管理の対象になる技術情報などは、AI の学習に使われるかどうかとは別に、法令や業界の基準、発注元との契約によって、クラウドの AI（Microsoft 365 Copilot を含む）の利用そのものが制限されることがあります。ここで問題になるのは、データがどこの国で処理され、誰の管理下に置かれるかです。たとえば Microsoft は、Copilot のやりとりを日本国内で処理するしくみ（国内での推論）の提供を2028年と案内しています（出典：",{"type":42,"tag":50,"props":685,"children":688},{"href":686,"rel":687},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fcopilot\u002Fblog\u002F2025\u002F11\u002F04\u002Fmicrosoft-offers-in-country-data-processing-to-15-countries-to-strengthen-sovereign-controls-for-microsoft-365-copilot\u002F",[54],[689],{"type":47,"value":690},"Microsoft 365 Blog「Microsoft offers in-country data processing to 15 countries to strengthen sovereign controls for Microsoft 365 Copilot」",{"type":47,"value":692},"）。こうした情報を扱う会社は、機密区分とは別に「クラウド不可」の区分を表に加え、扱い方を輸出管理や情報セキュリティの担当部門と決めておきます。",{"type":42,"tag":43,"props":694,"children":695},{},[696,698,703],{"type":47,"value":697},"なお、Microsoft 365 Copilot と Copilot Chat は、2026年に Microsoft Learn 上でそれぞれ「Microsoft Copilot」「Microsoft Copilot Chat」への名称変更が案内されています。移行期間中は旧名称も併用されるため、社内ルールや承認済みリストには",{"type":42,"tag":82,"props":699,"children":700},{},[701],{"type":47,"value":702},"契約上のライセンス名と画面上の表示名を併記",{"type":47,"value":704},"しておくと混乱を防げます。",{"type":42,"tag":175,"props":706,"children":708},{"id":707},"承認済みaiサービスのリスト管理",[709],{"type":47,"value":710},"承認済みAIサービスのリスト管理",{"type":42,"tag":43,"props":712,"children":713},{},[714,716,721],{"type":47,"value":715},"「会社が認めたAIだけを使う」と決めたら、",{"type":42,"tag":82,"props":717,"children":718},{},[719],{"type":47,"value":720},"認めたAIの一覧",{"type":47,"value":722},"を社員がいつでも見られる場所に置きます。条文にサービス名を直接書くと、名称変更や新サービスのたびに規程改定が必要になるため、条文では「会社が承認したAIサービス」とだけ定義し、具体名は別表で管理します。",{"type":42,"tag":43,"props":724,"children":725},{},[726],{"type":47,"value":727},"承認済みリストには、最低限次の列を持たせます。",{"type":42,"tag":263,"props":729,"children":730},{},[731,747],{"type":42,"tag":267,"props":732,"children":733},{},[734],{"type":42,"tag":271,"props":735,"children":736},{},[737,742],{"type":42,"tag":275,"props":738,"children":739},{},[740],{"type":47,"value":741},"列",{"type":42,"tag":275,"props":743,"children":744},{},[745],{"type":47,"value":746},"記入例",{"type":42,"tag":291,"props":748,"children":749},{},[750,763,776,789,802,815,828],{"type":42,"tag":271,"props":751,"children":752},{},[753,758],{"type":42,"tag":298,"props":754,"children":755},{},[756],{"type":47,"value":757},"サービス名（契約名／表示名）",{"type":42,"tag":298,"props":759,"children":760},{},[761],{"type":47,"value":762},"Microsoft 365 Copilot（画面上の表示：Microsoft Copilot）",{"type":42,"tag":271,"props":764,"children":765},{},[766,771],{"type":42,"tag":298,"props":767,"children":768},{},[769],{"type":47,"value":770},"利用できる人",{"type":42,"tag":298,"props":772,"children":773},{},[774],{"type":47,"value":775},"ライセンスを割り当てた部門のみ",{"type":42,"tag":271,"props":777,"children":778},{},[779,784],{"type":42,"tag":298,"props":780,"children":781},{},[782],{"type":47,"value":783},"サインインに使うアカウント",{"type":42,"tag":298,"props":785,"children":786},{},[787],{"type":47,"value":788},"会社の Microsoft 365 アカウント（職場アカウント）",{"type":42,"tag":271,"props":790,"children":791},{},[792,797],{"type":42,"tag":298,"props":793,"children":794},{},[795],{"type":47,"value":796},"入力してよい機密区分の上限",{"type":42,"tag":298,"props":798,"children":799},{},[800],{"type":47,"value":801},"社外秘まで（秘は指定業務のみ）",{"type":42,"tag":271,"props":803,"children":804},{},[805,810],{"type":42,"tag":298,"props":806,"children":807},{},[808],{"type":47,"value":809},"主な利用目的",{"type":42,"tag":298,"props":811,"children":812},{},[813],{"type":47,"value":814},"議事録要約、文書の下書き、社内資料の検索",{"type":42,"tag":271,"props":816,"children":817},{},[818,823],{"type":42,"tag":298,"props":819,"children":820},{},[821],{"type":47,"value":822},"利用上の注意",{"type":42,"tag":298,"props":824,"children":825},{},[826],{"type":47,"value":827},"顧客に出す文書は必ず担当者が事実確認する",{"type":42,"tag":271,"props":829,"children":830},{},[831,836],{"type":42,"tag":298,"props":832,"children":833},{},[834],{"type":47,"value":835},"承認日／次回見直し日",{"type":42,"tag":298,"props":837,"children":838},{},[839],{"type":47,"value":840},"2026-11-01／2027-10-31",{"type":42,"tag":43,"props":842,"children":843},{},[844],{"type":47,"value":845},"全社員が使える Copilot Chat（職場アカウントでサインインしたもの）と、有償の Microsoft 365 Copilot を別の行にしておくと、第1回で紹介した「二層構成」との対応も分かりやすくなります。",{"type":42,"tag":175,"props":847,"children":849},{"id":848},"個人アカウントでの業務利用を禁止する-ルールと技術の両輪",[850],{"type":47,"value":851},"個人アカウントでの業務利用を禁止する ― ルールと技術の両輪",{"type":42,"tag":43,"props":853,"children":854},{},[855,857,862],{"type":47,"value":856},"社内ルールで必ず明記したいのが、",{"type":42,"tag":82,"props":858,"children":859},{},[860],{"type":47,"value":861},"個人アカウントでのAIの業務利用の禁止",{"type":47,"value":863},"です。同じ「Copilot」という名前でも、職場アカウントでサインインした場合と、個人の Microsoft アカウントでサインインした場合とでは、適用されるデータ保護がまったく違います。",{"type":42,"tag":43,"props":865,"children":866},{},[867,869,876],{"type":47,"value":868},"Microsoft Learn では、職場・学校向けの Copilot は Microsoft Entra アカウント（会社のアカウント）でサインインして使い、個人向けの Microsoft Copilot は個人の Microsoft アカウントで使うものとして、入口が分けて案内されています（出典：",{"type":42,"tag":50,"props":870,"children":873},{"href":871,"rel":872},"https:\u002F\u002Flearn.microsoft.com\u002Fja-jp\u002Fcopilot\u002Fmanage",[54],[874],{"type":47,"value":875},"Microsoft 365 Copilot Chat の管理｜Microsoft Learn",{"type":47,"value":877},"）。社員から見ると画面が似ているため、「会社でも家でも同じ Copilot を使っている」と誤解しやすい点に注意が必要です。",{"type":42,"tag":43,"props":879,"children":880},{},[881],{"type":47,"value":882},"ルールだけでは防ぎきれないため、技術的な対策も組み合わせます。",{"type":42,"tag":123,"props":884,"children":885},{},[886,905],{"type":42,"tag":127,"props":887,"children":888},{},[889,894,896,903],{"type":42,"tag":82,"props":890,"children":891},{},[892],{"type":47,"value":893},"テナント制限 v2",{"type":47,"value":895}," ―― 会社が管理するネットワークやデバイスから、個人の Microsoft アカウントなど外部アカウントでのサインインを制限できます。Microsoft Learn でも、個人アカウントでの Microsoft 365 アプリへのサインインを管理する手段として案内されています。利用には Microsoft Entra ID P1 または P2 が必要です（出典：",{"type":42,"tag":50,"props":897,"children":900},{"href":898,"rel":899},"https:\u002F\u002Flearn.microsoft.com\u002Fja-jp\u002Fentra\u002Fexternal-id\u002Ftenant-restrictions-v2",[54],[901],{"type":47,"value":902},"テナント制限の構成｜Microsoft Learn",{"type":47,"value":904},"）",{"type":42,"tag":127,"props":906,"children":907},{},[908,913,915,922],{"type":42,"tag":82,"props":909,"children":910},{},[911],{"type":47,"value":912},"エンドポイントのデータ損失防止（DLP）",{"type":47,"value":914}," ―― Microsoft Purview にオンボードした Windows PC では、ブラウザーでアクセスするサードパーティの生成AIサイトへの機密情報の貼り付けを、警告またはブロックするポリシーを構成できます（出典：",{"type":42,"tag":50,"props":916,"children":919},{"href":917,"rel":918},"https:\u002F\u002Flearn.microsoft.com\u002Fja-jp\u002Fpurview\u002Fai-microsoft-purview",[54],[920],{"type":47,"value":921},"Microsoft Purview データセキュリティとコンプライアンス保護｜Microsoft Learn",{"type":47,"value":904},{"type":42,"tag":43,"props":924,"children":925},{},[926,928,933],{"type":47,"value":927},"どちらもライセンスや端末管理の前提があり、すべての会社がすぐに導入できるものではありません。まずはルールで禁止を明記し、全社に「使ってよい代わり」として",{"type":42,"tag":82,"props":929,"children":930},{},[931],{"type":47,"value":932},"保護付きの Copilot Chat",{"type":47,"value":934}," を用意することが、シャドーAI対策としては最も効きます。禁止だけして代わりを用意しないと、利用は地下に潜ります。",{"type":42,"tag":175,"props":936,"children":938},{"id":937},"新しいaiサービスの申請審査フロー",[939],{"type":47,"value":940},"新しいAIサービスの申請・審査フロー",{"type":42,"tag":43,"props":942,"children":943},{},[944],{"type":47,"value":945},"現場から「このAIを使いたい」という声が出たときの手続きも決めておきます。手続きがないと、使いたい人は黙って使うか、諦めるかのどちらかになります。",{"type":42,"tag":239,"props":947,"children":948},{},[949,950,955,956],{"type":47,"value":243},{"type":42,"tag":245,"props":951,"children":954},{"media":247,"srcSet":952,"width":249,"height":953},"\u002Fimg\u002Fcontents\u002Farticles\u002Fseisei-ai-shanai-rule-sample\u002Fshinsei-flow-sp.svg",768,[],{"type":47,"value":243},{"type":42,"tag":254,"props":957,"children":961},{"src":958,"alt":959,"width":258,"height":960,"loading":260},"\u002Fimg\u002Fcontents\u002Farticles\u002Fseisei-ai-shanai-rule-sample\u002Fshinsei-flow.svg","新しい生成AIサービスの申請・審査フロー：現場が申請、一次確認、5つの観点で審査、判定。承認したら入力してよい機密区分の上限を決めてリストに登録し、年1回以上見直す",376,[],{"type":42,"tag":963,"props":964,"children":965},"ol",{},[966,976,986,996],{"type":42,"tag":127,"props":967,"children":968},{},[969,974],{"type":42,"tag":82,"props":970,"children":971},{},[972],{"type":47,"value":973},"現場が申請する",{"type":47,"value":975}," ―― 使いたいサービス、使う業務、入力する情報の区分、利用人数を書きます。様式はA4で1枚以内に収めます",{"type":42,"tag":127,"props":977,"children":978},{},[979,984],{"type":42,"tag":82,"props":980,"children":981},{},[982],{"type":47,"value":983},"一次確認をする",{"type":47,"value":985}," ―― 情報システム担当が、承認済みのAIで代替できないかを確認します。多くの要望は既存のサービスの使い方で解決します",{"type":42,"tag":127,"props":987,"children":988},{},[989,994],{"type":42,"tag":82,"props":990,"children":991},{},[992],{"type":47,"value":993},"審査する",{"type":47,"value":995}," ―― 次の5つの観点でデータの扱いを確認します",{"type":42,"tag":127,"props":997,"children":998},{},[999,1004],{"type":42,"tag":82,"props":1000,"children":1001},{},[1002],{"type":47,"value":1003},"判定する",{"type":47,"value":1005}," ―― 承認・条件付き承認・却下のいずれかを決め、承認した場合は入力してよい機密区分の上限を決めてリストに登録します",{"type":42,"tag":43,"props":1007,"children":1008},{},[1009],{"type":47,"value":1010},"審査の観点は次のとおりです。",{"type":42,"tag":123,"props":1012,"children":1015},{"className":1013},[1014],"contains-task-list",[1016,1036,1051,1066,1081],{"type":42,"tag":127,"props":1017,"children":1020},{"className":1018},[1019],"task-list-item",[1021,1027,1029,1034],{"type":42,"tag":1022,"props":1023,"children":1026},"input",{"disabled":1024,"type":1025},true,"checkbox",[],{"type":47,"value":1028}," ",{"type":42,"tag":82,"props":1030,"children":1031},{},[1032],{"type":47,"value":1033},"契約",{"type":47,"value":1035},"：入力データの扱いが利用規約や契約で定められている",{"type":42,"tag":127,"props":1037,"children":1039},{"className":1038},[1019],[1040,1043,1044,1049],{"type":42,"tag":1022,"props":1041,"children":1042},{"disabled":1024,"type":1025},[],{"type":47,"value":1028},{"type":42,"tag":82,"props":1045,"children":1046},{},[1047],{"type":47,"value":1048},"学習",{"type":47,"value":1050},"：入力した内容がAIモデルの学習に使われないことを確認できる（設定で変えられる場合は、その設定を会社として固定できる）",{"type":42,"tag":127,"props":1052,"children":1054},{"className":1053},[1019],[1055,1058,1059,1064],{"type":42,"tag":1022,"props":1056,"children":1057},{"disabled":1024,"type":1025},[],{"type":47,"value":1028},{"type":42,"tag":82,"props":1060,"children":1061},{},[1062],{"type":47,"value":1063},"保存",{"type":47,"value":1065},"：データの保存場所と保存期間が分かる",{"type":42,"tag":127,"props":1067,"children":1069},{"className":1068},[1019],[1070,1073,1074,1079],{"type":42,"tag":1022,"props":1071,"children":1072},{"disabled":1024,"type":1025},[],{"type":47,"value":1028},{"type":42,"tag":82,"props":1075,"children":1076},{},[1077],{"type":47,"value":1078},"アカウント",{"type":47,"value":1080},"：会社が管理するアカウントで利用でき、退職時に停止できる",{"type":42,"tag":127,"props":1082,"children":1084},{"className":1083},[1019],[1085,1088,1089,1094],{"type":42,"tag":1022,"props":1086,"children":1087},{"disabled":1024,"type":1025},[],{"type":47,"value":1028},{"type":42,"tag":82,"props":1090,"children":1091},{},[1092],{"type":47,"value":1093},"記録",{"type":47,"value":1095},"：誰がいつ使ったかを会社が確認できる",{"type":42,"tag":43,"props":1097,"children":1098},{},[1099],{"type":47,"value":1100},"社内の資料を AI に読み込ませて検索させる仕組み（RAG）を作る場合は、AI サービスそのものの条件に加えて、読み込ませる資料の側の条件も確かめます。",{"type":42,"tag":111,"props":1102,"children":1103},{},[1104,1112],{"type":42,"tag":43,"props":1105,"children":1106},{},[1107],{"type":42,"tag":82,"props":1108,"children":1109},{},[1110],{"type":47,"value":1111},"K.S.Rogers の現場から",{"type":42,"tag":43,"props":1113,"children":1114},{},[1115],{"type":47,"value":1116},"機密性の高い技術情報を扱う製造業の会社様の支援では、業界の規格をまとめた資料を RAG に取り込もうとしたところ、資料の利用規約で AI の学習に使うことが禁じられているものがありました。AI サービスが審査に通っても、読み込ませる資料の側に制限があれば使えません。取り込む資料の利用規約・ライセンスは仕組みを作る前に確かめ、対象にする資料の範囲を最初に合意しておくと、後からの作り直しや見積もりのぶれを防げます。",{"type":42,"tag":43,"props":1118,"children":1119},{},[1120],{"type":47,"value":1121},"却下する場合も、「この業務なら承認済みの Copilot Chat でこう使える」といった代替案を返します。審査の目的は止めることではなく、安全な使い方に導くことだからです。",{"type":42,"tag":175,"props":1123,"children":1125},{"id":1124},"そのまま使える生成ai社内ルールのサンプル条文ひな形",[1126],{"type":47,"value":1127},"そのまま使える生成AI社内ルールのサンプル条文（ひな形）",{"type":42,"tag":43,"props":1129,"children":1130},{},[1131],{"type":47,"value":1132},"以下は、中堅・中小企業での利用を想定したサンプルです。自社の就業規則や情報管理規程の用語に合わせて修正してください。法的な有効性や既存規程との整合は、社内の法務担当や顧問弁護士に確認したうえで施行してください。",{"type":42,"tag":1134,"props":1135,"children":1136},"hr",{},[],{"type":42,"tag":43,"props":1138,"children":1139},{},[1140],{"type":42,"tag":82,"props":1141,"children":1142},{},[1143],{"type":47,"value":1144},"生成AI利用規程（サンプル）",{"type":42,"tag":43,"props":1146,"children":1147},{},[1148,1153],{"type":42,"tag":82,"props":1149,"children":1150},{},[1151],{"type":47,"value":1152},"第1条（目的）",{"type":47,"value":1154},"\n本規程は、当社の役員および従業員が業務において生成AIを利用する際の遵守事項を定め、業務の効率化と品質向上を図るとともに、情報漏えい、権利侵害その他のリスクを防止することを目的とする。",{"type":42,"tag":43,"props":1156,"children":1157},{},[1158,1163],{"type":42,"tag":82,"props":1159,"children":1160},{},[1161],{"type":47,"value":1162},"第2条（定義）",{"type":47,"value":1164},"\n本規程において、次の各号の用語の意味は当該各号に定めるところによる。",{"type":42,"tag":963,"props":1166,"children":1167},{},[1168,1173,1178,1183],{"type":42,"tag":127,"props":1169,"children":1170},{},[1171],{"type":47,"value":1172},"生成AI：文章、画像、プログラムその他のコンテンツを生成する機能を持つAIサービスをいう",{"type":42,"tag":127,"props":1174,"children":1175},{},[1176],{"type":47,"value":1177},"承認済みAIサービス：第5条に基づき会社が利用を承認し、別表2に掲載した生成AIをいう",{"type":42,"tag":127,"props":1179,"children":1180},{},[1181],{"type":47,"value":1182},"会社アカウント：会社が発行し管理するアカウントをいう",{"type":42,"tag":127,"props":1184,"children":1185},{},[1186],{"type":47,"value":1187},"機密区分：情報管理規程に定める情報の区分をいう",{"type":42,"tag":43,"props":1189,"children":1190},{},[1191,1196],{"type":42,"tag":82,"props":1192,"children":1193},{},[1194],{"type":47,"value":1195},"第3条（適用範囲）",{"type":47,"value":1197},"\n本規程は、当社の役員、従業員、派遣社員および当社業務に従事する委託先の従事者（以下「利用者」という）が、業務の目的で生成AIを利用する場合に適用する。私有の端末から利用する場合も同様とする。",{"type":42,"tag":43,"props":1199,"children":1200},{},[1201,1206],{"type":42,"tag":82,"props":1202,"children":1203},{},[1204],{"type":47,"value":1205},"第4条（推進責任者）",{"type":47,"value":1207},"\n会社は、生成AIの利用に関する推進責任者を置く。推進責任者は、承認済みAIサービスの管理、本規程の解釈、例外の承認および本規程の見直しを行う。",{"type":42,"tag":43,"props":1209,"children":1210},{},[1211],{"type":42,"tag":82,"props":1212,"children":1213},{},[1214],{"type":47,"value":1215},"第5条（利用できるAIサービス）",{"type":42,"tag":963,"props":1217,"children":1218},{},[1219,1224,1229],{"type":42,"tag":127,"props":1220,"children":1221},{},[1222],{"type":47,"value":1223},"利用者は、業務において承認済みAIサービスのみを利用することができる",{"type":42,"tag":127,"props":1225,"children":1226},{},[1227],{"type":47,"value":1228},"利用者は、承認済みAIサービスを会社アカウントでのみ利用し、個人アカウントで業務に利用してはならない",{"type":42,"tag":127,"props":1230,"children":1231},{},[1232],{"type":47,"value":1233},"承認済みAIサービスの一覧、利用できる者および利用条件は別表2に定め、推進責任者が管理する",{"type":42,"tag":43,"props":1235,"children":1236},{},[1237],{"type":42,"tag":82,"props":1238,"children":1239},{},[1240],{"type":47,"value":1241},"第6条（入力してよい情報）",{"type":42,"tag":963,"props":1243,"children":1244},{},[1245,1250,1255,1260],{"type":42,"tag":127,"props":1246,"children":1247},{},[1248],{"type":47,"value":1249},"利用者は、別表1に定める機密区分ごとの入力可否に従って生成AIに情報を入力する",{"type":42,"tag":127,"props":1251,"children":1252},{},[1253],{"type":47,"value":1254},"個人情報および特定個人情報の入力は、個人情報保護規程に従うほか、別表1で認められた場合に限る",{"type":42,"tag":127,"props":1256,"children":1257},{},[1258],{"type":47,"value":1259},"第三者から秘密保持義務を負って受領した情報は、当該契約で認められた範囲を超えて入力してはならない",{"type":42,"tag":127,"props":1261,"children":1262},{},[1263],{"type":47,"value":1264},"入力可否の判断に迷う場合、利用者は入力する前に推進責任者に確認する",{"type":42,"tag":43,"props":1266,"children":1267},{},[1268],{"type":42,"tag":82,"props":1269,"children":1270},{},[1271],{"type":47,"value":1272},"第7条（出力の取り扱い）",{"type":42,"tag":963,"props":1274,"children":1275},{},[1276,1281,1286,1291],{"type":42,"tag":127,"props":1277,"children":1278},{},[1279],{"type":47,"value":1280},"利用者は、生成AIの出力に誤りが含まれる可能性があることを理解し、業務に用いる前に内容の正確性を確認する",{"type":42,"tag":127,"props":1282,"children":1283},{},[1284],{"type":47,"value":1285},"社外に提出または公開する文書に出力を用いる場合、利用者は第三者の著作権その他の権利を侵害していないか、および個人情報が含まれていないかを確認する",{"type":42,"tag":127,"props":1287,"children":1288},{},[1289],{"type":47,"value":1290},"生成AIの出力を用いた成果物についての責任は、利用者およびその所属部門が負う",{"type":42,"tag":127,"props":1292,"children":1293},{},[1294],{"type":47,"value":1295},"人事評価、採用、与信その他、人に重大な影響を与える判断を生成AIの出力のみに基づいて行ってはならない",{"type":42,"tag":43,"props":1297,"children":1298},{},[1299,1304],{"type":42,"tag":82,"props":1300,"children":1301},{},[1302],{"type":47,"value":1303},"第8条（禁止事項）",{"type":47,"value":1305},"\n利用者は、次の各号の行為をしてはならない。",{"type":42,"tag":963,"props":1307,"children":1308},{},[1309,1314,1319,1324,1329],{"type":42,"tag":127,"props":1310,"children":1311},{},[1312],{"type":47,"value":1313},"承認済みAIサービス以外の生成AIを業務に利用すること",{"type":42,"tag":127,"props":1315,"children":1316},{},[1317],{"type":47,"value":1318},"個人アカウントで生成AIを業務に利用すること",{"type":42,"tag":127,"props":1320,"children":1321},{},[1322],{"type":47,"value":1323},"別表1で入力が認められていない情報を入力すること",{"type":42,"tag":127,"props":1325,"children":1326},{},[1327],{"type":47,"value":1328},"法令、公序良俗または他者の権利を侵害する目的で生成AIを利用すること",{"type":42,"tag":127,"props":1330,"children":1331},{},[1332],{"type":47,"value":1333},"承認済みAIサービスの設定のうち、会社が指定した設定を変更すること",{"type":42,"tag":43,"props":1335,"children":1336},{},[1337],{"type":42,"tag":82,"props":1338,"children":1339},{},[1340],{"type":47,"value":1341},"第9条（新たなAIサービスの申請・審査）",{"type":42,"tag":963,"props":1343,"children":1344},{},[1345,1350,1355],{"type":42,"tag":127,"props":1346,"children":1347},{},[1348],{"type":47,"value":1349},"承認済みAIサービス以外の生成AIの利用を希望する者は、所定の様式により推進責任者に申請する",{"type":42,"tag":127,"props":1351,"children":1352},{},[1353],{"type":47,"value":1354},"推進責任者は、契約上のデータの扱い、入力データの学習への利用の有無、データの保存場所と期間、会社アカウントでの管理の可否、利用記録の確認の可否を審査し、承認、条件付き承認または却下を決定する",{"type":42,"tag":127,"props":1356,"children":1357},{},[1358],{"type":47,"value":1359},"承認した場合、推進責任者は入力できる機密区分の上限その他の条件を定めて別表2に掲載し、利用者に周知する",{"type":42,"tag":43,"props":1361,"children":1362},{},[1363],{"type":42,"tag":82,"props":1364,"children":1365},{},[1366],{"type":47,"value":1367},"第10条（教育）",{"type":42,"tag":963,"props":1369,"children":1370},{},[1371,1376],{"type":42,"tag":127,"props":1372,"children":1373},{},[1374],{"type":47,"value":1375},"会社は、利用者に対し、生成AIの適切な利用に関する教育を行う",{"type":42,"tag":127,"props":1377,"children":1378},{},[1379],{"type":47,"value":1380},"利用者は、会社が定める研修を受講し、確認テストに合格した後に生成AIの利用を開始する",{"type":42,"tag":43,"props":1382,"children":1383},{},[1384,1389],{"type":42,"tag":82,"props":1385,"children":1386},{},[1387],{"type":47,"value":1388},"第11条（利用状況の確認）",{"type":47,"value":1390},"\n会社は、情報セキュリティの確保および本規程の遵守状況の確認のため、必要な範囲で生成AIの利用記録を確認することができる。",{"type":42,"tag":43,"props":1392,"children":1393},{},[1394,1399],{"type":42,"tag":82,"props":1395,"children":1396},{},[1397],{"type":47,"value":1398},"第12条（事故発生時の対応）",{"type":47,"value":1400},"\n利用者は、本規程に反する入力をしたとき、または情報漏えいのおそれに気づいたときは、直ちに推進責任者および所属長に報告する。報告した者は、そのことのみを理由として不利益な扱いを受けない。",{"type":42,"tag":43,"props":1402,"children":1403},{},[1404,1409],{"type":42,"tag":82,"props":1405,"children":1406},{},[1407],{"type":47,"value":1408},"第13条（違反時の措置）",{"type":47,"value":1410},"\n本規程に違反した場合、会社は就業規則その他の社内規程に基づき必要な措置を講じることがある。",{"type":42,"tag":43,"props":1412,"children":1413},{},[1414,1419],{"type":42,"tag":82,"props":1415,"children":1416},{},[1417],{"type":47,"value":1418},"第14条（見直し）",{"type":47,"value":1420},"\n推進責任者は、本規程および別表を年1回以上見直すほか、承認済みAIサービスの利用規約または仕様の変更、法令やガイドラインの改定、事故の発生その他必要が生じたときは随時見直す。",{"type":42,"tag":43,"props":1422,"children":1423},{},[1424,1429],{"type":42,"tag":82,"props":1425,"children":1426},{},[1427],{"type":47,"value":1428},"附則",{"type":47,"value":1430},"\n本規程は、20XX年X月X日から施行する。",{"type":42,"tag":43,"props":1432,"children":1433},{},[1434,1439],{"type":42,"tag":82,"props":1435,"children":1436},{},[1437],{"type":47,"value":1438},"別表1（機密区分ごとの入力可否）",{"type":47,"value":1440}," ―― 本記事の「入力してよい情報・いけない情報を機密区分と紐づける」の表を、自社の区分に合わせて作成する",{"type":42,"tag":43,"props":1442,"children":1443},{},[1444,1449],{"type":42,"tag":82,"props":1445,"children":1446},{},[1447],{"type":47,"value":1448},"別表2（承認済みAIサービス一覧）",{"type":47,"value":1450}," ―― 本記事の「承認済みAIサービスのリスト管理」の列（サービス名、利用できる人、アカウント、入力上限区分、利用目的、注意事項、承認日／次回見直し日）で作成する",{"type":42,"tag":1134,"props":1452,"children":1453},{},[],{"type":42,"tag":43,"props":1455,"children":1456},{},[1457,1459,1466],{"type":47,"value":1458},"条文のうち、第10条2項の「確認テストに合格した後に利用を開始する」は、運用負荷とのバランスで判断してください。公開事例では、三井化学が生成AI利用要領を整備し、確認テストへの合格を生成AI利用の前提としたうえで Microsoft 365 Copilot の利用を広げています（出典：",{"type":42,"tag":50,"props":1460,"children":1463},{"href":1461,"rel":1462},"https:\u002F\u002Fwww.microsoft.com\u002Fja-jp\u002Fcustomers\u002Fstory\u002F26949-mitsui-chemicals-microsoft-365-copilot",[54],[1464],{"type":47,"value":1465},"Microsoft 公式事例",{"type":47,"value":1467},"）。数問の理解度チェックでも、「ルールを読んだ」状態を作る効果があります。",{"type":42,"tag":43,"props":1469,"children":1470},{},[1471],{"type":47,"value":1472},"第12条の「報告した者は不利益な扱いを受けない」も重要です。誤って入力したことを報告すると罰せられるルールでは、事故は隠れます。",{"type":42,"tag":43,"props":1474,"children":1475},{},[1476],{"type":47,"value":1477},"第6条4項の「入力する前に推進責任者に確認する」は、迷ったときの確認として書いています。扱う情報によっては、入力の前の確認を毎回必ず通す手続きにする必要があります。",{"type":42,"tag":111,"props":1479,"children":1480},{},[1481,1488],{"type":42,"tag":43,"props":1482,"children":1483},{},[1484],{"type":42,"tag":82,"props":1485,"children":1486},{},[1487],{"type":47,"value":1111},{"type":42,"tag":43,"props":1489,"children":1490},{},[1491],{"type":47,"value":1492},"機密性の高い技術情報を扱う製造業の会社様では、ディープリサーチのような調べものや、社内の資料を AI に検索させる RAG の使い方でも、入力したプロンプトをそのままクラウドの AI に送ることは難しいという事情がありました。会社固有の用語や情報が、プロンプトを通じて外に出るおそれがあるためです。そこで、①送る前に上長がプロンプトを人の目で確かめ、OK を出してから通す、②会社固有の情報が入っていないかを自動で見つけて伏せる（自動マスキング）、の2つの方法を検討しました。",{"type":42,"tag":175,"props":1494,"children":1496},{"id":1495},"公的なガイドラインとの関係",[1497],{"type":47,"value":1495},{"type":42,"tag":43,"props":1499,"children":1500},{},[1501],{"type":47,"value":1502},"社内ルールを作る際は、公的なガイドラインとの整合も確認しておくと、経営や取引先への説明がしやすくなります。",{"type":42,"tag":123,"props":1504,"children":1505},{},[1506,1532],{"type":42,"tag":127,"props":1507,"children":1508},{},[1509,1514,1516,1523,1524,1531],{"type":42,"tag":82,"props":1510,"children":1511},{},[1512],{"type":47,"value":1513},"AI事業者ガイドライン（第1.2版）",{"type":47,"value":1515}," ―― 総務省・経済産業省が2026年3月31日に公表しました。AIの開発・提供・利用に関わる事業者を対象とした指針で、AIを業務で使う会社は「AI利用者」にあたります。第1.2版ではAIエージェントの定義が本文に加わるなど、AIの自律性が高まることを前提にした記載が拡充されています。ガイドラインは継続的に更新される前提の文書のため、参照する際は最新版を確認してください（出典：",{"type":42,"tag":50,"props":1517,"children":1520},{"href":1518,"rel":1519},"https:\u002F\u002Fwww.meti.go.jp\u002Fshingikai\u002Fmono_info_service\u002Fai_shakai_jisso\u002F20260331_report.html",[54],[1521],{"type":47,"value":1522},"経済産業省「AI事業者ガイドライン」",{"type":47,"value":150},{"type":42,"tag":50,"props":1525,"children":1528},{"href":1526,"rel":1527},"https:\u002F\u002Fwww.soumu.go.jp\u002Fmain_sosiki\u002Fkenkyu\u002Fai_network\u002F02ryutsu20_04000019.html",[54],[1529],{"type":47,"value":1530},"総務省「AI事業者ガイドライン」掲載ページ",{"type":47,"value":904},{"type":42,"tag":127,"props":1533,"children":1534},{},[1535,1540,1542,1549],{"type":42,"tag":82,"props":1536,"children":1537},{},[1538],{"type":47,"value":1539},"生成AIの利用ガイドライン（JDLA）",{"type":47,"value":1541}," ―― 一般社団法人日本ディープラーニング協会が公開している、組織内で生成AIを使うためのガイドラインのひな形です。第1.1版が公開されており、Word 形式で修正して使えます（出典：",{"type":42,"tag":50,"props":1543,"children":1546},{"href":1544,"rel":1545},"https:\u002F\u002Fwww.jdla.org\u002Fdocument\u002F",[54],[1547],{"type":47,"value":1548},"日本ディープラーニング協会 資料室",{"type":47,"value":904},{"type":42,"tag":43,"props":1551,"children":1552},{},[1553,1555,1560],{"type":47,"value":1554},"公的ガイドラインは広い事業者を対象にしているため、そのまま社内ルールにはなりません。本記事のサンプルのように、",{"type":42,"tag":82,"props":1556,"children":1557},{},[1558],{"type":47,"value":1559},"自社の機密区分・承認済みリスト・申請手続き",{"type":47,"value":1561},"という「自社の運用」に落とし込む作業が必要です。",{"type":42,"tag":175,"props":1563,"children":1565},{"id":1564},"中小企業で生成aiガイドラインを作る進め方",[1566],{"type":47,"value":1567},"中小企業で生成AIガイドラインを作る進め方",{"type":42,"tag":43,"props":1569,"children":1570},{},[1571],{"type":47,"value":1572},"専任の法務部門がない会社でも、次の順番なら1〜2か月で施行まで進められます。",{"type":42,"tag":963,"props":1574,"children":1575},{},[1576,1586,1603,1613,1623,1633],{"type":42,"tag":127,"props":1577,"children":1578},{},[1579,1584],{"type":42,"tag":82,"props":1580,"children":1581},{},[1582],{"type":47,"value":1583},"現状を把握する",{"type":47,"value":1585},"（1〜2週間）―― 社員が今どのAIを、どの業務で、どのアカウントで使っているかを匿名アンケートで聞きます。禁止している会社ほど、実態は想像と違います",{"type":42,"tag":127,"props":1587,"children":1588},{},[1589,1594,1596,1601],{"type":42,"tag":82,"props":1590,"children":1591},{},[1592],{"type":47,"value":1593},"既存規程を確認する",{"type":47,"value":1595},"（1週間）―― 情報管理規程の機密区分、就業規則の懲戒規定、既存の「外部AI禁止」条項を洗い出します。既存条項の読み方は",{"type":42,"tag":50,"props":1597,"children":1598},{"href":91},[1599],{"type":47,"value":1600},"特別編",{"type":47,"value":1602},"を参照してください",{"type":42,"tag":127,"props":1604,"children":1605},{},[1606,1611],{"type":42,"tag":82,"props":1607,"children":1608},{},[1609],{"type":47,"value":1610},"承認済みリストの初版を作る",{"type":47,"value":1612},"（1週間）―― まずは職場アカウントで使う Copilot Chat など、データの扱いを確認できたサービスだけで構いません",{"type":42,"tag":127,"props":1614,"children":1615},{},[1616,1621],{"type":42,"tag":82,"props":1617,"children":1618},{},[1619],{"type":47,"value":1620},"サンプル条文を自社用に直す",{"type":47,"value":1622},"（1〜2週間）―― 推進責任者、法務・総務、現場代表で読み合わせます",{"type":42,"tag":127,"props":1624,"children":1625},{},[1626,1631],{"type":42,"tag":82,"props":1627,"children":1628},{},[1629],{"type":47,"value":1630},"研修と同時に施行する",{"type":47,"value":1632}," ―― 施行日に「何が使えて、何を入れてよいか」を1枚にまとめた案内を配ります",{"type":42,"tag":127,"props":1634,"children":1635},{},[1636,1641],{"type":42,"tag":82,"props":1637,"children":1638},{},[1639],{"type":47,"value":1640},"3か月後に一度見直す",{"type":47,"value":1642}," ―― 問い合わせの多かった点を FAQ にし、別表を更新します。以降は年1回以上です",{"type":42,"tag":43,"props":1644,"children":1645},{},[1646,1648,1653],{"type":47,"value":1647},"ルールは最初から完璧である必要はありません。",{"type":42,"tag":82,"props":1649,"children":1650},{},[1651],{"type":47,"value":1652},"施行して、問い合わせを集めて、直す",{"type":47,"value":1654},"ことを前提に、早く出すほうが現場の混乱は小さくなります。",{"type":42,"tag":175,"props":1656,"children":1658},{"id":1657},"ksrogers-の支援",[1659],{"type":47,"value":1660},"K.S.Rogers の支援",{"type":42,"tag":43,"props":1662,"children":1663},{},[1664],{"type":47,"value":1665},"K.S.Rogers では、生成AIの社内ルール策定を、ルール文書の作成だけでなく Microsoft 365 側の設定とセットで支援しています。",{"type":42,"tag":123,"props":1667,"children":1668},{},[1669,1674,1679,1684],{"type":42,"tag":127,"props":1670,"children":1671},{},[1672],{"type":47,"value":1673},"既存規程と Copilot の読み合わせ、経営・法務向けの説明資料の作成",{"type":42,"tag":127,"props":1675,"children":1676},{},[1677],{"type":47,"value":1678},"機密区分の整理と、専用サイトでの管理への落とし込み（必要な会社には秘密度ラベルの設計）",{"type":42,"tag":127,"props":1680,"children":1681},{},[1682],{"type":47,"value":1683},"承認済みAIサービスの審査の型づくりと、初版リストの作成",{"type":42,"tag":127,"props":1685,"children":1686},{},[1687],{"type":47,"value":1688},"研修・確認テストの設計と、施行後の問い合わせ対応",{"type":42,"tag":43,"props":1690,"children":1691},{},[1692,1694,1700],{"type":47,"value":1693},"M365 の環境整備から Copilot の定着までの支援の範囲と進め方は、",{"type":42,"tag":50,"props":1695,"children":1697},{"href":1696},"\u002Fbusiness\u002Fm365-copilot\u002F",[1698],{"type":47,"value":1699},"Microsoft 365 Copilot 導入・活用支援",{"type":47,"value":1701},"のページにまとめています。",{"type":42,"tag":43,"props":1703,"children":1704},{},[1705,1707,1713],{"type":47,"value":1706},"「ルールがないので Copilot を配れない」「作ったルールが現場で使われていない」といった段階からご相談いただけます。",{"type":42,"tag":50,"props":1708,"children":1710},{"href":1709},"\u002Fcontact\u002F",[1711],{"type":47,"value":1712},"お問い合わせ",{"type":47,"value":1714},"からお気軽にご連絡ください。",{"type":42,"tag":175,"props":1716,"children":1718},{"id":1717},"まとめ",[1719],{"type":47,"value":1717},{"type":42,"tag":123,"props":1721,"children":1722},{},[1723,1734,1745,1757],{"type":42,"tag":127,"props":1724,"children":1725},{},[1726,1728,1732],{"type":47,"value":1727},"生成AIの社内ルールは、禁止事項を並べるのではなく",{"type":42,"tag":82,"props":1729,"children":1730},{},[1731],{"type":47,"value":136},{"type":47,"value":1733},"を先に示すことで、萎縮と暴走の両方を防ぎます",{"type":42,"tag":127,"props":1735,"children":1736},{},[1737,1739,1743],{"type":47,"value":1738},"入力してよい情報は、既存の",{"type":42,"tag":82,"props":1740,"children":1741},{},[1742],{"type":47,"value":486},{"type":47,"value":1744},"に紐づけて決めます。システムの上では、機微な情報を専用のサイトに置いて見られる人を絞ることで、規程と実際の制御がつながります",{"type":42,"tag":127,"props":1746,"children":1747},{},[1748,1750,1755],{"type":47,"value":1749},"サービス名は条文に書かず",{"type":42,"tag":82,"props":1751,"children":1752},{},[1753],{"type":47,"value":1754},"承認済みリスト",{"type":47,"value":1756},"で管理し、個人アカウントでの業務利用を禁止し、申請・審査フローを用意します",{"type":42,"tag":127,"props":1758,"children":1759},{},[1760,1762,1767],{"type":47,"value":1761},"規程は",{"type":42,"tag":82,"props":1763,"children":1764},{},[1765],{"type":47,"value":1766},"年1回以上",{"type":47,"value":1768},"、加えて規約・仕様の変更時に見直します。施行して、問い合わせを集めて、直す前提で早く始めます",{"type":42,"tag":43,"props":1770,"children":1771},{},[1772,1774,1778,1780,1784,1786,1792],{"type":47,"value":1773},"開発を外注している会社は、",{"type":42,"tag":50,"props":1775,"children":1776},{"href":104},[1777],{"type":47,"value":107},{"type":47,"value":1779},"もあわせてご覧ください。Copilot 導入の全体像は",{"type":42,"tag":50,"props":1781,"children":1782},{"href":70},[1783],{"type":47,"value":73},{"type":47,"value":1785},"、データの置き場所の整理は",{"type":42,"tag":50,"props":1787,"children":1789},{"href":1788},"\u002Farticles\u002Fcopilot-data-okiba-box-sharepoint\u002F",[1790],{"type":47,"value":1791},"第2回（前編）：Microsoft 365 Copilotは社内のメールやチャットを「学習」するのか",{"type":47,"value":96},{"title":7,"searchDepth":1794,"depth":1794,"links":1795},2,[1796,1797,1798,1799,1800,1801,1802,1803,1804,1805,1806],{"id":177,"depth":1794,"text":180},{"id":230,"depth":1794,"text":230},{"id":441,"depth":1794,"text":444},{"id":707,"depth":1794,"text":710},{"id":848,"depth":1794,"text":851},{"id":937,"depth":1794,"text":940},{"id":1124,"depth":1794,"text":1127},{"id":1495,"depth":1794,"text":1495},{"id":1564,"depth":1794,"text":1567},{"id":1657,"depth":1794,"text":1660},{"id":1717,"depth":1794,"text":1717},"markdown","content:articles:seisei-ai-shanai-rule-sample.md","content","articles\u002Fseisei-ai-shanai-rule-sample.md","articles\u002Fseisei-ai-shanai-rule-sample","md",[1814,1819,1823,1827,1832,1837,1842,1847,1852],{"_path":1815,"title":1816,"seriesNo":1817,"seriesLabel":1818},"\u002Farticles\u002Fm365-copilot-donyu-roadmap","Microsoft 365 Copilot 導入ロードマップ｜非IT企業がライセンス配布前に決めること",1,"第1回",{"_path":1820,"title":1821,"seriesNo":1822,"seriesLabel":1600},"\u002Farticles\u002Fcopilot-shanai-kitei-edp","Copilotのエンタープライズデータ保護（EDP）とは｜「外部AI禁止」の社内規程でも使えるかの判断手順",1.5,{"_path":1824,"title":1825,"seriesNo":1794,"seriesLabel":1826},"\u002Farticles\u002Fcopilot-data-okiba-box-sharepoint","Copilotは社内データを学習する？｜参照できるデータの条件とSharePoint・OneDrive・Boxの使い分け","第2回（前編）",{"_path":1828,"title":1829,"seriesNo":1830,"seriesLabel":1831},"\u002Farticles\u002Fcopilot-mail-chat-ikou-checklist","Exchange Online移行の注意点とLINE WORKSからTeamsへの判断｜Microsoft 365 Copilot導入前チェックリスト",2.5,"第2回（後編）",{"_path":1833,"title":1834,"seriesNo":1835,"seriesLabel":1836},"\u002Farticles\u002Fm365-copilot-iranai-google-hikaku","Microsoft 365 Copilotはいらない？無料版との違い・料金と「Googleより高い」への答え方",2.8,"番外編",{"_path":1838,"title":1839,"seriesNo":1840,"seriesLabel":1841},"\u002Farticles\u002Fcopilot-joho-rouei-sharepoint-kengen","Microsoft 365 Copilotの情報漏洩対策｜SharePoint・OneDrive・Teamsの権限を棚卸しして是正する手順",3,"第3回",{"_path":1843,"title":1844,"seriesNo":1845,"seriesLabel":1846},"\u002Farticles\u002Fcopilot-security-settei-chusho","Microsoft 365 Copilotのセキュリティ設定｜中小企業に秘密度ラベルとDLPは必要か",4,"第4回（前編）",{"_path":1848,"title":1849,"seriesNo":1850,"seriesLabel":1851},"\u002Farticles\u002Fcopilot-sensitivity-label-dlp","Microsoft 365 Copilotの秘密度ラベルとDLP｜「警告」から始める段階設計とライセンス要件",4.5,"第4回（後編）",{"_path":4,"title":8,"seriesNo":13,"seriesLabel":14},1791909858438]