Using AI safely at work.
What you should never paste in, how to check what comes out, and why your company's policy matters. None of it is complicated, and it protects you as much as your employer.
- Never put personal, confidential or customer information into an AI tool your organisation hasn't approved for it. If in doubt, leave it out.
- Check everything before you use it: facts, figures, names, tone, and anything that could cause harm if it's wrong.
- Follow your company's AI policy, and ask if you can't find one. Using AI openly and sensibly is far safer than using it quietly.
Prefer to watch?
The video covers the same ground as the page below, in a few minutes.
Why it matters what you paste in
When you type into an AI tool, your words are sent over the internet to computers run by the company that provides it. What happens to them next depends on the tool and on the kind of account you're using.
Free, personal versions of chatbots may keep your conversations and, depending on the settings, use them to help train future versions. Business versions bought by your employer usually come with contracts saying your data won't be used for training and will be handled properly. That difference is a big part of why your organisation might say “use this tool, not that one”.
There's also the law. In the UK, data protection law (UK GDPR) sets rules for how personal information is used. Pasting a customer's details into an unapproved tool could break those rules, even if you meant well.
What to keep out
Unless your organisation has specifically approved a tool for this kind of information, keep all of these out of it:
- Personal details. Names, addresses, phone numbers, dates of birth, National Insurance numbers, and anything else that identifies a customer, patient, colleague or job applicant.
- Sensitive information. Health records, HR cases, disciplinary notes, pay details and anything about someone's personal circumstances.
- Confidential business information. Unpublished financial results, pricing, contracts, plans, supplier terms, and anything marked internal or confidential.
- Passwords and security details. Logins, access codes, system settings, or anything that could help someone get into your systems.
- Other people's documents. A client's report or a supplier's proposal may come with confidentiality terms you've agreed to.
How to get help without the risk
Leaving data out rarely means you can't use AI at all. Usually it just means changing how you ask.
- Swap in placeholders. Write [customer name], [amount] and [date] instead of the real details, then fill them in yourself afterwards.
- Describe, don't paste. Instead of pasting a complaint, describe it: “a customer is unhappy that a delivery arrived two days late and wants a refund”.
- Use made-up examples. For help with a spreadsheet formula, build a small sample with invented numbers and the same column headings.
- Use the approved tool. If your organisation provides a business AI tool, use that for work, and stick to its rules about what it can be used for.
Check what comes out
The other half of safety is what you do with the answer. Whatever AI helps you write or decide, your name is on it. Before you send, publish or act on anything, check it.
- Facts and figures. Check every number, date, name and quote against a source you trust.
- Rules and policies. If it mentions a law, a policy or a procedure, check the real thing. AI often states rules that sound right but aren't.
- Tone. Read it as the person receiving it would. AI can sound oddly formal, over-enthusiastic, or simply not like you.
- Fairness. AI learns from human writing, so it can repeat human bias. Take extra care with anything about people, such as job adverts, shortlisting or performance notes.
- Links and instructions. Don't follow a link or instruction in an AI answer without checking where it leads.
Your company's policy, and two newer risks
Many organisations now have an AI policy that says which tools are approved, what they can be used for and what information is off limits. Read yours: it's there to protect you as well as the business. If there isn't one, ask your manager or IT team what's allowed. That's a sensible question, not an awkward one.
Be open about your use of AI, too. Quietly using unapproved tools, sometimes called shadow AI, is where a lot of the real risk comes from. When your team knows how you're using AI, you can all learn from each other. Finally, two newer risks are worth knowing about:
- Deepfakes. AI can now copy a person's voice or face convincingly. If you get an unexpected call, voice note or video from a “manager” asking for an urgent payment or login details, check through another channel before you do anything.
- Hidden instructions. AI tools that read emails, documents or web pages can be tricked by instructions hidden inside them. This is called prompt injection. If an AI assistant suddenly suggests something odd, such as sending information somewhere unusual, stop and check.
Your safe-use check
- Find your organisation's AI policy, or its guidance on which AI tools are approved. Try the intranet, the staff handbook or the IT pages.
- If you can't find anything, ask your manager or IT team one question: “Which AI tools are we allowed to use, and what information can we put into them?”
- Take a routine task you'd like help with, and write the request using placeholders instead of any real names, numbers or customer details.
- Run it through the approved tool, then check the result for facts, rules, tone, fairness and links.
- Note anything you'd like clarified and share it with your team. Chances are someone else has the same question.
Share it with your manager.
If your whole team is being asked to get up to speed on AI, a short practical session together saves weeks of guesswork.
About team training →Pass it on.
It's free, there's no sign-up, and it's written for people who aren't in IT.