Somewhere in your company, someone has already pasted something into a chat tool. A customer email, a sales list, a contract clause, a chunk of a spreadsheet. They did it to save time, and most of them didn't think twice.
You can't solve that by banning the tools. People will use them on a personal phone. A better move is to write down a short, clear set of rules, and to give people a safe way to get the benefit. This isn't legal advice, so check the specifics with someone qualified, but here's the shape of a sensible policy.
Sort your data into three piles
Fine to use freely. Public information, your own marketing copy, generic questions, code that contains nothing sensitive.
Use only with approved tools. Internal documents, non-public plans, anonymised or aggregated data, your own source code.
Keep out of external tools. Personal data about customers or staff (names with contact details, order histories, health or financial details), passwords and keys, anything covered by a confidentiality agreement, and unreleased financial results.
If that's all your team remembers, you've already prevented most of the problems.
Know what the tool does with what you type
This varies a lot between products and between plan types, and it changes. Free consumer versions have, at various times, used conversations to improve the service unless you switch it off. Business and API plans commonly say they don't train on your inputs, and offer controls on how long data is kept. Don't take any of that on trust, mine included. Read the provider's current terms and data processing documents, and write down what you found and when.
The questions to ask are straightforward. Is my data used for training? How long is it kept? Who can see it? Where is it processed? Can I delete it?
Options, roughly in order of safety
- Business or enterprise plans with no-training terms and admin controls. The easiest step for most teams.
- Calling a model through an API from your own systems, where you decide what is sent and can strip identifying details first.
- Running a model yourself, on your own servers or in your own cloud account. More work, more control, and often more than a small team needs.
- Removing the sensitive parts first. Even with a safe tool, you rarely need real names. Replace them with placeholders before sending.
Rules a small team can adopt this week
- Use only the approved tools for work, and put the list somewhere people can find it.
- Don't paste personal data about customers or staff into any tool that isn't approved for it.
- Treat the output as a draft. A named person reviews anything that leaves the building, especially numbers, legal wording and claims about products.
- Don't use model output as the only source for a decision about a person, such as hiring or credit.
- Tell people when AI-generated material is going to a customer, if it matters to them.
- Report mistakes without blame, so you hear about them.
Don't forget the law
If you handle personal data of people in India, the Digital Personal Data Protection Act, 2023 sets out duties around consent, purpose and safeguards, and other places have their own rules. Sending customers' personal data to an outside service is a form of processing and needs a lawful basis and appropriate protections. A short conversation with a lawyer is cheaper than a complaint.
Give people a good alternative
The reason staff use unapproved tools is that they're useful. Offer something approved that's just as easy, and a few examples of good uses, and most of the problem goes away. Fewer rules, followed, beat a thick policy no one reads.
If you want help choosing a setup that fits your data, that's part of our AI solutions work.