Using AI assistants at work without leaking company data: a practical policy for small teams

AI assistants are useful for drafting, summarising and explaining. They also make it very easy to paste something you should not have shared: a customer's details, a contract, a password. A small team does not need a long document to manage that. It needs one page that people read and follow. This is the shape we recommend.

Why write it down

Without a rule, each person decides alone, and the careful ones are slowed down while the careless ones create the risk. A short written policy turns a vague worry into three clear questions: what may go in, which tool may receive it, and who checks what comes out.

What never goes into an AI tool

Make the list short and specific, and put it at the top:

• Passwords, access keys and recovery codes, in any form.
• Personal data about customers, patients or staff: names with contact details, medical or financial records, identity documents.
• Contracts and agreements that carry a confidentiality clause, and anything a client has told you to keep private.
• Unpublished financial results and strategy.
• Source code or configuration that contains secrets, unless the secrets have been removed first.

If you are unsure whether something is on the list, it is. Ask before you paste.

Use work accounts and read the data settings

Personal accounts on free tools are the usual way company information escapes. Choose the tools the business approves, sign in with work accounts, and read the provider's current terms on three things: whether your content may be used to improve the product, how long it is kept, and who can see it. These terms change, so check them at least once a year, and again when you change plans.

List what the tools are for

Agree a few approved uses so people know where they stand. Good candidates are drafting and editing your own text, summarising public documents, explaining code or a concept, brainstorming, and turning notes into a clean format. Anything that sends confidential material, makes a decision about a person, or is shown to a client without a human reading it should be off the list until you have thought it through.

Treat the output as a draft

AI assistants write fluently, including when they are wrong. Before anything leaves the building:

• Check facts, figures and names against a reliable source.
• Check quotations and references: tools sometimes invent them.
• Review code as you would a colleague's, with tests, and watch for insecure patterns.
• Read it as your reader will. If you would not sign it, do not send it.

Be careful with documents and web pages you did not write. They can contain hidden instructions aimed at the tool, so do not let an assistant act on its own on content you have not read.

Make someone accountable

The person who sends or publishes the work is responsible for it, whatever helped to write it. Say so in the policy. For important documents, a short note in the file about how the tool was used makes later questions easy to answer.

Train people and review the policy

Spend half an hour showing the team real examples of what is and is not allowed. Review the policy every few months. The tools change quickly, and a rule that nobody revisits soon stops matching how people work.

What we help with

We build practical, supervised AI features into business tools and help teams set sensible rules for using them. If you would like to see what that looks like for your organisation, read about our AI-assisted tools or get in touch.