AI assistants like ChatGPT, Microsoft Copilot, Google Gemini and Claude save hours on emails, spreadsheets, summaries and writing. The risk lies in what you send them and which account you use. A contract or customer list pasted into a free personal account can leave the company’s control.
In this article
What never to paste into an AI chat (on a personal account)
- Personal data about customers and employees: full names with ID numbers, addresses, health data, salaries.
- Passwords, access keys, tokens and card details.
- Confidential contracts, proposals and strategy.
- Company source code and system data without authorization.
Use the right account and plan
- Business plans (such as ChatGPT Business or Enterprise, Claude Team or Enterprise, Gemini for Workspace and Microsoft 365 Copilot) usually include a contractual commitment not to use your data to train models, admin controls and configurable retention. Check each service’s terms.
- Sign in with your work account. In Microsoft 365, for example, Copilot used with your company account applies enterprise data protection; the same tool on a personal account follows different rules.
- Free and personal accounts: check the privacy settings to see whether conversations may be used to improve models, and turn that off where possible.
Good habits
- Anonymize: replace real names and numbers with placeholders (“Customer A”, “$X”) when only the structure matters.
- Always check the answer. AI can make up data, laws, numbers and references with complete confidence. Verify before sending anything to a customer.
- Don’t run commands, macros or code generated by AI without understanding what they do — especially on a server or with admin rights.
- Be careful with third-party files: documents and web pages can contain hidden instructions aimed at the AI. Treat what it reads as information, not orders.
Simple rules for your team
A one-page policy goes a long way:
- Which tools are approved and with which account.
- What can and can’t be shared (use the list above).
- Who reviews content that goes to customers.
- Who to notify if someone shares data by mistake.
FAQ
If the company has no business plan, is AI off-limits?
Not necessarily, but use is limited to information that isn’t confidential or personal. For serious use, a business plan is worth considering.
Can AI see my OneDrive or Google Drive files?
Only when you connect the tool to those accounts (as with Microsoft 365 Copilot). Then it respects the same permissions you already have — so review who can access sensitive folders.
