The short answer
Usually, you should not paste confidential work information into a public AI tool unless your organisation has approved that tool and you understand how it handles the data. The safe default is to remove identifying details, use a fictional example or ask your IT or security lead what is allowed.
The fact that an AI tool is free or popular does not make it suitable for company information. “It is only a draft” is not a privacy policy.
What counts as confidential?
The exact rule depends on your employer and industry, but treat these as sensitive until you have permission:
- customer names, contact details and account histories
- passwords, API keys, internal links and access codes
- unpublished financial figures, pricing or strategy
- employee records, health information and performance notes
- contracts, legal advice and documents marked confidential
- anything a client, colleague or supplier trusted you not to share
Personal data can still identify someone after you remove their name. A rare job title, location and date may be enough to recognise the person.
A safer way to use AI for a work task
First describe the task without including the real material. Ask the tool to help you design a structure, checklist or draft template. Then replace the placeholders yourself using an approved system.
For example, instead of pasting a customer complaint, write:
A customer says a delivery arrived late and wants a refund. Draft a polite reply that acknowledges the delay, explains that the order is being checked and asks for the order number. Do not promise a refund before a human confirms the policy.
You get help with the shape and tone without handing over the customer’s identity or order details.
A four-question check before you paste
- Would I put this on a public website? If not, pause.
- Has my organisation approved this tool for this kind of data? If you do not know, ask.
- Can I remove names, numbers and unique details while keeping the task useful? If yes, anonymise it.
- Who checks the output before it reaches a customer or decision-maker? Name the human, not just “someone”.
If any answer is unclear, use a generic example or keep the work inside an approved tool.
What about business accounts and paid plans?
A business or paid plan may offer different controls, but the label alone is not proof that the tool is approved for your work. Check the actual agreement, retention settings, access controls and your organisation’s policy. A tool can have strong privacy controls and still be the wrong place for a particular regulated or contractual document.
Do not assume that deleting a chat removes every copy, or that a “no training” setting solves access, retention or accidental sharing. Those are separate questions.
The useful rule
Use AI to help with the method before you use it with the material. Draft the checklist, rewrite a fictional example, map the workflow and identify what needs checking. Then bring the real information into a system your organisation has approved.
The AI Safety and Verification course covers the wider habit: checking what an AI system produces, protecting private information and knowing when not to trust a confident answer. If your goal is to build a team rule, continue with Safe AI Adoption for Teams.
This is practical guidance, not legal advice. Your employer’s policy, client agreements and local data-protection rules may require a stricter approach.