Somewhere in most companies right now, an employee is pasting a client contract, a chunk of proprietary source code, or a spreadsheet of customer records into a public AI chatbot to get a quick summary or a faster answer. Nobody told them not to, because most companies still haven’t written the policy.
This isn’t an argument against using AI tools at work — we use them too. It’s about being specific on what’s actually safe to hand over, because “don’t share sensitive information with AI” is too vague to be followed consistently.
Why this is genuinely a risk, not just theoretical caution
Depending on the tool and the plan you’re on, what you type may be stored, reviewed, or in some cases used to improve the underlying model. Even where a vendor’s policy is reassuring, your legal or contractual obligations to a client rarely have an exception for “but I asked an AI to help.” If you’ve signed an NDA or a data processing agreement, that document didn’t stop applying because the destination was a chatbot instead of a person.
What we tell our own team not to paste
- Client data — names, contact details, financial figures, anything covered by a confidentiality agreement
- Credentials and secrets — API keys, passwords, connection strings, tokens. Full stop, no exceptions, no “just this once to debug it faster”
- Unreleased or proprietary code where the license or client contract restricts sharing it outside the organisation
- Anything you wouldn’t be comfortable seeing quoted back in a stranger’s conversation, because that’s a realistic worst case for free-tier tools in particular
What’s usually fine
Generic questions, publicly available information, anonymised or synthetic examples, and code you’ve already open-sourced or that contains no identifying details. If in doubt, ask: would this be a problem if it appeared in a Google search result tomorrow? If yes, don’t paste it.
The practical fix
Business-tier AI plans generally offer real data controls — no training on your inputs, retention limits, admin visibility. If your team is using AI tools regularly (and they almost certainly are, policy or not), moving to a business plan with those controls costs less than the exposure of not having one. Pair that with a short, specific written policy — not a vague “be careful” — and you’ve closed most of the real risk.
If you want help thinking through what a sensible AI usage policy looks like for your team, get in touch — it’s a much cheaper conversation to have now than after something’s already been shared.