Employees should only enter company information into AI tools when their employer has approved both the tool and the type of information being shared. Public information may be suitable for some tasks. Confidential business details and personal data need much tighter controls.

AI can help with writing, planning and everyday admin. But copying a customer email or uploading a spreadsheet may send information outside the business. Before staff press “send”, they need to know what is allowed.

What counts as company information?

Company information includes more than financial reports and business plans. It can also be:

• Customer emails and contact details.
• Staff records, salaries and sickness notes.
• Contracts, supplier prices and sales figures.
• Meeting notes and internal messages.
• Passwords, access codes and private computer code.

Some information, such as a published opening time, is already public. Other details could harm the business or an individual if shared.

A useful starting question is: “Has this information been approved for sharing outside the company?” If the answer is unclear, staff should check before entering it.

Why can sharing information with AI be risky?

Depending on the service and account settings, an AI provider may store what users enter or use it to improve its systems. Businesses need to check the provider’s terms, privacy information and security arrangements.

Entering information does not automatically mean it becomes public. However, it may leave systems that the employer controls.

The National Cyber Security Centre (NCSC) advises against including sensitive information in questions sent to public AI chatbots. That includes details which would cause problems if made public.

For example, asking for a general customer service email template is different from pasting in a real complaint with a customer’s address and payment details.

Is a paid AI account safe for work?

A paid subscription alone does not prove that an AI tool is suitable for company information. A personal paid account may have different terms and controls from a business service.

Before approving a tool, an employer should check:

• Whether entered information is used to train AI models.
• How long information is kept and how deletion works.
• Who can access it, including the provider and its suppliers.
• Where it is processed and stored.
• Which security controls and contract terms apply.

Turning off model training does not answer every privacy or security question. The business still needs to understand how the service handles its information.

Approval should also have limits. A tool approved for drafting public social posts may not be approved for processing staff records.

What about customer and employee personal data?

Personal data is information that identifies someone, either on its own or alongside other details. Names, email addresses and information about an identifiable customer or employee can fall into this category.

UK data protection rules still apply when personal data is used in AI tools.

Businesses need a valid legal reason for using that data, must explain its use appropriately and must protect it. Health information and some other sensitive personal details need additional safeguards.

Using AI does not always mean a business needs a new legal reason for processing personal data. However, new purposes or sharing arrangements need proper checks.

Before allowing these uses, employers should involve whoever handles data protection in the business.

Does removing names make information safe?

Removing a name is a useful step, but it may not make a document anonymous.

An address, job title, exact date or unusual event could still identify someone. Replacing a name with “Customer A” may leave enough detail to work out who the person is.

Staff should not assume that removing names gives them permission to upload a document.

Where possible, use a made-up example instead. To improve the tone of a complaint reply, staff could ask for a polite response to a fictional delivery delay without sharing the real customer’s message.

What should a workplace AI policy cover?

A workplace AI policy should give staff clear, practical rules. It should explain:

• Which tools and accounts are approved.
• Which tasks staff may use AI for.
• What information must stay out of each tool.
• Who can approve a new use.
• How staff should check AI answers.
• Who to tell if information is shared by mistake.

The rules should cover file uploads and AI features built into other software, as well as chatbots. Meeting assistants, for example, may capture private discussions without anyone pasting text into a chat.

Give staff examples from their own jobs. “Do not upload customer records to an unapproved AI tool” is easier to follow than “use AI responsibly”.

Employers should also ask why staff want to use AI. Understanding the task can help the business provide a suitable, approved option.

Should someone check AI-generated work?

Yes. AI can produce answers that sound convincing but contain mistakes.

A person with the right knowledge should check facts, figures and wording before the work is used. Staff should take particular care with customer messages, contracts and information about people.

Approval to use an AI tool is not approval to send its answer without review.

What if someone shares information by mistake?

Staff should report the incident straight away to the manager, IT team or data protection contact named in their workplace policy.

They should explain which tool was used, what was shared and when it happened. Deleting a chat alone does not prove that every copy has been removed.

The business should assess the incident and take steps to limit harm. An unauthorised disclosure of personal data may be a personal data breach.

Not every breach must be reported to the Information Commissioner’s Office (ICO). Where reporting is required, the organisation must notify the ICO without undue delay and within 72 hours of becoming aware of it. Breaches must also be recorded, even when they do not need to be reported.

A quick check before pressing send

Before entering company information into AI, employees should ask: Is this tool approved? Is this information allowed? Could I complete the task with less detail?

If any answer is unclear, pause and ask. Clear rules can help staff benefit from AI while protecting the information people trust the business to hold.

For more straightforward guides on digital safety and protecting your information, explore the One Call Insurance blog.

Sources

• National Cyber Security Centre: The hidden risks of shadow AI National Cyber Security Centre
• Information Commissioner’s Office: Personal data breaches: a guide ICO