Before you paste work into an AI tool
Artificial intelligence (AI): tools that generate answers, text or images.
Pause before sharing work. Use an approved route, or ask with a made-up example.
1. Use the approved tool and account
Check which service, account and type of work your business has approved. A personal account is not automatically covered by a work licence or rule. If there is no clear approval, stop and ask your manager before using work information.
2. Keep private work out of public tools
Do not put passwords, sign-in codes, customer or staff information, unpublished contracts or private business records into a public AI tool: a general-use service not approved for this work. This includes attached files, screenshots and connected work folders, not just the text you type. Use your business's approved process for any permitted sensitive work.
3. Use a made-up example instead
If you only need help with wording or a method, write a general question or invent a small example from scratch. Replacing a name in a real document is not enough: dates, locations, job details and other clues may still identify someone. This guide cannot decide that a document is anonymous (no longer identifies anyone).
4. Check before the answer becomes work
Check facts, calculations, dates and source links yourself. Do not send, publish or rely on the answer as professional advice just because it sounds confident. Use your normal review and approval process; do not use this card to approve decisions about people.
A fictional request to avoid
Fictional request to avoid: "Draft a performance warning for Maya, our only night-shift supervisor at the fictional Northfield Repair shop, after the incident on 12 September. Here are her notes and health details..." Removing "Maya" still leaves identifying clues and private information. No real staff member or incident is described.
A fictional alternative
Fictional alternative: "Create a neutral outline for a manager to prepare for a routine staff meeting. Use no personal information, do not make a decision about anyone, and leave placeholders for facts and review by the responsible person." This asks for a generic structure rather than putting a real staff record into the tool. It is not an approved staff-management decision or legal advice.
If you already pasted work
Stop sending more work to the tool. Tell your manager or the person responsible for protecting information promptly. Record which service and account you used, when, what type of information was sent and whether it was shared or connected elsewhere. Use your approved incident record; do not copy private text into another public tool to ask for help. Preserve enough evidence for the review. Follow the service's current help and your business's instructions to limit further access. Deleting a chat is not proof that every copy is gone. If a password or sign-in secret was exposed, use your account-recovery process. If information about people was involved, the responsible person should assess the risk using current guidance from the Information Commissioner's Office (ICO), the UK data protection regulator. Not every incident needs an ICO report; a reportable personal-data breach must be reported without unnecessary delay and, where feasible, within 72 hours of awareness. Do not wait for this guide to decide.
What a manager needs to check
Approval depends on the exact service, account, settings and proposed use. Read its current terms and privacy information: what is kept, who can access it, whether it may be used to improve the service, connected sources, sharing, deletion and any limits your business needs. Features and terms can change. "Business account", "private mode" or "training off" alone is not enough to establish approval. Ask the responsible person about legal duties and contracts before work involving personal or confidential information. This card does not replace that assessment.
Limits
This card does not inspect your question, instructions or files, remove private information, check a service's settings or give legal approval. It is a free companion to the existing security packs and course, not a new qualification or a complete AI policy. General guidance, not legal or professional advice. Not endorsed by cited organisations. Check current provider terms for the exact service, account and use.