Using AI safely
What’s safe to put into ChatGPT, Copilot and other AI tools at work?
AI tools can save real time on writing, summarising and planning. They can also create problems if people paste in client files, customer details or passwords, or send out answers nobody checked. You don’t need to ban them. You need a few clear rules about what goes in and what comes out.
The short version
The basics
- Use business versions with data protection, not personal free accounts.
- Don’t paste personal information, client confidential data or passwords.
- Check every fact, figure and reference before using it.
- Be clear with clients when AI has been used.
The two risks
What goes in
Anything you type or upload may be stored by the provider, reviewed, or in some consumer services used to improve their models, depending on the account and settings. Personal information you put in is still covered by privacy obligations. Client information may be covered by confidentiality agreements.
What comes out
AI tools can be confidently wrong. They invent facts, references, legal points and figures that look plausible. Using an answer without checking it can embarrass you in front of a client, or worse.
A traffic-light rule for staff
| Colour | What it covers | Examples |
|---|---|---|
| Green: fine | Public or general information | Drafting a job ad, brainstorming, rewording your own public website text, explaining a concept |
| Amber: approved tools only | Internal business information without personal or client detail | Summarising internal notes, drafting a policy, analysing anonymised figures, in your business AI tool |
| Red: never | Information that’s personal, confidential or secret | Customer or patient details, client documents under NDA, passwords and keys, staff HR matters, unreleased financials |
Removing names isn’t always enough to make information anonymous. Details like dates, locations and job titles can still identify someone.
Use the right version of the tool
Business plans of the major AI tools, such as Microsoft 365 Copilot, ChatGPT business plans and Gemini for Google Workspace, typically offer stronger data protections than free personal accounts. Common commitments include not training models on your business data and keeping it within your organisation’s environment.
Check the current terms for the specific plan you use. Make sure staff use the business account you provide, not their personal one.
The OAIC has published guidance
The Office of the Australian Information Commissioner recommends that organisations don’t enter personal information, particularly sensitive information, into publicly available AI chatbots. Its guidance on commercially available AI products is a useful read for any business.
Checking what comes out
- Verify facts and figures against an original source before using them.
- Check every reference, link and quote. AI tools can invent sources that don’t exist.
- Read for tone and accuracy before sending anything to a client.
- Don’t rely on AI for legal, financial, medical or safety advice without a qualified person reviewing it.
- Keep a human responsible for the final version.
Newer risks to know about
- Prompt injection: documents, emails or web pages can contain hidden instructions that try to make an AI assistant do something it shouldn’t, like reveal data. Be careful when connecting AI tools to email, files or other systems.
- Fake AI tools: browser extensions and apps pretending to be popular AI tools can steal data. Install only from official sources.
- AI-written scams: phishing emails and fake voices are getting more convincing. See our phishing guide.
Putting a simple policy in place
For most small businesses, one page is enough:
- Which AI tools are approved, and through which accounts
- The traffic-light rule above
- That people check and take responsibility for anything AI helps produce
- When to tell clients that AI was used
- Who to ask when unsure
Common questions
Can I paste an email from a client and ask AI to draft a reply?
Only in an approved business tool, and remove details you don’t need. Don’t paste anything you’ve agreed to keep confidential into a personal account.
Is it okay to use AI to write code for our website?
It can help, but review it carefully for security issues and never paste in passwords, API keys or customer data.
Do we have to tell customers we use AI?
It depends on the context and any agreements you have. Being upfront is usually the safer choice, especially where AI affects decisions about people.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.