AI Without the Hype · Part 4 of 10
“Can I paste this into AI?” sounds like a simple question. The answer depends on what “this” contains, which tool and account you are using, and what your business is allowed to share.
A public product description and an employee’s disciplinary record need very different treatment. A tool’s business account and personal account may also have different terms and controls. Check the actual service and plan instead of assuming the brand name settles the question.
For a small business, the useful first step is to decide what information a particular task needs and whether the intended tool is approved to receive it.
Start with the least information that will do the job
Suppose you want help improving an overdue-payment reminder. To test the wording, you can use a fictional customer, a made-up balance, and a sample due date. You do not need to upload the receivables ledger.
If the task later becomes drafting real reminders, the decision changes. Now you need to consider customer information, access to records, and how the drafts will be reviewed and delivered.
Removing a name does not necessarily remove identifying details. An address, unusual job description, account number, or combination of facts may still reveal who the record concerns. Look at the whole input, including attachments and hidden spreadsheet tabs.
Give your team a usable rule
I would start with three practical groups, then adjust them for the business.
- Public material already approved for release can be used in approved tools for appropriate tasks.
- Internal material needs an explicit decision about which tools, accounts, and uses are allowed.
- Restricted material stays out unless the business has specifically approved that workflow and its protections.
Restricted examples could include passwords, private keys, payment credentials, sensitive employee records, and confidential customer information. The precise boundary depends on your agreements, obligations, and the information itself.
These groups are a starting policy structure, not a certification that an upload is lawful or secure. When information is subject to specific professional, contractual, or regulatory requirements, have the relevant specialist review the proposed workflow.
Check more than the training setting
Whether a provider uses your content for model training is one question. Also ask how long information is retained, who can access it, what deletion covers, and what happens when a connected service receives a copy.
Check the provider’s current documentation and your contract for the exact plan. If the answers are unclear, get clarification before uploading sensitive information. A paid subscription alone does not establish that the tool meets your requirements.
The UK National Cyber Security Centre’s guidance discusses the security issues surrounding language models and the importance of protecting sensitive information. The practical implication is to treat a new AI service as another service receiving business data, with a specific purpose and an access decision.
Connections deserve their own review
A manually pasted paragraph and access to an entire shared drive are different arrangements.
Before connecting an inbox, file store, or customer relationship management (CRM) system, find out what the tool can read and what it can change. Can access be limited to a specific folder or account? Does it inherit existing permissions? Can it send messages, create records, or delete files? Who can disconnect it?
Start with the smallest access the task needs. If you only want draft answers from an approved FAQ, unrestricted access to every company document is difficult to justify.
Remember that the output can contain sensitive material too. A summary copied into a team channel may reach people who could not access the original document.
Make the right choice easy on a busy afternoon
A policy that says “use good judgment” gives staff very little help when they need an answer now.
Name the approved tools and accounts. Give examples of permitted and restricted inputs. Identify who answers questions and what someone should do if information goes into the wrong place.
Use a simple example in training: “You can test this reminder using fictional details. You cannot upload the customer ledger to your personal account.” That is something an employee can apply without interpreting a long policy.
If a mistake happens, have the person stop further sharing and report what was uploaded, where, and when. Follow your incident process and involve the right people. Do not assume deleting the visible chat resolves every copy or retention issue.
The decision to make before the upload
Write down the task, the information required, the approved tool and account, the access granted, and the person responsible. If any of those is unclear, use a fictional example while you resolve it.
You can learn whether a workflow is promising without making your most sensitive records the test data.
Source
NCSC: ChatGPT and large language models, what’s the risk?. The policy structure and examples above are suggested operating practices; check current provider terms for your specific service.