Start now
For teams Agents Integrations Governed Runtime Pricing Enterprise Security Academy Compare Blog
Book a demo Sign in

Module 2 of 5 · 12 min read

Using AI safely at work

The fastest way to get AI banned in a company is a data leak. A few habits keep you and your organisation clear of that, without slowing you down.

The one question to ask before you paste

Most AI mistakes at work are not exotic. They come down to putting the wrong information into a tool. Before you paste anything into an AI assistant, ask yourself one question:

"Would I be comfortable if this ended up outside the company?" If the honest answer is no, do not paste it into a general AI tool. Use an approved, governed tool, or leave it out.

To make that judgement quick, sort information into three buckets. Think of it as a traffic light.

A traffic light for what to put into AI tools Green means safe: public information and your own rough drafts. Amber means check your policy: internal information that is not sensitive. Red means stop: personal data, customer records, credentials, financial, health, and confidential material, which need an approved governed tool. Green · go Public information, general questions, your own rough drafts and ideas. Amber · check your policy Internal but not sensitive: process notes, non-confidential plans, anonymised examples. Red · stop, use an approved tool Personal or customer data, passwords and keys, financials, health, anything under NDA.
When in doubt, treat it as red and check. Red is not "never," it is "not in a general tool."

Shadow AI: the risk you cannot see

Shadow AI is using AI tools your organisation has not approved, usually with good intentions and a personal account. The work gets done, so it feels harmless. The problem is what you cannot see: where that data now lives, whether it is retained, whether it trains a model, and the fact that nobody can audit any of it.

You do not need to become a security expert. You need one habit: use the tools your organisation has approved, and if the approved tool cannot do something you need, ask for the tool rather than working around it. A quiet workaround is exactly how sensitive data ends up somewhere it should not be.

Does AI train on what I type?

It depends entirely on the tool and the tier, and the difference is real money and real risk:

  • Consumer and free tools: often reserve the right to retain your inputs and use them to improve their models, unless you change a setting. Treat anything you type as potentially leaving your control.
  • Business and enterprise tools: usually contract not to train on your data and keep it isolated to your organisation. This is one of the main reasons companies pay for governed versions.

The safe default: assume a general, personal-account tool is not private, and save anything sensitive for a business tool your organisation controls. If you are not sure which tier you are on, that uncertainty is itself a reason to keep sensitive data out.

Four habits that keep you safe

  • Minimise. Share the least the tool needs to help. You rarely need the real names, numbers, or the whole document.
  • Anonymise. Swap real names, account numbers, and identifiers for placeholders when you just need the shape of an answer.
  • Never paste secrets. Passwords, API keys, and access tokens do not belong in any chat box, ever.
  • Mind attachments and links. Uploading a file or connecting a tool shares everything in it, not just the part you care about.

A note on AI that can act

Everything so far is about AI that answers. Some AI can now take actions in your real systems: send an email, change a record, move a file. That is more useful and higher stakes, because a mistake is not a bad paragraph, it is a real event. The safety idea there is approval before action and giving the AI only the access it needs. Module five covers this properly.

Key takeaways

  • Before pasting, ask: would I be fine if this left the company? If not, use an approved tool.
  • Sort data green, amber, red. Keep red out of general tools.
  • Shadow AI is unapproved tools. The fix is simple: use what your organisation approves, and ask for more when you need it.
  • Assume personal, free tools are not private. Sensitive work belongs in a governed, business tool.