AI tools can save real time at work, and most of the risk comes from a handful of avoidable mistakes: pasting in the wrong thing, trusting an answer without checking it, or using a tool your employer doesn't know about. Here's a plain-English checklist, based on guidance from the UK's National Cyber Security Centre.

Before you rely on this: it's general guidance, not legal advice, and your employer's own AI policy comes first. The official sources are listed at the end.

Why this matters

When you type into a public AI tool such as the free versions of ChatGPT, Gemini or Copilot, your words leave your organisation. The National Cyber Security Centre (NCSC) puts it simply: the query "will be visible to the organisation providing the LLM", and queries are stored. Stored data can be "hacked, leaked, or more likely accidentally made publicly accessible."

None of that means you shouldn't use AI at work. The NCSC says organisations should make sure people who want to experiment with these tools are able to. It means using them with the same care you'd give an email to someone outside the company.

The checklist

1. Check what your employer allows

Many organisations now have an AI policy, and some provide approved tools with business-grade data protections. Use those if they exist. If there's no policy, ask your manager or IT team before using AI with work material. It's a two-minute conversation that protects you as much as the company.

2. Keep sensitive information out of public AI tools

This is the NCSC's main recommendation: do "not include sensitive information in queries to public LLMs." In practice, that means leaving out:

  • customers' or colleagues' names, contact details and anything else that identifies a person
  • financial figures, contracts and pricing that aren't public
  • passwords, access codes and system details
  • anything marked confidential.

If you need help with a document, swap the real details for placeholders such as [CLIENT] or [AMOUNT] before you paste it in. If the information is about identifiable people, data protection law applies to how it's handled, which is another reason to ask before you share it.

3. Remember the question can be sensitive too

The NCSC makes a point that's easy to miss: a query can be sensitive because of who is asking, not just what it contains. Its example is a chief executive asking how best to lay off an employee. Its advice is not to submit queries "that would lead to issues were they made public."

4. Check the tool's data settings

Read how the tool uses what you type. OpenAI's plans page, for example, says conversations on its individual plans are used to train its models unless you opt out, and that an opt-out is available. The NCSC says the terms of use and privacy policy "need to be thoroughly understood before asking sensitive questions."

5. Check every answer before you use it

AI tools can produce answers that sound right and aren't, with invented facts, figures or references. The UK government's AI Playbook calls this hallucination. Check names, numbers, dates, quotes and anything legal, financial or technical against a trusted source, and never send an AI-written message you haven't read properly.

6. Keep the decision with a person

Use AI to draft, summarise and suggest, not to decide. The government's Playbook notes that language models lack "critical thinking, personal experience and judgement" and aren't a substitute for professional advice. Decisions about people, money or safety should rest with someone who can explain and stand behind them.

7. Be open about where AI helped

If AI drafted a report or summarised a meeting, say so when it matters, especially if someone will rely on the content. Being open about it heads off awkward questions later.

Good, low-risk ways to start

The safest uses are the ones where nothing sensitive goes in and you check what comes out:

  • Rewording your own writing so it's clearer or shorter.
  • Explaining a term, a process or a piece of public guidance.
  • Brainstorming headings, ideas or questions for a meeting.
  • Turning your own rough notes into a tidy structure, with names removed. The AI meeting notes workflow shows how.
  • Drafting templates that you then fill in with the real details yourself.

Better prompts make all of this quicker and safer, because you get a usable answer without pasting in more than you need to. How to write AI prompts that actually work covers the method.

When the data has to stay private

For information that can't leave your control, the NCSC notes that private AI models, such as ones offered by a cloud provider or self-hosted, may be appropriate for organisational data after a proper assessment. At the small end of that, running a private AI assistant with Ollama keeps everything on your own computer. And if you're weighing up tools for a team, Microsoft Copilot vs ChatGPT compares the two most workplaces start with.

If you run a small business and want AI set up properly rather than piecemeal, the guide to AI tools for small business covers where to start, and I build automations for small businesses on the services page. New to AI altogether? Your First 30 Days With AI is my eight-module beginner course, and the first two modules are free.

Want more plain-English AI guides? I send one practical guide a week to my newsletter. Sign up here and I'll send the next one straight to your inbox.

Questions people actually ask

Is it safe to use ChatGPT at work?

It can be, if your employer allows it and you keep sensitive information out. The UK's National Cyber Security Centre recommends not including sensitive information in queries to public AI tools, and checking the tool's terms and privacy policy first.

What should you not put into AI tools?

Personal information about customers or colleagues, passwords, confidential business details, financial figures that aren't public, and anything that would cause problems if it became public. Replace real details with placeholders before pasting a document in.

Can my employer see what I type into ChatGPT?

On a personal account, what you type goes to the company that runs the tool, not to your employer. On a work account or an approved business tool, your organisation may have access depending on how it's set up, so check your employer's policy.

Do AI tools use what I type to train their models?

Some do by default. OpenAI, for example, says conversations on its individual ChatGPT plans are used to train its models unless you opt out, and an opt-out is available. Check the data settings of whichever tool you use.

How can I use AI at work without breaking the rules?

Use the tools your employer approves, keep sensitive information out, check every answer before you rely on it, and keep decisions with a person. Starting with low-risk tasks, such as rewording your own writing, is a good way in.

Sources