1. Check Your Company's AI Policy First
Before you even open an AI tool, your first stop should be your company's internal guidelines. Many organisations now have specific acceptable use policies that outline which AI tools are approved, what kind of data is strictly prohibited, and the proper
workflows for using them. Some companies have banned public AI tools like the free version of ChatGPT altogether, providing employees with secure, private enterprise versions instead. Others may have a list of sanctioned tools that have been vetted by IT and legal for data security. Ignoring these policies is the fastest way to create a security incident. An IBM study found that a significant percentage of users have unknowingly shared sensitive information with AI tools. If your company has no formal policy, treat all public AI platforms as insecure and raise the issue with your IT or security department. Don't assume that a lack of rules means there are no risks.
2. Understand the AI's Data Policy
Not all AI tools treat your data the same way. The most critical question is: does the service use your inputs to train its models? Many free, consumer-grade AI platforms state in their terms of service that they may use the content you provide to train future versions of their AI. This means your proprietary code, confidential client information, or strategic plans could potentially be absorbed by the model and inadvertently surface in a response to another user. This was a key concern in an incident where Samsung employees uploaded sensitive source code to ChatGPT, prompting a company-wide ban. Always check the tool's privacy and data retention policies. Look for options to opt out of data training, though these shouldn't be treated as a complete failsafe. Enterprise-level AI products, by contrast, typically offer contractual guarantees that your data will not be used for training and will remain private.
3. Aggressively Anonymise Your Data
If you are cleared to use an AI tool, the next step is to practice strict "prompt hygiene." This means stripping out any and all confidential or personally identifiable information (PII) before you paste. Never include real names, email addresses, phone numbers, financial figures, health information, or any data that could identify a customer or employee. Instead of pasting "Client John Doe's financial summary for Q3 shows a loss of ₹50,000," you should generalise it to "A client's financial summary for a recent quarter shows a significant loss." Replace specific project names, formulas, or snippets of secret source code with generic placeholders like `[Project X]` or `[Proprietary Algorithm]`. The goal is to provide the AI with enough context to be helpful without exposing any information that is unique or sensitive to your business.
4. Use the 'Public Forum' Test
A simple but powerful rule of thumb is to treat public AI chatbots like a public internet forum or social media. Before you paste anything into the prompt window, ask yourself: "Would I be comfortable posting this information on a public website with my name attached?" If the answer is no, then do not put it into a consumer-grade AI tool. Think of the prompt box not as a private conversation but as a submission to a third-party system that logs, analyses, and potentially stores your data indefinitely. This mental framework helps re-contextualise the action from a simple productivity hack to a potential act of public data disclosure. It forces you to consider the worst-case scenario—what if this conversation leaked?—and act accordingly to protect company and client information.
5. Distinguish Between Brainstorming and Exposing IP
Not all information carries the same level of risk. It's crucial to evaluate the type of content you are working with. Using an AI to brainstorm generic marketing slogans or to rephrase a non-confidential paragraph for clarity is very different from asking it to analyse a secret merger and acquisition document or debug a core piece of your company's proprietary software. The former is a low-risk activity that leverages the AI's creative capabilities. The latter involves feeding the company's crown jewels—its intellectual property (IP)—into a system outside of your organisation's control. Create a clear mental distinction between using AI as a general-purpose assistant for public-facing or non-sensitive tasks and using it as a confidant for core business secrets. The moment a task involves confidential strategy, unannounced products, or private data, the risk of using a public AI tool outweighs the convenience.
