Using AI safely at work
4 min read · Updated on 19 October 2026
AI assistants such as Microsoft Copilot, ChatGPT and Claude are handy for summarising, rewriting and brainstorming. The risk isn't in using them, but in what you paste into them.
The main rule
Anything you type or upload into an AI service leaves your organisation, unless the service runs through your work account and is set up for it. So treat a public chatbot as an unknown outsider.
Not in a public AI service
- Personal data of customers, employees or patients.
- Contracts, quotes, pricing agreements and financial figures that aren't public.
- Passwords, keys, internal documents and source code.
- Confidential emails or chats to be summarised.
Fine to do
- Copilot through your work account: Microsoft 365 Copilot or Copilot Chat with the shield that shows your data is protected. Your data then stays within your organisation and isn't used to train models.
- Anonymise first: replace names with "customer A", leave out amounts and add the details back yourself afterwards.
- Use AI for the form (tone, structure, translation) and always check the content yourself. AI makes up convincing-sounding nonsense, including about laws and figures.
Careful with extensions
Browser extensions and free AI tools that read along with your screen or mailbox often ask for access to everything. Don't install them without checking with your IT administrator.
For organisations
Copilot finds everything an employee can already access. If information is shared too widely, AI suddenly makes that visible. So map where sensitive data is stored and who can access it before rolling out Copilot widely.