Safer AI use at work: what to share and what to keep private

A quick primer before the walkthrough: Read this before you paste anything sensitive into any chatbot.

In plain English: Not all AI tools are equal, and not all data can be pasted anywhere. This tutorial gives you a simple rule of thumb and a starter policy framework your team can adapt.

Key terms:

• Tenant / Enterprise tier — paid business versions of AI products that typically offer contractual data protections, though specific terms vary by agreement and vendor.
• Model Training — the process of using prompt inputs and outputs to improve future AI models. Many enterprise agreements offer options to opt out or restrict training, but you must check your organization's specific contract.
• PHI / PII — Protected Health Information / Personally Identifiable Information.

Comfort level: No prior AI or legal background needed. This material is for informational purposes only and does not constitute legal, regulatory, clinical, or medical advice.

The one rule of thumb

If it would be a problem for this data to leak or be improperly disclosed, check your organization's governance guidelines before pasting it into any AI tool.

That is 80% of the policy. The other 20% is understanding your organization's specific contracts, configuration settings, and technical boundaries.

A simple traffic-light system

Adapt this framework to your organization's internal SOPs; it serves as a practical starting point for discussion with your compliance team.

🟢 Green — minimal risk in general tools

• Public papers, press releases, ClinicalTrials.gov data.
• Generic coding or methodology questions (for example, "Explain how DESeq2 handles low counts in RNA-seq analysis").
• Draft marketing text for publicly announced products.

🟡 Yellow — enterprise tier only, subject to internal policy and lead approval

• Internal non-regulated SOPs, protocols, and meeting notes.
• Internal financial forecasts or draft presentations.
• Unpublished preliminary research or non-sensitive experimental results.
• Non-final draft regulatory documents.

🔴 Red — restricted processing (requires explicit legal/compliance approval and executed agreements)

• PHI or patient-level clinical trial data (processing requires appropriate executed agreements, such as a Business Associate Agreement (BAA) or Data Protection Addendum (DPA), as well as internal privacy approval).
• GxP-regulated records or validation data (commercial AI tools may support, but do not satisfy, your validated-records requirements).
• Proprietary trade secrets, key IP, or unannounced molecular structures.
• Data covered by third-party Non-Disclosure Agreements (NDAs) that prohibit third-party or automated processing.

Consumer vs enterprise tiers, plainly

Note: Always check your organization's current agreement with the vendor, because vendor terms, privacy policies, and default configurations change over time.

Bottom line: For yellow data, use an enterprise tool approved by your organization. For red data, do not paste into standard commercial AI tools unless your privacy, legal, and compliance teams have explicitly authorized the specific platform, configurations, and signed agreements.

A 5-line starter policy your team can adapt today

1. Use only company-approved AI tools designated by IT and compliance.
2. Do not paste PHI, patient identifiers, or GxP-regulated records into any AI tool without explicit authorization and verified agreements.
3. Internal non-public documents may only be processed in approved enterprise-tier tools configured for your tenant.
4. Treat every AI output as an unverified draft; a human expert remains responsible for review and final decisions.
5. When in doubt regarding data classification, consult your security or compliance lead before pasting.

Practical patterns that reduce risk

• De-identification as risk reduction. Replacing direct identifiers (names, MRNs, dates) reduces exposure risk, but indirect identifiers or complex biological datasets can still permit re-identification. Treat placeholder substitution as a risk-reduction measure and subject sensitive datasets to internal privacy review under your SOPs.
• Use internal architectures (e.g., RAG over internal document stores). Connect enterprise AI tools to indexed internal document stores rather than manually copy-pasting raw text, and follow your IT team's guidance on which stores may be indexed.
• Documenting inputs and outputs. Saving prompts and outputs can support internal administrative traceability. However, preserving AI outputs may extend data retention obligations and does not satisfy validated-records requirements (such as 21 CFR Part 11) on its own. Follow your organization's record-retention SOPs.
• Enterprise integration tools. Enterprise tools such as Microsoft Copilot are designed to respect existing tenant permission boundaries, though administrators must still verify system configurations and data access controls.

What to try next

• Choosing the right AI tool
• Your first ChatGPT prompt for lab and office work

If something goes wrong

• You already pasted something you should not have. Tell your manager or IT promptly — early disclosure is almost always the cheaper outcome.
• You are not sure whether a tool is approved. Ask before you use it; approval usually depends on the specific tenant or plan, not the brand name.
• A colleague shares an AI-written document with unclear sourcing. Ask where the numbers came from before it is reused.
• The rules at your site differ from this tutorial. Your organization's policy wins, always.