What should never go into a public AI tool

Ask a room of thirty people whether they know what company data they may paste into ChatGPT and you will get thirty different answers, most of them guesses. That is not a discipline problem. Nobody ever wrote the rule down, so everyone drew their own line, and some of those lines are in the wrong place.

The line we help teams draw

• ✳Never: personal data about identifiable people, unless the tool is covered by your own agreement
• ✳Never: credentials, keys, or anything that grants access to a system
• ✳Never: material covered by an NDA with a third party
• ✳Care: unreleased financials, pricing, and anything commercially sensitive
• ✳Fine: your own drafts, public material, and work you would email externally without hesitation

The test that works in the moment

The rule people actually remember is simpler than any policy: would you be comfortable if this text appeared in a competitor’s inbox. It is not legally precise, but it is available in the two seconds before someone hits paste, which is when the decision is really made.

Approved tools change the answer

This all shifts when the company has an agreement in place. A business tenant of Copilot or an enterprise ChatGPT account with the right terms is a different proposition from a personal free account, and staff need to know which one they are in. Most accidental disclosures we hear about are someone using their own login for work material because it was the one already open.