What it is
Write a short rule that says which kinds of data may go into which AI tools. Most companies need only three groups:
| Data | Example | Where it may go |
|---|---|---|
| Public | Text from your website, published prices | Any AI tool |
| Internal | Plans, drafts, internal figures | Only AI tools the company has approved |
| Restricted | Personal data, client files, health details, contracts, passwords | Only tools approved for that data, or none |
A public tool is one anyone can sign up for, such as the free version of a chatbot. What you type into it is held by the company that runs it.
What the evidence shows
Two documented cases and regulators’ guidance are the basis for this advice. No study has tested it.
- What goes in is out of your hands. A child protection worker at a government department in Australia typed a family’s details into ChatGPT. The privacy regulator found that the information had been disclosed to the company behind the tool and “released outside the control” of the department.
- One file can hold thousands of people. At a state agency in Australia, a temporary worker uploaded one spreadsheet to ChatGPT. It held names, addresses, dates of birth and health information for 2,031 people.
- A rule on paper was not accepted as enough for the most sensitive work. In the first case the regulator ordered named AI tools to be blocked for child protection staff. It said the risk was too great “to be managed by policy and guidance alone”. In the second, the agency put in controls that block uploads of personal information to AI tools.
- A data limit can stop people using a tool at all. At HMRC, the UK tax authority, staff could use Copilot only on material below the “Official Sensitive” level. Among staff given a licence who did not use it, 46% cited security and data concerns. Say clearly what is allowed, not only what is not.
- Regulators say it plainly. Australia’s privacy regulator recommends that organizations “do not enter personal information, and particularly sensitive information” into publicly available AI tools.
How to do it
- Write the three groups for your company, with two or three examples each from your own work.
- List your AI tools and note which group of data each tool may receive. Include AI features switched on inside software you already pay for: meeting notetakers, bookkeeping assistants, email drafting. Small firms told a Federal Reserve survey that some AI arrived inside software they already used, and one said its bookkeeping software’s AI feature could not be disabled. For each approved tool, check what the supplier does with what you type: whether it is kept, and whether it is used to train the supplier’s systems. See ask AI vendors for proof.
- Give staff an approved tool. If the only rule is “no”, people will use a public tool on their own account. Pick one, read its terms on what happens to your data, and pay for it.
- Teach one habit: strip the details. Most tasks work without names. Replace the client’s name with “the client” and remove figures that identify someone.
- Block where a mistake would be serious. For teams that handle health, children’s, financial or legal files, ask your IT supplier to block public AI sites or uploads to them.
- Limit bulk downloads. The agency above also restricted manual downloads from its core systems. A file that cannot be exported cannot be uploaded.
- Put the rule in your one-page AI-use policy.
What to measure
- Whether every AI tool in use is on the list, with its data group.
- The number of staff with access to an approved tool, against the number who need one.
- Uploads blocked, if you have blocking in place. A rising number shows where an approved tool is missing.
Where it fails
- No approved alternative. The department in the first case had no rules and no approved tool, and about 900 staff had opened ChatGPT.
- Too many groups. Five levels of classification will not be remembered. Three is enough.
- Temporary staff and contractors are left out. The upload in the second case was made by a temporary worker.
- The rule covers typing and forgets files. Uploading a spreadsheet is the faster way to leak a lot.
By company size
- Micro and small: one sentence may be enough: no client or personal details in any free AI tool. That rule does not cover AI that runs by default inside paid software. Check those settings too. Buy a business plan for the tool you use most.
- Medium: the three-group table, an approved tool for everyone, and a block for the teams with the most sensitive data.
- Mid-market and enterprise: the same table tied to your existing data classification, with technical controls on uploads and downloads.
Company cases
Companies that did this
- Ashurst The firm’s general counsel, risk and information-security teams set strict rules for each trial. Only public data was used, and no client data.
- Gilberts Chartered Accountants It is “a firm-wide rule that no client-specific or confidential data is to be entered into open/public AI models”, and the firm asks clients to approve specific AI tools.
- HM Revenue & Customs (HMRC) During the trial, staff could use Copilot only on material below the Official Sensitive security classification.
What happened without it
Companies that came round to it
Sources
No published study tests this practice directly, so it is rated Common practice. The rating rests on the company cases above and on the sources below.
- Office of the Australian Information Commissioner (October 2024, updated January 2025). Guidance on privacy and the use of commercially available AI products. oaic.gov.au
- Office of the Victorian Information Commissioner (September 2024). Investigation into the use of ChatGPT by a Child Protection worker. ovic.vic.gov.au
- Sanchez-Moyano, Holmes and Simms (2026). AI Adoption Among Small Businesses: Qualitative Insights from the Small Business Credit Survey. Federal Reserve Bank of San Francisco, Community Development Research Brief 2026-01. frbsf.org
Related practices
- Write a one-page AI-use policy staff will actually read Put the rules for AI on one page: which tools are allowed, what must never be typed in, who checks the output, and who to ask. Then build the most important rule into the work itself, because a page alone gets ignored. Do first · Effort: low (days, one person)
- Ask AI vendors for proof before you buy, and test on your own material Do not take an AI vendor’s accuracy figure or “fully compliant” promise on trust. Ask how it was tested and on what, run a small test on your own material, and check the terms on your data and on leaving. Do first · Effort: medium (weeks, a few people)
- Know the rules that already apply to your AI use Most of the rules that bind your use of AI are not AI laws. You answer for what your AI says and does under the consumer, privacy, advertising and professional rules you already follow. List your AI uses and match each to its rules. Do first · Effort: low (days, one person)
- Train staff on the tools you actually chose Show every user what your chosen AI tool is, where it goes wrong, and what they must check. Use your own tasks and your own rules, give people time to practise, and include temporary staff. Do first · Effort: medium (weeks, a few people)