ChatGPT, Claude, Copilot or Gemini · Practical walkthrough

Work out what you are allowed to put into an AI tool at work

You have a supplier quote open and an AI tool open, and the honest answer to whether the first may go into the second is that you don't know. The policy, if there is one, mentions confidential information without saying which of your documents that means.

Task by Task16 min read + practice

What you'll make

a one-page note listing the kinds of information you handle, each marked P, A or N (yes, ask first, no), with the person or document that decided it and the date.

What you'll need

the exact AI account you’d use, your organisation’s AI or acceptable-use policy if there is one, the names of the people who own the policy, data protection and the tool’s contract, and a week for replies.

Example result.

What it is	P / A / N	Who decided, and when
Supplier quotes we issued, in the company Microsoft 365 account	P	Line manager, 7 Oct
Anything a client sent us	N	Line manager, 7 Oct
Internal pricing sheet	A	Asked policy owner, 6 Oct; no answer yet

If you’ve already put something into a tool and you’re uneasy about it, stop here. That’s an incident: report it to IT or your incident process today. Don’t paste the material into another tool to investigate, and don’t delete anything unless the incident team tells you to.

1. Name the account and check its settings

“I use ChatGPT at work” can mean two different arrangements. Write down the exact account: the company workspace you sign into with your work login, or a personal one. Then read what the vendor says about it. That makes your questions specific; it doesn’t answer them.

ChatGPT: OpenAI doesn’t use Business, Enterprise, Edu or API content to train its models by default. On personal plans the control is Improve the model for everyone in Settings › Data controls. Even with it off, a thumbs up or down can send that whole conversation for training.
Claude: Anthropic doesn’t train on Claude for Work or API content by default. A thumbs up or down stores the whole conversation for up to five years; Team and Enterprise owners can turn this off with Rate chats in Organization settings › Data and Privacy. Free, Pro and Max are consumer plans with their own privacy settings.
Microsoft Copilot (formerly Microsoft 365 Copilot): prompts, responses and Microsoft Graph data aren’t used to train the foundation models, and Copilot only shows content you can already view. Your prompts and responses are kept as activity history, which admins can set retention for in Microsoft Purview.
Gemini in Google Workspace: on Google AI plans, Gemini in Gmail, Docs and Drive doesn’t use your content for training or store prompts without permission. The exception: if you share Workspace data with Gemini Apps or Search through a personal account, those products’ terms apply and it may be used for training.

Why this works: “they don’t train on it” is about what the vendor does. Whether you may send it is your organisation’s decision.

What you should see: one named account, and a line or two on its training and retention settings.

2. List what you handle

Policies talk in categories: confidential, personal, sensitive. You’re holding a specific PDF. Write the list as things, mark each P, A or N, and leave the decision column blank until someone fills it.

What I may put into [exact account] — [your name] — [date]

| What it is | P / A / N | Who or what decided, and when |
|---|---|---|
| Customer name and email | | |
| Unsigned supplier quote | | |
| Candidate CV | | |
| Internal pricing sheet | | |
| [your own] | | |

The first time, nearly everything is an A, and that’s the right result. Describe items in words, without attaching files: a distinctive example can identify someone even without a name.

Why this works: the decision column is the whole point. A row with nothing in it isn’t a permission; it’s a guess with a tick next to it.

What you should see: a list of five to ten things, mostly marked A, with empty decision columns.

3. Ask the people who decide

Send each owner a question with a one-line answer. In a small firm, one person may cover several.

Policy owner (often IT): “Which AI accounts are approved for work use, and is there a written list I can link to?”
Data protection contact: “Has anyone recorded a position on putting personal data into [account]? Which kinds does it cover, and where is it written?”
Contract owner (IT, procurement or finance): “Are we using [account] under a business agreement, and does it cover everyone using it?”
The person whose information it is, often your manager: “Are you content for [specific item] to go into [account]?”

[account] is the exact account from step 1; [specific item] is a row from your list. Keep the dated replies. If two conflict, ask the policy owner to reconcile them; don’t pick the one that lets you proceed.

Why this works: a one-line question gets answered this week; “could we have a chat about our AI position” gets moved twice.

What you should see: dated replies you can quote, and a clear owner for anything still open.

4. Turn the answers into the note

If the replies are fine to put into your account, an assistant can arrange them. Otherwise, fill the note by hand.

Turn these replies into a one-page note of what I may put into [account]. Use three sections: "Permitted", "Ask first" and "No". For every permitted line, name the person or document that decided it and the date. If no person or document is named in my notes, put the line under "Ask first" with who I asked and when. Keep every "no" exactly as given. Don't infer permission from a vendor's training statement, a paid plan or someone saying a tool is available. Don't state whether anything is lawful.

My list and the replies:
[list and replies]

[list and replies] is your table from step 2 and the dated answers.

Why this works: requiring a named decider for every yes stops a general statement becoming a specific permission.

What you should see: every line in the first section naming a person or document, and nothing moved up without an answer.

Check the result

Every P names a person or document and a date.
No line moved from A to P without a reply that covers it.
Every N from the policy is still there.
The account is named exactly, such as “the company Microsoft 365 account”, not “work AI”.

The usual failure: the note promotes a line because a vendor page says the data isn’t used for training, or because someone said the tool is available to everyone. Both answer a different question. Check every P against the reply it cites.

The line "[line]" is marked permitted, but [source] doesn't decide that: [why]. Move it to "Ask first" and keep the reply in its notes. Check the other permitted lines for the same mistake. Don't change any "No" lines.

[line] is the row, [source] the reply or page cited, and [why] what it really says.

Worked example: four emails and one unwelcome discovery

Fictional example. Joanna, office manager at a sixty-person professional services firm, is asked to use AI to tidy supplier correspondence. She lists nine things, marks them all A, and sends the questions on Tuesday 6 October.

IT, Tues: No approved list. We have Microsoft 365; Copilot Chat is available to everyone. Nothing else is approved.
Practice manager (data protection), Thurs: A 2025 position says no client personal data in "AI tools". It doesn't list tools or define the term.
Finance, next Mon: No AI contract. Two expense claims for personal AI subscriptions were approved in the spring.
Line manager, Weds: Fine for supplier quotes we issued ourselves, not for anything a client sent us.

The assistant’s first note put “internal pricing sheet” in the first section, citing IT: “Copilot Chat is available to everyone.”

The failure. IT confirmed which account exists, not what may go into it. Nobody had decided the pricing sheet.
The repair. The repair prompt with that line, “IT’s reply” and “it confirms the account, not the content” moved it to Ask first. The final note has one P (supplier quotes the firm issued, company Microsoft 365 account, manager, 7 October), one N (anything a client sent) and seven lines under Ask first, each with who was asked and when.
The discovery. Two colleagues use personal subscriptions, so their work sits under consumer terms. Joanna doesn’t raise it as a conduct matter. She sends IT and finance the vendors’ consumer and business pages with one line: “These are different products with different defaults. Worth a decision.” Respond sensibly to shadow AI covers what a team does next.

Task kit for this job: Download (ZIP) · Reusable instructions

Go deeper

Optional training: When there's no policy at all

No policy isn’t permission, and it isn’t a reason to wait six months. The smallest workable interim decision is three lines: the named account people should use, two or three things that definitely don’t go into it, and the person to ask about anything else. Dated, and signed off by someone who can sign things off. Offer the policy owner a blank version of your note to fill in; that’s quicker than asking them to write a policy.

Optional training: Check the whole route, not just the chat

Permission to paste public text into a chat doesn’t cover connecting a shared drive, uploading a recording or sharing the conversation. Ask about each route separately, and about who can see the result. Turning off training also doesn’t mean immediate deletion; retention is a separate setting, often controlled by your admin. For connector approvals, see Explain an AI integration request to the person who has to approve it.

Optional training: Keep the note current

Date the note and say what would make it out of date: a new account, a new feature such as file upload or connectors, a new kind of information, or a change of policy. When one happens, recheck the affected rows before carrying old permissions forward, and mark old versions as superseded. For UK personal-data questions, the ICO’s guidance on AI and data protection is useful background for your data protection lead; it doesn’t assess your particular workflow.