What you actually need to know about data, security and getting your team using AI properly. Plain English. No scaremongering.
Most businesses that are worried about AI security are simultaneously allowing their staff to use free consumer AI tools with no policy, no guidance and no oversight.
Right now, someone on your team has probably pasted something into ChatGPT that you would not be comfortable with if you knew about it. Not because they are careless. Because nobody told them what was and was not okay.
The risk is not using AI. The risk is using it without a policy. This guide gives you the information you need to use AI properly, protect your business and brief your team in under a day.
The honest answer: it depends on which plan you are on. On the free tier of ChatGPT, your conversations can be used to improve OpenAI's models unless you opt out in settings. On ChatGPT Plus (the paid plan), you can turn off training entirely. On ChatGPT Team or Enterprise, your data is never used for training and stays within your organisation.
Claude and Copilot work similarly. The paid and enterprise tiers have significantly stronger data protections than the free consumer versions. The simple rule: if your team is using free consumer AI tools for business content, you need to change that.
This is the more pressing problem for most businesses. People are already using AI. The question is whether they are doing it in a controlled way or not. A staff member who pastes client financial data into free ChatGPT because they want to produce a report faster is not being malicious. They are being resourceful without guidance.
The solution is not prohibition. Prohibition does not work and it puts you at a competitive disadvantage. The solution is a simple policy that tells people what they can use, what they can put into it and what they cannot.
If your business operates in professional services, legal, financial services, healthcare or any sector handling personal data, you have additional obligations. GDPR applies to personal data processed through AI tools. Client confidentiality obligations apply regardless of the tool used. Sector-specific regulation varies.
The practical answer: do not put personal data, client-identifiable information or commercially sensitive content into public AI tools without understanding which plan you are on and what the data terms say. Anonymise or redact before pasting where possible.
You do not need a 20-page policy document. You need something clear enough that a team member knows what to do without having to ask. Here is a starting framework.
The briefing matters more than the document. Here is how to frame it so your team takes it seriously without feeling restricted.
We are implementing AI properly across the business. That means giving everyone access to tools that genuinely save time, and making sure we use them in a way that protects our clients, our data and the business.
Most of you are probably already using AI for some things. That is good. We want to build on that. What we are doing now is making sure everyone uses it consistently, safely and in a way that benefits the whole team rather than just individuals.
The policy is short. The main thing to know is what not to paste into AI tools and which tools are approved. Everything else is about helping you use this more, not less.
Do not frame this as a risk management exercise. Do not lead with what they cannot do. Do not imply that you are implementing this because you caught someone doing something wrong. The framing determines whether your team embraces this or resents it.
Join the free community and get the six free playbooks, the AI readiness diagnostic and ongoing guidance on using AI safely and effectively in your business.
Join free → Book a call →