Quick summary: AI chatbots such as ChatGPT, Gemini, Claude and Microsoft Copilot can save hours of work every week, but they also create new risks: leaked confidential data, confident-sounding wrong answers, and company-policy problems. This practical guide gives you 10 simple rules for using AI tools safely at work, based on guidance from national cyber security agencies.
Why AI safety at work matters
Most people start using AI tools the same way: they paste in an email, a report or a spreadsheet and ask for a summary. It feels harmless, but whatever you type into a public chatbot leaves your computer and is processed by the AI provider. Depending on the service and your settings, it may be stored and used to improve future models.
The UK's National Cyber Security Centre (NCSC) gives two simple recommendations for public AI chatbots: do not include sensitive information in your prompts, and do not ask anything that would cause a problem if it became public. Australia's cyber security agency gives similar advice and adds that you should always check AI-generated results before using them.
10 rules for using AI chatbots safely at work
1. Never paste confidential data into a public chatbot
This includes customer names and phone numbers, contracts, salary data, passwords, unreleased financial results, source code that is not public, and internal strategy documents. If you need help with such a document, remove names and numbers first or describe the problem in general terms.
2. Use your company's approved AI tool
Many organisations now provide business versions of AI tools (for example, Microsoft 365 Copilot or enterprise plans of ChatGPT, Gemini and Claude) with stronger data protection. Using a personal account for work data, sometimes called "shadow AI", can break company policy even if your intention is good.
3. Check the data and privacy settings
Open the settings of the AI app you use and look for options such as chat history, memory and "improve the model for everyone". Decide consciously what you allow. Read the provider's privacy policy at least once.
4. Treat every answer as a first draft
AI models can "hallucinate": they sometimes invent facts, quotes, prices, laws or references while sounding completely confident. Verify important facts with an official source before you send, publish or act on them.
5. Ask for sources, then open them
When accuracy matters, ask the chatbot where the information comes from, then open the links yourself. If a link does not exist or does not say what the AI claimed, do not use that information.
6. Be careful with files and links from AI tools
Do not run code, macros or scripts produced by AI on important systems without understanding what they do. Test them on sample data first. The same goes for formulas in large spreadsheets.
7. Watch out for prompt-injection tricks
If an AI tool can read web pages, emails or documents for you, hidden text inside that content can try to give the AI new instructions, for example to reveal information or click a link. Be cautious when an AI assistant suddenly suggests unexpected actions.
8. Keep a human in the loop for decisions
Use AI to draft, summarise and brainstorm, but let a person make final decisions about money, hiring, legal matters, health and safety, or anything that affects customers.
9. Be transparent
If a document, report or customer message was mainly written by AI, follow your organisation's rules on disclosure. Never present AI output as checked facts if you did not check them.
10. Report mistakes and leaks quickly
If you accidentally pasted sensitive information into a chatbot, tell your IT or security team straight away. Many services let you delete a conversation, but your company may need to take extra steps.
Safe ways to get real value from AI
- Writing help: improve the tone of an email after removing private details.
- Learning: ask for a simple explanation of a technical concept or Excel formula.
- Planning: create a checklist or project outline from general information.
- Summaries: summarise public articles, documentation or meeting notes that contain no confidential data.
- Brainstorming: generate headline ideas, questions for an interview or test cases.
Quick checklist before you press Enter
- Is there any personal, customer or confidential data in my prompt?
- Am I using the AI tool my organisation approved?
- Would it be a problem if this prompt became public?
- Will I verify the answer before using it?
Related: big cloud services can also fail, as we saw in the Microsoft 365 outage of November 12, 2026, so it is smart not to depend on a single tool for critical work.
FAQ
Is it safe to use ChatGPT or Gemini for work?
It can be, if you follow your company's policy, avoid sensitive data in public tools and verify the answers.
Do AI chatbots store what I type?
Many services store conversations, and some may use them to improve their models depending on your settings and plan. Check the provider's privacy settings.
Can I trust AI answers?
Treat them as a helpful first draft. Always confirm important facts with an official source.
Sources