AI at work, without leaking your data.
Your team is already using AI, often on free accounts, often pasting in customer emails. Here's what happens to that data, the easy fixes, and the one-page policy that keeps everyone on the safe side.
Ask around in any small business and you'll find someone pasting a customer's email into a free chatbot to write a quick reply. It works, it saves time, and nobody has thought about where that email ends up.
You don't need to ban AI to fix this. You need the right accounts, a few clear rules, and a team that knows why the rules exist.
01 — The riskWhat happens to what you paste
When someone pastes text into an AI tool, it is sent to the provider and stored there, at least for a while. What happens next depends on the plan and its settings:
- On many free and personal plans, conversations may be used to train future models, unless someone switched that off.
- The data may be stored outside the EU.
- There's no agreement between your company and the provider about how that data is handled.
If the text contains your customers' personal data, your business is responsible for it under the GDPR, whichever tool an employee happened to use.
02 — The fixThe easy part: business plans
The big providers all offer team or business plans. These typically exclude your data from model training by contract, come with a data processing agreement, and give you an admin panel to control who uses what. Some let you keep data in the EU.
Two things to check before you pay: what the terms say about training and retention (not the marketing page), and whether the provider signs a data processing agreement with you. A plan for a team of five usually costs less than an hour of their time a month.
03 — The rulesWhat never goes in
Even with a business plan, some things don't belong in an AI tool unless it was set up specifically for them:
- Personal data you don't need for the taskNames, phone numbers, bank details, health information. Replace them with roles: "the customer", "supplier A".
- Passwords, keys and access codesNever, in any tool, for any reason.
- Documents under a confidentiality agreementContracts, client plans, anything you promised to keep to yourself.
- Anything you couldn't explain to the customerA good test: would you be comfortable telling them you did this?
04 — On paperA one-page AI policy
Write it down, keep it to one page, and go through it with the team. It needs five answers:
- Which tools are approved, on which accounts.
- Which data may go in, and which never does (section 03).
- Who checks AI output before it reaches a customer, a supplier or the books.
- Who to ask when in doubt.
- What to do when something went in that shouldn't have: report it straight away, no blame.
A policy nobody reads protects nobody. Half a day with real examples from your own work does more than ten pages of rules.
05 — The lawThe AI Act already asks for this
Since 2 February 2025, the EU AI Act requires companies that use AI systems to take measures so that their staff have a sufficient level of AI literacy (Article 4). For a small business, that doesn't mean a certification. It means your team knows what the tools can and can't do, where the risks are, and what your rules are.
Training the team on real tasks, plus the one-page policy, covers that, and it's the same thing that makes AI actually useful day to day.
What does your team paste into AI?
Want to try this in your business, or have a question? We read every email, and the first call is free.
