You can usually use AI at work, but check first which tools are approved, what information you're allowed to put into them, and who is accountable if something goes wrong. Whether AI is allowed in general matters less than which information you're permitted to share with it.
Most workplaces already have a rule about confidential information, even if they've never written a word about AI, and that rule usually covers it. A ten-minute conversation with your manager or IT contact is normally enough to get clear answers.
What can go wrong when you use AI at work?
The main risks are breaching a client agreement, sending personal data somewhere it shouldn't go, and putting out a wrong answer under the company's name.
Breaching a client agreement. Many contracts require client information to stay confidential. Pasting a client's document into a tool your firm hasn't approved may breach that, even if nothing bad comes of it.
Personal data leaving the organisation. Staff records, customer details and health information carry legal obligations in most countries. In the UK, for example, the data-protection regulator (the ICO) publishes guidance on AI and data protection, because data-protection law applies whenever AI tools process personal data. Where the data travels matters as well as who reads it.
A wrong answer going out under the company's name. The tool drafted it, but the company sent it, and accountability stays with the sender.
Picture a practice manager at a dental surgery who pastes a patient's complaint letter into a personal AI account to help draft a reply. The intention is good and the reply may be excellent, but a patient's health details have just gone to a service the practice never approved. Most of these problems start the same way: someone trying to save time on a busy afternoon.
What should you check before using AI at work?
Confirm which tools are approved, what data can go in, whether output needs review, whether you must disclose AI use, and where the data is stored.
Approved tools. Some organisations keep a list. Some have blocked specific tools after a review. Ask rather than assume. Using a personal account for work usually gets a different answer from using a company account.
Permitted data. Most organisations sort information into sensitivity levels, covered in the next section. Ask which levels you can use.
Review before sending. For anything client-facing, a person should read it before it goes out, the same rule you'd apply to a junior colleague's draft. The AI agent safety guide covers approvals in more depth.
Disclosure. Some firms require a note that AI was used, and some clients ask. Check and follow it. Disclosing at the start is easier than explaining later.
Storage. If the agent keeps memory, things you said months ago are still there. Ask whether that's acceptable for the material you plan to use. What happens to your data explains where messages go.
How sensitive is the material?
"Work or personal" is too blunt a test. A four-level scale is more useful:
- Public: published material, marketing copy, general information. Usually fine.
- Internal: meeting notes, plans, internal documents. Often allowed, sometimes not.
- Confidential: client material, contracts, financial detail. Usually restricted.
- Regulated: personal data, health information, anything with a legal retention rule. Treat as restricted unless told otherwise.
If nobody can tell you which levels are permitted, stick to the first two.
What to say to your manager
You don't need a formal meeting. A short message does it:
"Before I use an AI tool for work, can I check a few things? Is there an approved list, or a tool I should avoid? What level of information am I allowed to put in? And does anything client-facing need sign-off before it goes out?"
That's enough to start a sensible conversation. If the answer is "we haven't thought about it", you've flagged something your organisation needed to look at.
What if your workplace has no AI policy?
Take the cautious position until there is one:
- Use public and internal material only.
- Keep client names and personal details out, and use placeholders instead.
- Review everything before it leaves your desk.
- Don't use a personal subscription for confidential work.
- Offer to help write a short policy. A one-page note covering the four data levels and the review rule is usually welcome, because most organisations know they need one.
Can you use a personal AI account for work?
Only if your employer agrees, and even then keep the material as low on the sensitivity scale as the task allows. It's a common habit: in Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 people in 31 countries, 78% of AI users said they were bringing their own AI tools to work.
The problems are practical. Your employer may not know where the data is stored. A provider's consumer terms can differ from the business terms your organisation would have agreed, including on whether conversations are used for training. And if you leave the job, the history leaves with your account.
Before you start: a checklist
- Asked whether there's an approved tool list
- Confirmed which data levels are permitted
- Confirmed that client-facing output needs review
- Checked whether disclosure is required
- Removed names and personal details where possible
- Confirmed where memory and history are stored
- Agreed who is accountable if something goes wrong
If you're using an agent for your own planning, internal notes or thinking through a problem with no client information involved, the risk is low and these checks take minutes. The everyday tasks guide has plenty of low-risk places to start. The care belongs with material that identifies a person, belongs to a client or carries a contractual obligation, which is usually a smaller share of the day than it feels.
This guide is general information, not legal advice. If your organisation handles regulated data, its AI policy should be written or reviewed by someone qualified.
Common questions
Can I use ChatGPT at work?
Often, yes, depending on your employer's rules and the information involved. Many organisations allow AI tools for public or internal material and restrict client, financial or personal data. Some approve a business version with agreed terms and block personal accounts, so ask your manager or IT contact before you start.
Can my employer see what I type into an AI tool?
On a company account, administrators may be able to see usage or conversation history, depending on the product and its settings. On a work device or network, your activity may also be monitored under your employer's IT policy. On a personal account and device your employer usually can't see it, but any work material you paste in is still covered by your confidentiality obligations.
What should a workplace AI policy include?
A good policy fits on a page. It names the approved tools, sets out which levels of information can go in, says when a person must review output, and states whether AI use must be disclosed to clients. It should also name who to ask when something isn't covered, and be reviewed when tools or terms change.
Should I tell my manager I use AI for work?
In most cases, yes. Telling them lets you confirm the tool and the material are acceptable before there's a problem. It also protects you if a client or colleague later asks how something was produced, and many organisations are still forming their rules, so asking openly is the safer route.
Questions first? Talk to us.