Knowing what company information is safe to enter into ChatGPT or Microsoft Copilot starts with two checks: how sensitive the information is and whether your organization has approved the exact tool and account you plan to use. A familiar product name is not enough. Personal accounts, work accounts, and different product experiences may handle company data differently.
Give employees a simple way to make that decision before they write a prompt. The guide below is a starting point, not a replacement for your company’s policies, customer agreements, or other obligations. If those requirements are unclear, pause and ask the person responsible for IT, security, or compliance.
Classify information before using an AI tool
Use labels that employees can recognize in everyday work. The names below are examples. Map them to your own information-handling rules and make sure staff know which label applies to common documents and tasks.
Public
Public information is already approved for anyone to see, such as published website copy or a public product description. It may be appropriate for a prompt in an approved tool, but review your organization’s rules first. Do not include private drafts or internal comments just because the main subject is public.
Internal
Internal information is intended for the organization, not the general public. Examples might include routine internal procedures or non-sensitive project notes. Use it only in a work environment your organization has approved, and share only what is needed for the task.
Confidential
Confidential information could harm the organization or another person if exposed. Examples can include customer details, employee information, contracts, non-public financial material, and security documentation. Do not enter it unless your company has explicitly approved the tool, account, and use case for that type of data.
Restricted
Restricted information requires especially careful handling under company rules or other obligations. Credentials, private keys, sensitive personal records, and protected case files are examples that should not be pasted into a general AI chat. Use only a formally approved process if your organization has one, and ask for guidance when in doubt.
These labels work best when they connect to existing safeguards, not when they sit in a standalone document. A practical data-loss prevention approach can help clarify how sensitive information should be handled across everyday work.
Check the exact tool and account
Before sharing company information, verify the product, the account you are signed into, and whether your organization has approved that specific experience. A personal account is not automatically an approved work account, even if the app has the same name. Likewise, an option to limit model training does not by itself answer questions about access, retention, connected services, or company policy.
For Microsoft Copilot, distinguish personal use from an eligible work-account experience. Microsoft describes enterprise data protection for eligible Microsoft Copilot experiences, but employees should confirm which product and account they are using and what protections apply. See Microsoft’s overview of enterprise data protection in Copilot and its Copilot Chat frequently asked questions for product-specific details.
Apply the same discipline when evaluating ChatGPT Business or Enterprise. Do not treat a plan name as permission to enter any company information. Have the appropriate owner review the current terms, organizational settings, retention practices, access controls, and any connected apps or data sources before employees use the tool with non-public information.
Connected services deserve special attention. An AI tool may be able to work with files or other information a user can access. If shared folders or permissions are too broad, the tool can make that existing access issue more consequential. Check who can access the source content and whether the connection is approved for the intended use.
Use a pre-prompt checklist
Build a short pause into the workflow. Before sending a prompt or uploading a file, employees should ask:
- Is this tool approved? Confirm the exact product and account, not just the brand.
- What is the information label? If you cannot classify it, do not share it until you get guidance.
- Can I remove identifying details? Replace names and real records with synthetic examples where possible.
- Am I sharing only what is necessary? Use a short excerpt or summary instead of a full file when that will do.
- Have I checked permissions and settings? Consider file access, connected services, retention, and sharing controls.
- Will I review the output? Treat AI responses as drafts that need appropriate human review before they are used or shared.
For example, an employee who wants help improving a customer email could remove the customer’s name, account details, and private circumstances, then ask for a clearer version using a fictional example. The goal is to get useful assistance without exposing more information than the task requires.
Turn the rules into an AI policy employees can use
A useful company AI acceptable-use policy should be brief enough to consult during work and specific enough to guide decisions. It can identify approved tools and account types, connect information labels to allowed uses, explain which data must stay out of prompts, and name a person or team employees can ask when they are unsure.
Include practical examples based on the work your employees actually do. Explain how to remove identifiers, when a file upload is allowed, and what to do if a tool unexpectedly exposes information. Set expectations for reviewing AI-generated content as well as protecting the information used to create it.
Keep the policy and related procedures easy to find and update them when approved tools, settings, or company needs change. Clear IT documentation can help employees follow the intended process rather than relying on assumptions or informal guidance.
NIST’s Generative Artificial Intelligence Profile is a resource for organizations considering risks across the use of generative AI. It can help inform a broader review, but your policy should still reflect your own systems, data, and requirements.
Frequently asked questions
Can employees paste customer or employee data into ChatGPT?
Only if the organization has explicitly approved the specific tool, account, and use for that information. If approval is uncertain, remove identifying details or use a synthetic example, and ask the appropriate internal owner before proceeding.
Is ChatGPT Business or Enterprise safer for company information?
A business-oriented plan may offer organizational controls, but the plan label alone does not establish that a particular use is approved. Review the current terms and settings, then confirm that they meet your organization’s requirements for the data involved.
Is turning off model training enough to protect confidential data?
No. Consider the full handling of the information, including account approval, access controls, retention, connected services, and your company’s rules. A single setting does not replace that review.
What should employees never enter into an AI chatbot?
As a default, keep credentials, private keys, and restricted records out of general AI chats. Follow your organization’s rules for confidential and regulated information, and use a specifically approved workflow if one exists.
Make safe AI use part of everyday work
Employees can make better AI decisions when they know how to classify information, verify approved tools, and minimize what they share. Start with a short policy and clear examples, then give staff a straightforward way to ask for help. To discuss a practical next step for your business, contact Zevonix at (904) 658-0777.