Knowing what information employees should never paste into an AI tool starts with a simple rule: use only tools approved by your organization, and share only the information approved for that tool and task. A business account does not automatically make every kind of information safe to enter.
AI can help draft, summarize, and organize work. But a prompt may include information that should stay within approved business systems. Tool settings and data-handling terms vary, so employees should not assume a prompt is private or appropriate to share. When in doubt, stop and ask the person responsible for privacy or security.
Information employees should keep out of AI prompts
Unless your organization has approved a specific tool and use for the information, do not paste:
- Passwords and access details: Passwords, authentication codes, private keys, API keys, recovery codes, and links that grant access to business accounts.
- Personal identifiers and account information: Social Security numbers, payment card details, bank information, account numbers, identity documents, and personal contact details tied to a person.
- Customer, client, or employee records: Names alongside contact details, support histories, personnel files, payroll information, performance reviews, or other non-public records.
- Patient and veterinary information: Medical or veterinary records, appointment details, test results, treatment notes, or other information that could identify a patient or client.
- Student and nonprofit records: Student records, family details, case notes, donor information, or information about people receiving services.
- Confidential business material: Contracts, legal advice, financial statements, tax records, internal investigations, unreleased plans, and confidential vendor or customer terms.
- Technical details that create risk: Private source code, system configurations, network diagrams, security findings, and information that could help someone access or disrupt business systems.
These examples apply across workplaces. A retail employee might be handling a customer’s payment or contact details. A legal office may have confidential client documents. A school, clinic, veterinary practice, or nonprofit may work with records that need careful protection. Treat non-public information as sensitive unless your organization has clearly approved its use.
Does removing names make information safe?
Not necessarily. A record can still point to a person through a combination of details, such as a location, unusual event, job role, date, or specific set of circumstances. Removing a name is not the same as confirming that information is de-identified or authorized for use in an AI tool.
Redaction can also be incomplete. A copied document may include hidden comments, identifying details in a file name, or other content outside the visible passage. If a task requires real records, use only a system and workflow that your organization has specifically approved for that purpose.
Can staff use customer, patient, or business records in an approved AI account?
Only when the organization has approved that tool for the specific information and task, and staff follow its rules. “Approved AI tool” should not be treated as permission to paste any material into it. Approval should make clear which data types are allowed, who may use the tool, and what work it may support.
For example, an organization may allow a tool to help draft a general customer-service reply while prohibiting the use of identifiable customer records. Patient, veterinary, student, legal, and financial information should not be entered just because a tool is available through a business account. If the policy does not clearly cover the information, ask before using it.
For background on managing employee practices, see Zevonix’s guide to cybersecurity training for small-business employees. Training is most useful when it gives staff clear examples and a path to ask questions.
Safer ways to get help from AI
Employees can often get useful assistance without sharing real records or secrets. Try these approaches:
- Use a fictional example. Replace a real customer or employee situation with an invented scenario that preserves the general task but contains no real details.
- Ask for a template or process. Request a general checklist, outline, or explanation instead of submitting the source document.
- Minimize the prompt. Include only the information needed to explain the task. Leave out identifiers, account details, and unnecessary background.
- Use organization-approved systems. If a task requires sensitive material, use only the specific system and process your organization has cleared for that data and purpose.
- Check before sharing code or documents. Ask the appropriate manager or technical contact whether the material is approved for the intended tool.
A useful prompt might ask for a neutral email template about a delayed order, without including the customer’s name, order number, address, or account history. For a document summary, ask for a summary structure or provide an approved, suitably de-identified example rather than assuming that removing names is enough.
What to do after an accidental disclosure
If sensitive information has already been pasted into an AI tool, report it promptly. Do not wait to see whether the prompt causes a problem, and do not try to manage the response alone.
- Stop sharing. Do not add more sensitive details or repeat the prompt in another tool.
- Tell the designated contact. Follow your organization’s reporting process and notify your manager, privacy contact, or security contact as appropriate. If you do not know who that is, tell your manager promptly and ask where to escalate.
- Record what happened. Note what kind of information was entered, which tool or account was used, when it happened, and any relevant settings or steps taken. Share these details through the approved reporting channel, not in another AI prompt.
- Preserve relevant details. Keep information that will help the organization assess the event, such as the tool name and a description of the prompt. Follow internal instructions rather than deleting or changing records on your own.
- Let the organization assess next steps. The appropriate team can evaluate containment, vendor options, and whether any legal, contractual, or other notification duties may apply.
For general context, the Florida statute on security of confidential personal information describes requirements that may be relevant to certain incidents. What steps apply depends on the circumstances; employees should report promptly and leave the assessment to the organization’s designated contacts.
How to decide which AI tools employees may use
A small-business AI data policy should be short enough to follow and specific enough to guide everyday work. It can name approved tools, explain permitted and prohibited data, identify who can authorize exceptions, and tell employees how to report a mistake. It should also clarify that using an approved tool does not authorize every use of that tool.
Before approving a tool, the business can review its data-handling terms and settings, intended use, access controls, and how the tool fits with existing systems and obligations. The NIST Generative Artificial Intelligence Profile offers a risk-management framework organizations can consult when considering generative AI risks.
When staff need to connect AI with existing business processes, decisions about access and data handling matter alongside the workflow. Zevonix’s overview of small-business software integration may help frame those systems questions.
Frequently asked questions
Can employees paste a contract or financial document into an AI chatbot?
Only if the organization has approved that tool for the document and task. Otherwise, use a general template or ask an authorized person to recommend an approved workflow.
Should staff put patient or veterinary records into an AI chatbot?
Not unless the organization has specifically approved the tool and use for those records. Do not treat a business account or removal of names as permission.
Who should an employee tell after a mistake?
Use the organization’s reporting process and promptly notify the designated manager, privacy contact, or security contact. If you are unsure who handles reports, start with your manager.
What is the safest choice when the policy is unclear?
Do not paste the information. Ask the designated contact whether the tool and use are approved, or use a fictional example that does not reveal real business or personal details.
Make the safe choice easy
Employees should be able to recognize sensitive information, know which AI tools are approved, and report accidental sharing without delay. Set clear data boundaries and provide a practical alternative for common tasks. If your business needs help aligning AI use with its systems and security practices, contact Zevonix to discuss your IT support needs.