Before You Paste Into AI, Check What You Are Sharing

AI tools can be useful at work. They can help rewrite a message, summarise notes, organise ideas, or turn rough text into something clearer.

The safety habit is simple: before you paste, check what you are sharing.

Many people treat AI chat boxes like a private notepad. They are not always private in the way your company systems are private. Depending on the tool, your prompt may be processed outside your organisation, stored for a period of time, reviewed for abuse or quality, or used under settings your business has not approved.

That does not mean staff should panic or avoid useful tools completely. It means business information needs the same care in an AI prompt as it would in email, WhatsApp, a shared drive, or a web form.

What should not go into an unapproved AI tool

If you would not post the information in a public chat or send it to an unknown supplier, do not paste it into a public AI tool.

Be especially careful with:

customer names, phone numbers, addresses, ID numbers, banking details, or medical information
payroll, HR, disciplinary, legal, contract, or financial records
passwords, API keys, MFA codes, recovery codes, or screenshots that show secrets
internal network details, diagrams, firewall rules, server names, or remote-access information
supplier quotes, private tenders, unreleased pricing, or confidential client conversations
full email threads that include attachments, signatures, hidden history, or other people's data

A safer approach is to remove or replace sensitive details before asking for help. For example, use “Customer A”, “Supplier B”, or “the branch office” instead of real names and account numbers.

Do and do-not guidance for everyday office use

Do:

Use only AI tools your business has approved for work information.
Check whether the tool is signed in with a company account or a personal account.
Remove names, account numbers, contact details, passwords, and private business figures before pasting.
Ask AI to improve structure or wording, not to handle secrets.
Treat AI-generated links, instructions, formulas, and technical steps as drafts that need review.
Keep a human in the loop for payments, HR, legal, security, and customer-impacting decisions.

Do not:

Paste passwords, MFA codes, API keys, recovery phrases, or remote-access credentials.
Upload client contracts, payroll files, bank documents, medical files, or full mailboxes unless the tool has been approved for that type of data.
Ask an AI tool to decide whether a supplier bank-detail change, invoice, or payment request is legitimate.
Follow technical commands from an AI response on a live system without IT review.
Assume a convincing answer is correct just because it sounds confident.

Watch for AI-assisted scams too

Attackers are also using AI to make scams cleaner and more believable. Phishing emails may have fewer spelling mistakes, better grammar, and more natural wording than older scams. A fake request can sound like a normal manager, supplier, courier, bank, or software provider.

So the old warning signs still matter, but they are not enough by themselves. Slow down when a message asks you to sign in, scan a code, open a file, approve a payment, change bank details, install remote access, or share sensitive information.

Use a known contact method to verify anything important. Do not rely only on the message thread you received.

If you are unsure

Pause before pasting or acting. Ask your manager, IT support team, or security contact whether the tool and the information are appropriate for work use.

If you already pasted sensitive information into an unapproved AI tool, do not try to hide it. Report it quickly so the risk can be assessed. If a password, MFA code, API key, or recovery code was shared, it should be changed or revoked immediately.

AI can save time, but it should not become a shortcut around good judgement. The best rule for business users is this: use AI for help with wording and thinking, not for exposing private data.

Sources: UK National Cyber Security Centre — AI and cyber security: what you need to know; Microsoft Security Blog — AI as tradecraft: How threat actors operationalize AI; NSA/CISA and partners — AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems.