You have started using AI at work. Nobody told you to. Nobody told you not to. There is no policy, no training, and no obvious person to ask, so you have been making it up as you go and quietly hoping that is fine.
It is a very common position to be in, and the uncertainty is the worst part of it. You are not sure whether you are being resourceful or reckless, and there is nobody to tell you which.
This is a practical guide to working that out for yourself.
The risk is not the tool. It is what you put into it.
Almost every worry about workplace AI collapses into one question: where does the information go?
When you paste something into a tool, you are sending it to a company outside your organisation. Depending on the tool and the plan your workplace pays for, that text may be stored, may be reviewed by a human, and may be used to improve the product. That is not sinister. It is just how the service works, and it is written into terms most people have never read.
So the thing to be careful about is not "using AI". It is putting information into a system your organisation has not agreed to send it to.
That distinction matters, because it turns a vague anxiety into something you can actually check.
Find out what your organisation already says
Your workplace almost certainly has no AI policy. It almost certainly does have rules that cover this anyway.
Look for whatever you already agreed to: a privacy policy, a confidentiality clause in your employment contract, an acceptable use or IT policy, a code of conduct, a records management procedure. In a health, legal, financial or government setting, add whatever obligations sit over your industry.
None of those documents will mention AI. All of them will tell you how you are permitted to handle information, and that is the question you are actually asking. If your confidentiality obligation says client information does not leave the organisation, that answer does not change because the destination is a chat window rather than an email.
Reading those documents takes about twenty minutes and puts you in a much stronger position than a colleague who has not.
Three questions before you paste anything
Once you know your obligations, most decisions take a few seconds.
Could this identify a person? Names, contact details, dates of birth, client numbers, medical or financial details, or the combination of small facts that would let someone work out who is being described. If yes, take it out before you paste, or do not paste.
Would we mind a competitor reading this? Pricing, strategy, unreleased work, supplier terms, anything commercially sensitive. If the honest answer is yes, that content stays inside.
Am I about to rely on this without checking it? These tools produce confident, fluent, entirely wrong answers. That matters most for anything with a number, a name, a date, a citation or a rule in it.
Rewriting a paragraph you have already written passes all three. Summarising a client file does not. Most of the day sits comfortably at one end or the other.
Do the work in a form the tool can help with
A surprising amount of what you want help with does not require sensitive information at all, if you set the task up properly.
Instead of pasting a client's complaint and asking for a reply, describe the shape of it: an unhappy customer, a service that ran two weeks late, an apology needed without admitting fault. You get the same help. Nothing identifying has left the building.
Instead of uploading the actual spreadsheet, describe its columns and ask how to structure the formula. Instead of pasting the contract, ask what a clause of that type usually covers so you know what to look for.
This is a genuinely useful habit, and it is one of the clearest signals that someone knows what they are doing with these tools.
Write down what you are doing
Keep a short record: which tool, what you use it for, and what you have decided not to put in it. A few lines is enough.
This costs almost nothing and does two things. If a policy arrives later, you can show that your practice already met it. And if anyone ever asks how you have been working, you have an answer rather than a memory.
There is a bigger reason too. When your organisation eventually writes its policy, somebody will be asked what people are actually doing. Being the person who already knows is a good position to be in.
If you have already put something in
Do not panic and do not quietly hope. Work out what was sent and how sensitive it was, then check the tool's settings — most have a history you can delete and a control for whether your content is used for training. Turn that off.
If what you sent was genuinely sensitive, tell someone. It is a much smaller conversation on the day it happens than three months later, and every organisation would rather hear it early. People rarely get into trouble for the first thing. They get into trouble for the concealment.
Raising it without sounding like a confession
The most common reason people say nothing is that raising it feels like admitting to something.
Do not open with what you have been doing. Open with the missing guidance.
Something like: "A few of us are using AI tools for parts of our work and we have no guidance on what is and is not appropriate. I would rather we agreed on that than everyone guessed. I have written down how I have been handling it, if that is useful as a starting point."
That is not a confession. It is someone identifying an unmanaged risk and turning up with the beginning of a solution, which is a considerably more valuable thing to be.
The part that lasts
The specific tools will change. Which one your workplace pays for will change. The judgement will not: knowing what information can go where, checking anything you are going to rely on, and being able to explain your reasoning to someone who asks.
That judgement is what makes someone trusted with this technology rather than watched around it. It is learnable, it is visible to the people you work with, and it does not go out of date when the tool does.
If you want to go further than a personal habit and actually build the thing your organisation is missing, that is the sort of work our program is built around: real problems in your own workplace, done properly, with the evidence to show for it.