Use business or enterprise tiers, which do not train on your data by default, turn off chat history or training in the settings, and never paste genuinely sensitive information (personal data, passwords, client confidential material) into free consumer tools. Write a short AI use policy so everyone follows the same rules.
Most data risk with AI is not the technology being sinister. It is a well-meaning employee pasting the wrong thing into the wrong tool. Fix that and you have fixed most of it.
This is the question that keeps cautious owners, and every solicitor, accountant and IFA I train, up at night. And rightly so. You are responsible for your customers' data, and "the AI ate it" is not a defence you want to be testing with the ICO. The good news is that using AI safely is not complicated. It is mostly a few settings and a few sensible rules.
The one distinction that matters most
Free consumer versions of AI tools and paid business versions are not the same when it comes to your data. As a rule, the free consumer tiers may use your conversations to help train future models. The business and enterprise tiers of the major tools do not, by contract and by default. So the first, biggest move is simple: for anything work-related, use the business tier, not the free personal one.
| Free consumer tier | Business / Enterprise tier | |
|---|---|---|
| May train on your inputs | Often yes (check settings) | No, by default |
| Data handling controls | Limited | Admin controls, retention settings |
| Suitable for client data | No | Yes, with the right setup |
| Cost | Free | ~£17 to £30 per user / month |
Five rules that cover most of the risk
Your practical AI data checklist
- Use business tiers for work, not personal free accounts
- Turn off training / history in settings where the option exists
- Never paste passwords, card details, or unredacted personal data into any tool
- Redact first - strip names and identifiers before summarising sensitive documents
- Write a one-page AI policy so everyone knows what's allowed and what isn't
None of that requires an IT department. It requires ten minutes in the settings and a clear rule everyone understands. The full data safety guide walks through the exact toggles, but those five habits are the backbone.
The human risk is bigger than the tech risk
The scenario that actually bites is mundane. An employee, trying to be efficient, pastes a client's full file into a free chatbot to get a summary. No malice, just a shortcut. But now potentially confidential data has gone somewhere it should not, possibly under terms that allow it to be retained. This is not a tooling failure. It is a training and policy gap, and it is entirely preventable.
That is why the single best data protection you can buy is not software, it is clarity. A team that knows which tool to use, what may go in, and what must never go in, is a team that gets AI's benefits without the sleepless nights. We build exactly this into our AI Policy Workshop and our sector sessions for regulated professions.
Give your team the safe way to work
Our AI Policy Workshop turns 'I'm nervous about data' into a clear, one-page policy your whole team can follow.
For regulated professions especially
If you handle client money, health records or legal matters, the bar is higher and so is the scrutiny. That does not mean avoiding AI, it means using it deliberately: approved tools only, clear rules on client data, and a documented policy you can show a regulator. Our sessions for law firms, accountants and IFAs cover this head-on, because "we didn't think about it" is not a compliance strategy.
Used carelessly, AI is a data risk. Used with a few settings changed and a clear policy in place, it is no more dangerous than email, and considerably more useful. The difference is knowing the rules. So learn them, write them down, and get on with the good bit.
Frequently asked questions
Is it safe to use AI tools for business?
Yes, with the right setup. Use business or enterprise tiers, which don't train on your data by default, adjust the privacy settings, and keep genuinely sensitive information out of free consumer tools. A short policy keeps everyone consistent.
Do AI tools train on the data I put in?
Free consumer tiers often may, unless you turn it off in settings. Business and enterprise tiers of the major tools do not train on your inputs by default, which is why they are the right choice for work.
What should I never put into an AI tool?
Passwords, card and bank details, and unredacted personal or client-confidential data, especially in free tools. Redact identifiers first if you need a document summarised.
Does AI use comply with GDPR?
It can, if you use appropriate tiers, control retention, and have a lawful basis and policy for the data involved. Regulated firms should document their approach. Our governance framework guide covers the essentials.
How do I stop staff pasting sensitive data into AI?
Give them a clear, simple policy and a short training session. Most breaches are well-meaning shortcuts, not malice, so clarity about which tools and what data is allowed prevents the vast majority.