AI tools — Claude, ChatGPT, Microsoft Copilot, and the dozens behind them — are already in your team’s browser tabs, whether you have a policy or not. Used well, they are a real accelerant: faster drafts, cleaner templates, better research, quicker learning. Used carelessly, they are a data leak with a friendly chat window. These are the ground rules we follow ourselves and recommend to every client — high level, plain English, and short enough that people will actually read them.
Rule one: never share what you can’t un-share
Treat anything you type into an AI tool the way you would treat posting it outside your company. The providers have safeguards, and the enterprise tiers have real contractual protections — and the rule still stands, because a prompt is a disclosure. Keep these out of any AI tool, full stop:
- Confidential business information — strategy, unreleased plans, pricing you have not published, anything deal-related.
- Financial records — statements, payroll, banking details, forecasts.
- Personal records and PII — employee files, health information, Social Security numbers, customer identities.
- Client data of any kind — their names, their environments, their documents. Their trust is not yours to spend.
- Credentials and secrets — passwords, API keys, access tokens, network diagrams.
- For defense contractors, the hard line: CUI, FCI, and export-controlled technical data never touch a public AI tool. That is a compliance boundary, not a judgment call.
Where AI is absolutely the right tool
Inside those boundaries, use it freely — this is what the tools are for:
- Streamlining repetitive work — summarizing long documents, reformatting notes, cleaning up data, turning bullet points into prose and back.
- Templates — email replies, SOP skeletons, checklists, meeting agendas, project plans you then tailor.
- First drafts — proposals, job descriptions, documentation outlines; you bring the facts, it brings the blank-page escape.
- Research on public information — comparing approaches, explaining standards and regulations, surveying a topic before you go deep. Verify what comes back before you rely on it.
- Learning and upskilling — having a concept explained three ways, generating practice questions, pressure-testing your own understanding.
- Code and configuration boilerplate — starting points and debugging help, reviewed by a human who understands what the code does.
- Brainstorming — names, angles, objections, edge cases; AI is tireless at volume, you supply the judgment.
Cite it or write it: the plagiarism line
AI does not change the rules of authorship. Passing someone else’s words or ideas off as your own is plagiarism whether a search engine found them or a chatbot paraphrased them. If you quote, quote — with quotation marks and attribution. If AI drafted something you are presenting as your work, review it, make it yours, and be ready to stand behind every sentence; where disclosure is expected — academic work, published writing, client deliverables with authorship terms — disclose. The byline is a promise that a person vouches for the content.
Use AI to get smarter, not to stop thinking
The best use of these tools is not outsourcing your thinking — it is accelerating it. Ask the follow-up question. Ask why, then why again. Have it argue the other side of your position. Use it to discover what you did not know to ask about, then go verify the load-bearing claims against primary sources, because these tools state wrong things with exactly the same confidence as right ones. The people getting the most from AI are not the ones who prompt and paste — they are the ones who finish the conversation more curious, and measurably sharper, than they started it.
Quick answers on AI at work
Can I paste company or client data into Claude, ChatGPT, or Copilot?
No — not confidential plans, financials, personal records, PII, credentials, or anything belonging to a client, regardless of the tool’s safeguards. The test is simple: if it leaking would cause reputational or contractual damage, it does not go in a prompt. Rewrite the question using placeholder or generic data instead; you usually lose nothing.
Is it okay to use AI for templates and repetitive tasks?
Yes — that is one of its best uses. Email templates, SOP skeletons, checklists, meeting agendas, reformatting, summarizing, data cleanup: all fair game, and encouraged. The pattern that works is AI for the structure and the busywork, you for the facts, the judgment, and the final read before anything ships.
Is using AI plagiarism?
Using AI is not plagiarism; misrepresenting authorship is. Quoting someone else’s work requires quotation marks and attribution, exactly as it always has. AI-drafted text you present as yours should be reviewed, edited, and genuinely owned by you — and disclosed where disclosure is the norm, like academic or published work.
Do I need to verify what AI tells me?
Yes, every time it matters. These tools produce confident, fluent answers that are sometimes wrong — about dates, numbers, citations, and regulations especially. Treat output as a well-read colleague’s first take: useful direction, never the final authority. Check load-bearing facts against primary sources before you act on them or repeat them.
What about CUI or other regulated data?
Never in a public AI tool — no exceptions. CUI, FCI, ITAR, and export-controlled technical data live inside your assessed boundary, and a consumer chatbot is not in it. If your team handles CUI, your acceptable-use policy should say this explicitly, and AI use around that data should go through tools your compliance program has actually approved.
Which AI tool should we standardize on?
The ground rules above are tool-agnostic — they apply to Claude, ChatGPT, Copilot, and whatever launches next quarter. What differs is data handling: enterprise tiers offer contractual protections consumer versions do not. Pick tools deliberately, read the data terms, turn on the business protections, and tell your team which ones are approved.