Is It Safe to Use ChatGPT at Work?

Short answer? Yes, it can be. As long as you've set it up properly and your team knows the rules. In my experience the risk is rarely the tool itself. It's people using it without anyone telling them what's OK and what isn't.

Here's what I'd want every small business owner to know.

What happens to what you type in?

This is the big one, and it depends on the type of account.

On personal accounts, free or paid, ChatGPT and Claude can use your conversations to help train future models unless you switch that off in the settings. Both let you turn it off, but most people never look.

On business plans, like ChatGPT Business or Enterprise and Claude's Team or Enterprise plans, your data isn't used for training by default, and you get more control over who can see what.

Copilot used with your work Microsoft account sits within your Microsoft 365 setup, so it's covered by the same protections as the rest of your company's files.

These settings do change, so it's worth checking them every few months rather than assuming.

The real risk: shadow AI

Here's what actually keeps me up at night. Staff using AI on their personal phones because nobody gave them a proper tool or told them what's allowed. They're not being sneaky. They're trying to get their work done faster. But it means company information is going into accounts you can't see and can't control.

Banning AI doesn't fix this. It just pushes it further underground. Giving people a safe option and clear rules does.

What should never go into an AI tool

Unless you're on a business plan that's been properly set up for it, keep these out:

• Customers' personal details, like names, addresses, phone numbers and emails
• Anything about someone's health, finances or personal circumstances
• Passwords, login details or access keys
• Financial figures or plans that aren't public yet
• Anything covered by a confidentiality agreement

A good rule of thumb I give teams: if you wouldn't put it in an email to a stranger, don't put it in a personal AI account.

What about GDPR?

If personal data goes into an AI tool, UK GDPR still applies, exactly as it would with any other software. You need a good reason to use the data, the right account type, and clear rules for your team. The ICO has published guidance on AI and data protection that's worth a read if you handle a lot of customer information.

The other risks people forget

Data gets all the attention, but there are a couple of others. AI tools can sound completely confident and still be wrong, so anything important needs checking by a human. And they can reflect bias from the information they learned from, which matters if you're using them for anything to do with hiring or people decisions.

Five steps to use AI safely at work

• Pick an approved tool and put it on a business plan.
• Switch off training on any personal accounts that are still in use.
• Write a short AI policy. One or two pages is plenty. Here's how to write an AI policy for a small business.
• Train your team so they know what good use looks like as well as what's off limits.
• Keep a human in the loop for anything that goes to a customer or makes a decision about a person.

If you want your team confident on the safe-use side of things, our AI and ethics training covers all of this with examples from your own work.