Using AI tools at work

Key points

Check your organization's AI use policy and approved-tool list before you start.

Never enter confidential, personal or restricted data into a tool not approved for it.

You are responsible for checking AI outputs before you rely on or share them.

Tell people when AI helped produce something, where this is required or expected.

Report problems, near misses and shadow AI early. Silence makes small problems bigger.

Who this is for: anyone new to the topic. Related stage: Set up governance.

Why this matters

Staff often adopt AI tools faster than policy. Use of AI at work without the organization’s knowledge is called shadow AI. It is rarely malicious. People want to work faster. The risk is that sensitive data leaves the organization, or that unchecked output reaches customers.

Five habits

Know the rules. Read the AI use policy and find the list of approved tools. If a tool is not listed, ask before using it for work.
Protect data. Do not paste customer data, personal data, confidential business information or source code into a tool unless it is approved for that kind of data. If you are unsure, treat the data as restricted.
Check outputs. You are responsible for what you rely on and share. Check facts, figures and references. Look for unfair assumptions.
Be open. Say when AI helped produce something where this is required or expected, for example in customer-facing content or decisions about people.
Speak up. If a tool behaves oddly, leaks something, or treats a group unfairly, report it through your incident route.

What good policy language looks like

Policy that works names a role and a frequency. “Teams should consider reviewing access regularly” is advice. “The System Administrator shall review access rights every 90 days” is a rule someone can follow and check.

Example

An analyst pasted a customer contract into a public chatbot to get a summary. The contract held personal data and confidential pricing. No policy had told the analyst which tools were approved, and there was no easy route to ask. The fix was a short acceptable use policy, an approved-tool list and a named contact.

What to do now

Find your organization’s AI use policy and approved-tool list.
If you are a manager, publish a one-page acceptable use note. The AI use policy template is a starting point.
Take the Everyone quiz.

My regions