Right tool, right account, right data
Find the policy first
Many employers now have an AI policy, even if it is one page on the intranet. It usually says which tools are approved, which are banned, what data may go in, and whether you must say when AI helped. If there is no policy, ask your manager or IT before using AI on work material. "Nobody told me" is a weak defence after a leak.
Work accounts are different
Business and enterprise plans of ChatGPT, Claude, Gemini and Microsoft Copilot usually come with contracts that say your company's data won't be used to train models, plus admin controls and audit logs. A free personal account offers none of that to your employer. The same chatbot can be fine for work on one account and a breach of policy on another.
What not to paste
Unless your approved work tool allows it: customer personal data, staff records, health information, passwords and keys, unreleased financial results, contracts under negotiation, and anything marked confidential. In 2023 Samsung banned staff from public chatbots after engineers pasted internal source code into one. Removing names and figures before you paste solves many cases.
Settings you control
Personal accounts usually let you switch off use of your chats for model training and turn off chat history or memory. Check these in settings for each tool you use. They reduce risk; they don't make a personal account suitable for confidential work. When in doubt, describe the problem in general terms instead of pasting the real document.
Do you know whether your workplace has an AI policy, and where to find it? If not, who would you ask?