Assume someone on your staff uses an AI tool at work, approved or not. The useful question is what they have put into it, and whether the account they used protects it.
Work through this checklist in one afternoon. Do it before anyone pastes a client file into a chat window, or as soon as you learn someone has.
The ten-minute version
If the afternoon has to wait, send your staff one email today. Ask them to keep client names and client documents out of every AI tool until the written policy exists, and ask each person to reply with the tools they use. That message closes the easiest mistake to make while you finish the rest of this list, and the replies give you the inventory for the next section.
Staff and their accounts
- Ask each person which AI tools they use for work, and on which account. A personal login and a company business plan can come with different data controls.
- List every tool and account on one page, with the name of whoever pays for it.
- Ask what people have pasted in so far. Tell them you are gathering facts. People share the full list when they don’t expect trouble for it.
The settings on each account
Open the data settings on every account that touches work. I describe a provider’s policy after I have read its current page, so I’ll use OpenAI as the example and leave the others to you.
- Find the training switch. In ChatGPT, OpenAI places it under Settings, then Data Controls, labeled “Improve the model for everyone” (OpenAI Data Controls FAQ).
- Set it once per login. OpenAI says the training setting applies to the whole account and syncs between web and mobile, so one change covers every device on that login.
- Know its limits. OpenAI says that with the switch off, your conversations stay out of model training. They still appear in the account’s chat history.
- Read the rules for temporary chats. OpenAI states that Temporary Chats are deleted from its systems after 30 days, aren’t used for training, and may be reviewed to monitor for abuse.
- Compare plan types. OpenAI says its Team, Enterprise and Edu plans offer additional data controls.
- Check every other provider’s current terms yourself. Providers revise their policies, and a summary from memory, mine included, goes stale.
Data that stays out
Agree on the categories before you agree on the tools. A starting list:
- Client names and anything that identifies a client
- Documents covered by confidentiality or legal privilege
- Tax IDs, account numbers and health information
- Anything your engagement letters promise to protect
Check this list against the rules your profession sets. Attorneys, accountants and medical practices each answer to their own, and your insurer may want a say.
The written policy
- Write one page. Name the approved tools and the data that stays out, and add the name of the person who answers questions.
- Have every employee sign it, new hires included.
- Put a review date on it every quarter. Providers update their tools and terms, and you need to catch those changes.
A safe place for the sensitive work
A policy full of prohibitions sends people back to personal accounts on their phones. Give them a sanctioned route for each kind of work.
- Approve at least one hosted tool under a business account for work that contains no client data.
- Set up private AI for confidential documents. A model running on your own hardware keeps client files off third-party servers. Asking questions of your own documents runs well on a modest machine, which I covered in last week’s post.
Help with the whole list
I set this up for firms end to end, from the one-page policy to a private AI system on their own hardware.
I’m taking on three founding clients at $6,000 a month instead of $8,500, month to month with no minimum. In exchange, I ask for a testimonial and permission to publish the results as a case study. My full pricing is at b4help.com, and a free 30-minute call is the fastest way to ask about a spot.