Can I put this into AI?

A decision card for one person. Print it, or keep it open in a tab for the first month.

This advises you, not your organization. Where it touches company policy, policy wins — if your employer has written data rules, those are the answer and this card is just a way of remembering them.

Start here: which account are you using?

This is the question almost nobody asks first, and it changes everything below.

Account	What it usually means
Company-provided (Team, Enterprise, or a tool your employer set up)	There is an agreement covering your data. Follow the written rules.
Your own personal account, free or paid	You are the data agreement. Assume anything you paste may be retained.

Paying for a personal plan does not make it a work account. That’s the most common mistake, and it’s an easy one to make — the interface looks identical.

The decision

Work down. Stop at the first row that matches.

If the material…	Then
Is already public — published pages, press releases, your own blog	Go ahead.
Names a customer, client, patient, student, or applicant	Stop. Don’t paste it. Not a judgment call.
Contains credentials, keys, or anything that would let someone log in	Stop. Never, on any account.
Is unreleased — financials, strategy, an unannounced product	Stop unless your written rules explicitly permit it.
Is about a named colleague — performance, health, a complaint	Stop. Talk to a person instead.
Is internal but unremarkable — a process note, a draft agenda	Only on a company-provided account, and only if your rules allow it.
You genuinely can’t classify	Ask. See the script below.

”Can I just remove the names?”

Sometimes. Not always, and not by default.

Only if your written data rules explicitly allow sanitized material. Otherwise, stop and ask. Whether de-identified data is permitted is a decision your organization makes, not one you can make on its behalf — and re-identification is easier than it looks when the surrounding detail is specific.

If you do sanitize: remove names, account numbers, dates, locations, and job titles. A “small anonymized case” that mentions the one client in Reykjavík is not anonymized.

When you can’t tell, ask like this

Short, specific, and answerable. Vague questions get no reply.

Hi — I’d like to use [tool] for [specific task, e.g. “summarizing my own meeting notes”]. Before I do, can you confirm:

Is [tool] approved for work use?

What categories of information must never go into it?

Is there a difference between the company account and a personal one?

Happy to work from public or made-up material until I hear back.

That last line matters. It lets you keep going without waiting, and it makes clear you’re not asking for permission to take a risk.

While you’re waiting for an answer

You can do real work with none of the above:

Public material — anything already on the open web.
Made-up material with the same shape as the real thing.
Your own words — a draft you wrote, an email you’re about to send, your own notes.
General questions with no company detail: “what usually goes in a project brief?”

That’s enough to get competent. The confidential material can wait for the written answer.

Drawn from Shadow AI: You're Probably Using AI Your Company Never Approved, which has the evidence behind it.