How to use AI safely at work

By Kike Gandia · Co-Founder & CEO, OSCP

Almost every guide on safe AI use is written for the security team. This one is written for the person using the tool every day: whoever has to decide, in ten seconds, whether they can paste that email, that contract or that snippet of code into a chat. These are the practical rules that settle most of those decisions, with concrete examples of what goes wrong.

Rule 1: assume anything you paste could be read by someone

Not because the vendor is malicious, but because retention terms vary, free plans typically allow content to be used to improve the model, and conversation histories have leaked more than once through platform faults.

The practical test before pasting: would you mind if this appeared in a screenshot outside the company? If the answer is yes, do not paste it into a personal account. It is an imperfect heuristic, but it resolves 90% of cases without needing to consult the policy.

Rule 2: separate the personal account from the corporate one

This is the single highest-impact individual measure and the easiest to apply. A corporate ChatGPT, Copilot or Gemini account typically does not train on your data, allows retention to be disabled and leaves a record for the organisation. A personal account offers none of that.

If your company has not enabled corporate accounts yet, that is the concrete ask worth making: not "I want to use AI", but "I need a corporate account so I am not using my personal one with client information".

Rule 3: anonymise before pasting, not after

Most queries do not need real data to produce a good answer. Replacing names, tax IDs, specific amounts, domains and internal paths with placeholders keeps the answer useful and removes almost all the risk.

A real example of the difference. Instead of: "Draft a formal demand letter for Talleres Martínez S.L., tax ID B12345678, for €14,320 unpaid on invoice F-2026-118." Use: "Draft a formal demand letter to a business client for an unpaid invoice, leaving placeholders for name, tax ID, amount and invoice number." The second version gives you the same template and sends no identifiable data to any third party.

Rule 4: what never gets pasted, regardless of the account

There is one category of data where the rule admits no nuance: health data, third-party financial data, credentials or API keys, data on minors, and information under an explicit confidentiality agreement with a client.

Credentials deserve a separate mention because the mistake is surprisingly common: pasting a configuration file or a full log so the AI can help debug an error, without noticing that a password, a token or a connection string is travelling inside it. Before pasting a log or a config file, search it for keys.

Rule 5: always review the output before it leaves your hands

Models generate plausible text, not necessarily true text. In a professional context that translates into three concrete risks: figures and dates invented with complete confidence, legal or regulatory references that do not exist, and code that runs but introduces a vulnerability —concatenated queries, missing validation, outdated dependencies.

The operating rule: the AI drafts, the person signs. If something goes to a client, into a contract or into production, somebody has to have read it and understood it. And if the result is published or delivered to a third party, it is worth stating that AI assistance was involved.

Ten-second checklist before pasting

Check	If the answer is no
Am I on the corporate account?	Switch accounts before continuing
Have I removed real names, tax IDs, amounts and domains?	Anonymise first
Are there credentials, tokens or keys in what I am about to paste?	Strip them, always
Is this health data, third-party financial data, data on minors or under NDA?	Do not paste it, find another route
Am I going to review the output before using it?	Review it, especially figures, citations and code

If all five answers are yes, go ahead. If any is not, the tool is not the problem: the specific piece of data you were about to feed it is.

FAQ

Can I use ChatGPT for work if my company has no AI policy?

You can, carefully, applying the rules in this guide: corporate account where one exists, anonymise first, never credentials or regulated data, and review the output. That said, the absence of a policy is an organisational problem, not yours: it is worth raising the need for one, because without it every person improvises a different standard and the company has visibility into nothing.

Is it safe to paste my company code into an AI assistant?

It depends on the account and the code. On a corporate account that does not train on your data, to debug an isolated function, the risk is low. On a personal account, or with code containing proprietary business logic, credentials or connection strings, no. As a practical rule: share the minimum snippet that reproduces the problem, never the whole file or the repository.

Is Microsoft 365 or Google Workspace AI safer than ChatGPT?

When deployed in the corporate tenant, yes, in one specific respect: the data stays inside the contracted environment and under the processing agreement you already hold with the vendor. But it introduces a different risk: these assistants access everything your user can see, so if your file permissions are wrong, the AI suddenly surfaces information that had been badly shared for years but buried.

Do I have to disclose that content was generated by AI?

For content that is published or delivered to a third party, it is the recommended practice, and in certain scenarios involving interaction with people the AI Act requires explicit transparency. Internally it usually need not be declared, but it should be clear who reviewed the content, since that is the part carrying the responsibility.

Related service

safe AI use training and governance

Sources

Train your team in safe AI use