AI Acceptable Use: What's Allowed and What's Not

AI Acceptable Use: What's Allowed and What's Not

AI Acceptable Use: What's Allowed and What's Not

Overview

AI tools can speed up your work, but they also create new risks. This article covers the everyday principles for using AI at work safely. Your company's full AI policy may go further. When the two disagree, your company policy wins.

Before You Begin

  • Locate your company's AI policy. HR or your security team can point you to it.
  • Know which AI tools your company has approved. Common ones are Microsoft Copilot, Google Gemini, and ChatGPT Enterprise.
  • Recognize what counts as company-sensitive data: customer records, financial details, HR information, source code, and anything marked confidential.

Steps

  1. Use approved AI tools only. A free consumer tool may train on what you type. The same prompt in the company's Enterprise tool does not.
  2. Never paste customer-identifying data into a public AI tool. Names, emails, phone numbers, account numbers, and health or financial details all qualify.
  3. Avoid pasting proprietary code or internal documents into public AI tools. Once it leaves your tenant, you cannot pull it back.
  4. Treat AI output as a draft, not a finished product. Read, fact-check, and edit before you send or publish.
  5. Disclose AI use when policy requires. Some industries require you to label AI-assisted content. Some clients expect it in deliverables.
  6. Keep humans in the loop for important decisions. Hiring, firing, legal advice, medical guidance, and financial recommendations should never be driven by AI alone.
  7. Watch for hallucinations. AI tools sometimes invent quotes, citations, statistics, or contact details. If something matters, verify it from a trusted source.
  8. Report AI mistakes that cause harm. If an AI-generated message went out with bad information, tell your manager so the team can correct it.

Troubleshooting

  • If a coworker is pasting customer data into a free AI tool: flag it. A friendly heads-up first, then loop in your security team if it continues.
  • If you used AI to draft something sensitive: review for any phrases that sound made up. Confirm names, dates, and numbers before sending.
  • If a vendor's product adds AI features overnight: check with your security team before using them. New AI features sometimes change how data is handled.
  • If you are unsure whether a use case is allowed: ask first. It is faster than walking back a mistake later.

Related Articles

Need More Help?

Submit a ticket at support.bostonmit.com or email support@bostonmit.com.