Services
Explore
Free AI assessmentAnswer 15 questions about one process and see where AI could help.
Start an assessmentUsing AI with business data: what to decide before you start
Whether an AI tool is appropriate for your data depends on the tool, the plan, its settings and how your team uses it. This guide sets out the questions to answer first.
The short answer
Data risk depends on the tool, the plan and how it is used
Whether an AI tool is safe to use with business data depends on what it is for, what data goes into it, the provider's terms for your plan, who has access, how long data is kept, what it connects to and how output is checked. Answer those questions before staff use a tool for work.
Some concerns about AI and data are well founded, and some apply only to certain tools or plans. Working through the questions below helps you decide which apply to you and what safeguards you need.
A business plan with suitable terms, sensible settings and a clear staff policy reduces many risks, but none of those on its own makes a particular use lawful or secure. The safeguards need to fit the data and the task.
Common risks
Data risks to look at first
Entering client personal data, financial records or commercially sensitive information into a free or personal account may mean it is used to improve the provider's models or kept under terms you have not agreed. Business plans often have different terms. Check the terms for the exact plan.
AI providers keep inputs and outputs for different periods and purposes, and this can vary by plan and setting. Find out what is kept, for how long and why before using a tool with business data.
If staff use personal AI accounts for work, the business has no agreement with the provider covering that data. An organisational account with agreed terms and a clear usage policy gives you more control.
AI output can contain errors. If it reaches clients or business records without being checked, mistakes go with it. Decide who checks what, and before which action.
Decision checklist
Questions to answer before using AI with business data
What is the tool for, and which categories of data may go into it? List the data that must not be used, such as special-category personal data, unless specific safeguards are agreed.
What do the provider's current terms for your plan say about training use, retention, access by the provider and data location? Where personal data is involved, check what data protection agreement is needed and what it covers.
Who can use the tool, and what systems is it connected to? Give connections the minimum access they need. Write a short policy saying which tools are approved, what data is allowed and who to ask.
Who checks output before it is used, and what happens if data is entered by mistake or output causes a problem? Agree how incidents are reported and handled, and whether a private or self-hosted setup is needed for very sensitive data.
UK data protection
What UK data protection law means for your AI use
UK data protection law applies when an AI tool processes personal data. The roles of the parties, and the agreements needed between them, depend on the provider, the plan and how the tool is used, and can differ from one provider to another.
When we work on a project, we identify the rules that apply to the work with you and agree the safeguards and checks before anything goes live. This page gives general information and is not legal advice. For decisions about lawful basis, controller and processor roles or special-category data, take advice from a qualified data protection specialist.
Common questions
Questions about AI data security
Is using AI tools a data protection risk?
It can be, particularly if personal data goes into a tool without suitable terms and agreements in place. The risk depends on the data, the plan, the settings and the usage policy. Work through the checklist above before using a tool with personal data.
What data should we never put into an AI tool?
As a cautious starting position, keep out patient data, client financial data, employee personal data and commercially sensitive information until you have checked the provider's terms, the agreements in place and the controls on the account. Write the categories into your usage policy.
Is AI safe to use in healthcare or dental practice?
It depends on the tool, the setup and the data. Some tools are designed for clinical settings, and some general tools can be configured with additional safeguards. Identify the rules and professional guidance that apply to your practice, and get specialist review, before choosing a tool for patient data.
Does AI learn from our data?
Some consumer accounts may use your inputs to improve the provider's models. Business plans and the API often have different terms, and some settings can be changed. Check the current terms for the specific plan and setting you use.
What should our AI usage policy cover?
Which tools are approved for work, which data categories may and may not be entered, how output is checked before it reaches clients or records, how to report a mistake and who to contact with questions. Keep it short enough that staff will read it.
Do we need a lawyer or compliance specialist to use AI safely?
For low-risk tasks that involve no personal or confidential data, a clear policy and the checklist above may be enough. If you work in a regulated sector or with personal or special-category data, a review by a qualified data protection or compliance specialist is worth the time.
Talk to us
Want help applying this to your business?
Bring the task that takes your team the most time. We reply within one working day.