A practical data safety checklist for using AI at work

Start with data classification

Before pasting anything into an AI tool, decide whether the material is public, internal, confidential, or regulated. Public examples and synthetic test data are usually easier to handle safely than customer records or proprietary source code.

Understand where the data goes

Review the product's workspace settings, retention terms, access controls, connected tools, and whether submitted content may be used for model improvement. Settings can differ across personal and enterprise plans, so do not assume all accounts behave alike.

Limit what an assistant can access

Use least-privilege access for connected repositories, drives, email, and internal systems. Test integrations in a limited environment first. Require human review before AI-generated commands change production infrastructure, financial records, or customer communications.

Build a lightweight approval process

Publish a short acceptable-use policy, an approved-tool list, and a clear path for requesting new AI workflows. Review vendor security documentation, log administrative changes where available, and periodically remove unused permissions.

Keep humans accountable

Treat AI output as a draft or recommendation, not an authoritative source. Verify citations, calculations, and operational instructions before publishing or acting on them.

Further reading

• NIST AI Risk Management Framework
• CISA Secure Our World