Your Data and AI: What to Paste and What Not To

The scene that repeats in every office every day:

An eight-page contract arrives. You open an AI tool, paste it in, and type: "summarise this and tell me

which clauses are risky."

And within two seconds, a contract containing names, amounts and terms has left your control.

And nobody will blame you — because the tool gave you in a minute what would have taken an hour. **And that

is precisely why the problem is hard: the benefit is real.**

Why "do not paste data" fails as advice

The prevailing advice is "do not put sensitive data into AI tools." It fails for two reasons:

1. Nobody follows it. Because the work has to get done, and the tool gets it done.

2. It does not say where the line is. What counts as "sensitive"? A customer name? An invoice number?

A contract? With no definition, everyone decides by instinct.

And a ban that is not followed is worse than none, because it pushes the use into hiding: the employee

uses the tool from their phone rather than asking you, and you lose both the ban and the visibility.

**This course does not ask you to ban it. It asks you to know what you paste, and for your team to know it

by a rule they can apply in three seconds.**

What actually happens to what you paste

Without alarm and without minimising — the structural reality:

1. It leaves your device. It is sent to another company's servers to be processed. That is not a flaw in

the tool — it is how it works.

2. It is stored for some period. Most services retain conversations for a time, for operational reasons

and to handle misuse.

3. It may be used for improvement. Some services use what you write to develop their models and some do

not — and the difference is often between a personal account and a business account.

4. Humans may see it. Sampling for quality control or misuse review is a normal practice in this

industry.

5. It falls under the laws of wherever the servers are, which may be outside your country.

And not one of those five means "the tool is bad." All of them apply to your email and your cloud

storage too. The difference is that with email you know you are sending something, and with the tool it

feels like you are "asking a question."

The idea the course rests on

**An AI tool is not a special case. It is a third party — like your accountant, your system vendor and

your marketing agency.**

And you already know how to deal with a third party: give them the least they need, know **where your

data goes**, and sign something in writing.

So the question is not "is AI safe?" — a question with no useful answer. The question is:

Does this particular piece of information leave me, and to whom?

And the real difference from any third party

Three differences make it more dangerous in practice, and all three are **behavioural rather than

technical**:

1. There is no friction. Sending a file to your accountant is an act you decide on. Pasting is a passing

gesture that does not feel like sending.

2. There is no record. You know what you sent your accountant. **Nobody knows what your team pasted

yesterday.**

3. Every employee can do it. Engaging a supplier is a management decision. Opening an AI tool needs

nobody's permission.

And the third is the hardest: you do not have one gate to guard — you have the number of employees ×

the number of devices.

What you will leave with

• A classification list for your data: what may be pasted, what may be pasted after redaction, and what

never

• A one-page policy your team signs and can actually apply
• An approved tools list and the questions to assess any new tool
• An incident procedure: what to do when someone pastes something they should not have

What is not in this course

• No walkthrough of buttons or particular settings. Interfaces and policies change every few months, and

any course describing them becomes a source of error. You will learn what to ask of any tool.

• No comparison of models or which is smarter. Not our subject, and it changes faster than it can be

written.

• No opinion on AI itself. I use it daily. This course is about what leaves your side, not about the

tool.

And the legal question

Some sectors carry specific obligations around the confidentiality of client, patient and case data, and

some contracts contain confidentiality clauses forbidding sharing information with any third party — **and

an AI tool is a third party**.

Consult your lawyer, your syndicate, or the competent body about what applies to you specifically.

This is a course of practice, not of law.

Action steps

1. Write honestly: what are the last three things you pasted into an AI tool?
2. For each: would you have sent it to your accountant without thinking? And if not, why did you paste it?
3. Ask yourself: do you know what your team pastes? And how would you know?
4. Review your contracts: do they contain a confidentiality clause forbidding sharing with a third party?
5. Write in one line: what are you most afraid of leaving your side?