Copyright forbes
Photo by Solen Feyissa on Unsplash UNSPLASH.COM With its conversational and seemingly discreet nature, it was only a matter of time before people started using ChatGPT as a therapist. Even professional therapists acknowledge its uncanny effectiveness. One wrote, “In moments of grief, fatigue, or mental noise, the machine offered a kind of structured engagement. Not a crutch, but a cognitive prosthesis—an active extension of my thinking process.” With no fear of judgment, people are surprisingly forthcoming with the AI, disclosing all types of personal and private details. Similarly, businesses and employees are sharing sensitive information with ChatGPT—often without even realizing it. Studies have shown that employees regularly copy and paste sensitive data, or upload files containing sensitive information, into ChatGPT prompts. A substantial portion of this usage occurs via unmanaged personal accounts, leaving companies totally in the dark and unable to manage the risks. As ChatGPT usage continues to skyrocket for both personal and business purposes, it’s increasingly important for business leaders to establish clear guidelines for safe use. Here are some best practices for using ChatGPT without compromising your business’s security. Only Permit Data That’s Strictly Necessary I’ve written before about best practices for using ChatGPT. In short, I encourage using it for tedious, manual parts of work that don’t require human judgment, freeing up time for more meaningful tasks. For example, ChatGPT can help edit text, but you shouldn’t outsource the creative side of writing. Just as you’re careful about which tasks you delegate to ChatGPT, it’s equally important to be mindful of the information you share. As a rule of thumb, provide only the minimal information necessary for the AI to complete a task. Avoid pasting personally identifiable information (PII—anything that can be used to identify you), payment details, trade secrets, or your confidential business plans. MORE FOR YOU With my company, here’s the rule of thumb I encourage our employees to use: Think of ChatGPT like a company Slack channel—assume that anything you input could one day become public. Use Enterprise Or Controlled AI Platforms Recent research has found that nearly 60% of professionals use AI tools that their companies have not approved—commonly called “shadow AI.” The name sounds ominous, and for good reason: 75% of shadow AI users admit to sharing sensitive company data, potentially creating significant risks for businesses. To address this, companies should explicitly discourage employees from using free, unmanaged AI accounts and instead rely on enterprise-level AI platforms. These controlled platforms can provide access management, activity logging, and built-in compliance features, helping reduce the risk of accidental data disclosure. Which leads to my next point. Train Employees On Safe AI Use French poet Charles Baudelaire once wrote, “The devil's finest trick is to persuade you that he does not exist.” ChatGPT’s finest trick is to convince you that it’s not working for you (or your employees). Ignoring AI tools or pretending that they don’t exist is the quickest way to run afoul of safe usage. Leaders should hold regular training sessions (during the workday, to avoid cutting into your team’s personal time) to educate employees on safely using ChatGPT and other AI. Educate staff on what data is sensitive, what should never be shared, and lay out smart strategies for using AI tools. For example, demonstrate how to anonymize and sanitize their ChatGPT prompts—replacing sensitive identifiers with placeholders (e.g., Client X, Product B, Region 1). Offer clear examples of what to do—and what not to do—and give employees the necessary slack in their schedules to test AI on their own. Create And Update An Acceptable Use Policy Training is the first step in setting clear guidelines for employees using ChatGPT. The next step is formalizing rules in a company-wide policy that’s easily accessible. At my company, for example, we’ve drafted guidance on essential usage topics and compiled answers to FAQs. Our policy covers how to access the company’s AI platforms, permitted prompts, prohibited data types, and how to report incidents and concerns. We also hold a standing monthly meeting with the AI compliance team to review and update the policy, ensuring it evolves alongside our tools and business needs, and of course, the continually changing AI landscape. By formalizing these rules, companies create a clear framework that protects sensitive data, reduces risk, and sets expectations for responsible AI use. Final Thoughts AI is changing the way companies operate, opening up vast potential for automation. Nevertheless, it’s critical to always keep humans in the loop. Never fully delegate decisions involving sensitive information to AI. When ChatGPT drafts something for you, treat it as a first pass, not a final product. It can be surprisingly creative, but it also makes bold mistakes. Always review outputs for accuracy, compliance, and tone before sharing or acting on them. And remember: AI is always evolving. What’s safe or effective today might shift tomorrow, so revisit your company’s policies regularly to stay current and safe. Editorial StandardsReprints & Permissions
