Using AI at Work = Side by Side with Confidential-Info Risk
When you ask AI, what you input is sent to a server. Inputting confidential information while ignoring internal rules/contracts/law leads directly to serious incidents like leakage or violation. First, the minimum security to hold.
Information You Must Not Input (Typical Examples)
- Customer info (name, address, phone, email)
- Unpublished contracts/pricing with partners
- Unpublished financial data/management metrics
- Employees' personal info/HR evaluations
- Unpublished product/technical specs
- Intellectual property (pre-patent ideas)
- Passwords/API keys/tokens
- Medical/health info (personally identifiable)
3 Confirmation Points
1. Terms of Service / Data Policy
Always confirm whether the AI "uses / doesn't use" input data for training (conditions differ by service/plan and can change—check the latest on official pages). General tendencies:
- Paid individual (ChatGPT Plus, Claude Pro, etc.): may be used for training; often can be turned off in settings
- Team / Enterprise / business: "not used for training" is standard
- API use: generally not used for training (major providers)
2. Internal Rules
- Confirm the company's AI-use policy (many companies already have one)
- Confirm the approved AI-tool list
- Rules by confidentiality tier (e.g., "confidential is AI-prohibited")
3. Law / Contracts
- Personal-information protection law: sending personal info to overseas servers = handle as cross-border transfer
- GDPR: EU-resident data is especially strict
- NDA: putting partner data into AI is almost a violation
- Industry regulation: finance/medical are especially strict
5 Practical Mindsets
- Masking: replace names/company/amount with "Company A" "Mr. X" "amount N" before inputting
- Ask abstractly: generalize "our XX" to "generally IT companies"
- Limit to approved tools: use company-approved tools (business plans, internal AI)
- Confirm training-off: turn on "don't use for training" in settings
- Keep logs: record what you input (needed for cause analysis on incidents)
Surprising Pitfalls
- Pasting minutes: confirm no partner info is mixed in
- Screenshots: watch for incidental capture (email addresses, screen notifications)
- CSV files: whether columns contain personal info
- Chat pastes: DM content is basically confidential
When an Incident Occurs
- Immediately report to your superior/information-security department
- Preserve the conversation history without deleting
- Consider a data-deletion request to the AI tool
- Consider contacting affected parties (customers/partners)
Summary
Confidential-info incidents usually start from a "careless paste." Just the minimal set—concretely decide what not to input, mask it, use approved tools, confirm training-off—greatly lowers risk. Organization-wide AI governance is covered in detail in the later "Adopt in the Organization" chapter.
