Using AI Securely at Work: 8 Practices Every Team Should Follow

AI tools like Claude, ChatGPT and Copilot can change how your team works. They can also turn a productivity win into a breach in a single paste. The difference is not the tool. It is whether your team knows what data belongs in it and has a few guardrails in place.

The eight practices below are the ones we walk clients through. Each is mapped to the NIST AI Risk Management Framework or the NIST Cybersecurity Framework 2.0, so they line up with what auditors and insurers already expect.

1. Set the rules before you start

Decide which AI tools are approved, what data is allowed in them, and who owns the output. Put it in writing. No policy means no guardrails. (AI RMF: Govern)

2. Never feed AI your secrets

Keep client personal information, health records, passwords, financials and confidential strategy out of public AI tools. Once it is pasted in, you have lost control of it. (CSF: Protect)

3. Use business-grade accounts

Run approved tools on company-managed logins with single sign-on, multi-factor authentication and least-privilege access. No personal accounts for work data. (CSF: Protect, Identity)

4. Trust, but verify every output

AI can sound confident and still be wrong. A person reviews anything AI helped produce before it is sent, signed, billed or acted on. (AI RMF: Measure)

5. Know where your data goes

Check each vendor's terms. Is your data used to train their model? How long is it kept? Favor tools that do not train on your content. (AI RMF: Map, CSF: Identify)

6. Watch for AI-powered attacks

Deepfake voices, AI-written phishing and prompt injection are rising fast. Verify any unusual request for money or data through a second channel, such as a call back on a number you already have. (CSF: Detect)

7. Eliminate shadow AI

Take inventory of the AI tools employees actually use. Unapproved tools are unmanaged risk, and you cannot protect what you do not know about. (AI RMF: Govern, CSF: Identify)

8. Have a plan when it goes wrong

Treat accidental data exposure through an AI tool as a security incident: contain it, report it and document it like any other breach. (CSF: Respond and Recover)

What is generally safe, and what is not

A quick rule of thumb for your team:

• Keep out of AI tools: customer or employee personal information, patient health information, passwords and credentials, financial statements and payroll, confidential contracts and strategy.
• Generally safe: drafting public-facing content, brainstorming and summarizing, explaining concepts, cleaning up non-sensitive documents, and anything you would be comfortable posting publicly.

A note on Claude specifically

For business use, choose Claude Team or Enterprise. Under Anthropic's commercial terms, your content is not used to train models by default. Personal Free, Pro and Max plans should have training turned off in privacy settings, or should not be used for company data. If you handle patient information, only a qualifying commercial plan with a signed business associate agreement is HIPAA-eligible.

Free download: Using AI Securely

We put all eight practices, the safe and unsafe lists, and the Claude notes into a one-page guide your team can keep at their desk. Download Using AI Securely from our free resource library.

Not sure where your team stands?

Get your free Cyber and AI Risk Score. It takes about five minutes and shows where your AI use is protected and where it is exposed.