On Friday, we hosted an AI Powered Workplace webinar on using AI safely for Cybersecurity Awareness Month. The question behind it: how do you use AI safely and still get the work done?
Most teams are somewhere in the middle. People are using AI to clean up notes, tidy spreadsheets, and make sense of vague feedback. When we asked the audience which task takes the most time, feedback won. But many teams are unsure which tools are approved, what they can paste in, and how much to trust what comes back.
Vic Sweeting, our AI process consultant, walked through three habits for using AI safely and two live demos.
“The models have gotten better. They’ve also gotten way more convincing when they don’t have the right information to begin with. So verify.”
Vic Sweeting, AI Process Consultant, GadellNet
Three Habits for Using AI Safely
Use the right tool
A work email or a paid plan does not automatically make a tool approved. Ask how prompts are stored and whether they train the model. Notetakers, plugins, and agents need approval too. Once you as an organization have asked the question, and decided on the answer, get it in writing: which tool, which account, and which data.
This came up in the chat. An attendee from a financial institution asked what data they should keep out of Copilot. The answer starts with Microsoft’s enterprise data protection, which keeps your data out of model training, and ends with your own policy and agreements which ultimately decide what is allowed.
Share less, still get the answer
Before you paste anything into a new tool, ask: Would I be OK if this showed up on a public website?
We call this the AI Safety Stoplight: sort data by how much it would hurt if it showed up on a public website.
- Green: Public information and general questions.
- Yellow: Internal plans and drafts. Use an approved tool and cut the extra detail.
- Red: Client data, passwords, HR, and legal. Ask first.
In the first demo, a messy renewal spreadsheet became a clean three-column table with one short prompt. The prompt told the AI to use only what was in the file and to mark gaps as “needs confirmation.” Client details stayed out.
Trust, but verify
AI can sound sure and still be wrong. Vic shared a client story. An AI assistant said it had created a mailbox automation. When he checked, nothing had changed.
We also practiced on a fictional meeting note. The AI summary changed the date from October 30 to October 31 and added a room that was never confirmed. Summaries always need a human check against the source.
One more risk: hidden instructions. In the second demo, a vendor quote hid a line telling the AI to call the contract month-to-month with no cancellation terms. At medium effort, Sonnet flagged it. A smaller model at low effort followed it. The model you choose matters, and so does reading a file before you trust it.
What to Do If You Paste the Wrong Data Into AI
- Stop. Do not add more data.
- Report. Tell your IT team, even if you are unsure.
- Follow policy. Your policy and your AI steering group decide what happens next.
Leaders can test how well their team is using AI safely with a 15-minute tabletop exercise, like a cyber drill. Ask your team: if someone pasted a client list into a personal AI account today, who would they tell?
Try this week: Use AI Safely on One Task
Pick one safe task in an approved tool, with no client data:
- Turn notes into next steps and flag what is unclear.
- Fix spreadsheet formatting and flag anything that looks off.
- Ask what a reviewer wants, and request two readings.
- Quiz yourself with fictional phishing emails.
Last month, we shared how to build an AI brand standard. The idea carries over: start small, with one workflow, one owner, and one standard people can follow.
“Right tool. Right input. Right questions.”
Vic Sweeting, AI Process Consultant, GadellNet
Join us December 4 for Claude for Nonprofits, our next AI Powered Workplace session.
Frequently Asked Questions: Using AI Safely
Using AI safely at work means three habits: use a tool your organization has approved, share only the data the task needs, and check what comes back before you rely on it. It doesn’t mean avoiding AI. It means knowing which tool, which account, and which data are allowed, and keeping a human in the loop for anything that matters.
Never put passwords, API keys, or other credentials into any AI tool. Keep client data, HR records, and legal matters out unless your organization has approved that specific tool for that data. A simple test: would you be OK if this showed up on a public website? If not, use an approved tool, cut the extra detail, or ask first.
Not automatically. A personal paid plan is not the same as a business plan, and a work email doesn’t make a tool approved. Ask how prompts are stored, how long they’re kept, whether they train the model, and who can see them. Then get the answer in writing. Notetakers, plugins, and AI agents need the same review, because they can reach more data than a chat window.
Stop, report, and follow policy. Tell your IT or security team right away, even if you’re unsure it matters. Don’t add more data, and don’t delete the chat yourself: deleting it may not remove the data from the vendor, and IT may need to see what was shared. A quick report gives them the best chance to limit the impact.
A hidden instruction, also called prompt injection, is text inside a file, email, or web page that tells an AI tool to do something you didn’t ask for, like misstating a contract’s terms. It’s often invisible to a person reading the file. Some models catch it and some follow it. Treat files from outside your organization with care, verify any AI summary against the source, and be extra careful with AI tools that can take actions for you.
