Safe AI at work

Keep these out of every AI tool

• Passwords, API keys and access codes.
• Unreleased financial results, and deal terms under a non-disclosure agreement.
• Anything a client contract says must stay in your systems.
• Health, religion, ethnicity, sexual orientation, union membership, criminal records, and card or bank numbers, unless someone accountable has approved the tool for them in writing.

For everything else, use the account your employer approved and paste only what the task needs. Business and personal accounts can have different terms on training and retention, so check which one you are signed in to.

Strip names before you paste

1. Replace names, emails, phone numbers and account numbers with numbered placeholders, such as [CLIENT_1] or [ORDER_1].
2. Use the same placeholder every time the same person or thing appears, so the model can follow the story.
3. Keep what the task needs, such as amounts and dates. Generalize details that point to one person, such as a rare job title.
4. Keep the list of who is who off the chat, and swap the real details back into the answer yourself.

Before: Northfield Supply disputes invoice 20931. Their buyer is at buyer@northfield.example.
After:  [CLIENT_1] disputes invoice [INVOICE_1]. Their buyer is at [EMAIL_1].

Safe Paste, at thinkhard.si/safe-paste/, does the swap in your browser and puts the details back.

Check before you send

• List every number, name, date, quote and link in the answer. The Fact Check List, at thinkhard.si/fact-check/, does it for you, riskiest first.
• Check each one against the original source, not against another AI answer.
• Open every link. A model can write web addresses that look right and lead nowhere.
• Be most suspicious of the sentence that says exactly what you hoped.

Where facts matter, add this line to the prompt:

If a fact is not in the material I gave you, write [CHECK] instead of guessing.

A person decides

AI can draft anything. A named person approves anything that spends money, makes a promise, changes a contract, goes public under the company’s name, or affects someone’s job, pay or legal position.

Say when AI helped

• Customers talking to a bot should know it, and be able to reach a person. In the EU, Article 50 of the AI Act requires that people be told they are interacting with an AI system, unless it is obvious.
• Never publish AI-written reviews or testimonials. In the US, the FTC’s 2024 rule bans fake reviews, including AI-generated ones.
• Inside the company, say when a document was drafted with AI and who checked it, so readers know how much checking was done.

Practical guidance, not legal advice. The full checklist is at thinkhard.si/guides/ai-at-work-risk-checklist/.