How to use ChatGPT at work safely

Using ChatGPT and other AI tools safely at work comes down to three decisions: what can and cannot be sent to these tools, which tools and plans are approved for professional use, and in which situations an answer needs human review before it is used.

Most companies already use AI, with or without permission. Employees paste emails, spreadsheets and contracts into public tools to save time. Banning everything rarely works and pushes usage underground. The more effective approach is to guide: allow the productive uses, block the risky ones and provide suitable tools.

This can be handled with a short internal policy, a quick training session and, as usage grows, by choosing business plans or integrating AI into the company's systems.

Productive everyday uses

Tools such as ChatGPT, Claude, Gemini and Copilot are built on language models, systems trained on large volumes of text that read, summarize and write in natural language. In everyday work, they help with tasks such as:

• Drafting emails, announcements and replies to customers.
• Summarizing long texts, meeting minutes and reports.
• Checking grammar, clarity and tone.
• Generating ideas for campaigns, headlines and scripts.
• Explaining a technical concept or a spreadsheet formula.
• Translating texts and adapting language for different audiences.
• Helping write code, reviewed by someone who knows the system.

What these have in common is that the person remains responsible for the result. AI produces a draft, and the user reviews, adjusts and decides. Our article on how to use AI in business covers uses that go beyond individual work and are built into business processes.

The risks of using AI without guidance

Leaks of confidential and personal data

This is the most immediate risk. When someone pastes a customer contract, the payroll spreadsheet, the sales strategy or the system's source code into a public tool, that information leaves the company's control. Depending on the plan and settings, it may be stored by the vendor and, in some cases, used to improve its models.

When the text contains personal data, such as names, ID numbers, phone numbers or health information about customers and employees, the problem is also a legal one. Sending that data to an external service is processing of personal data and must comply with data protection law. In Brazil, that law is the LGPD (Lei Geral de Proteção de Dados), Brazil's data protection law, similar in spirit to Europe's GDPR. Companies in other countries should check the data protection rules that apply to them.

Wrong answers delivered with confidence

Language models can produce false information that looks true, which is called hallucination. They can cite a law that doesn't exist, get a calculation wrong or invent a reference. The text looks correct, and that's what lets the error slip through. On legal, tax, financial and technical topics, review by someone who knows the subject is mandatory.

Copyright and intellectual property

Text, images and code generated by AI can resemble protected content. The issue is still being debated in many countries, and vendors' rules change. For public-facing materials, such as campaigns, marketing pieces and products, it's worth checking originality and reviewing the tool's terms of use. Sending a third party's material covered by a confidentiality agreement to an AI tool may also breach that agreement.

Dependence and loss of know-how

If an important task comes to depend on someone who "asks the AI" without understanding the result, the company loses the ability to check what is being delivered. AI should speed up people who know how to do the work, not replace the knowledge needed to review it.

An internal AI use policy

A use policy doesn't need to be long. One or two pages, in plain language, cover most cases. It should answer four questions.

What can be sent

• Public or general-purpose text, with no customer identification.
• Your own drafts, for writing review.
• Conceptual questions and requests for explanations.
• Anonymized data, from which no person or customer can be identified.

What cannot be sent

• Personal data of customers, employees or suppliers.
• Contracts, proposals and documents marked as confidential.
• Undisclosed financial information, strategy and sales data.
• Passwords, access keys, tokens and system credentials.
• Source code of internal systems, unless in a tool approved for that purpose.

Which tools are approved

List the authorized tools and plans. Decide whether use must happen through company accounts and who administers those accounts. Tools not on the list should be evaluated before they are used with company information.

When human review is mandatory

All content sent to customers, published or used in a decision must be reviewed by a person. On legal, tax, health and safety topics, the review should be done by someone with technical knowledge of the area.

A practical rule for the team: if you wouldn't paste this text into an email to someone outside the company, don't paste it into an AI tool that hasn't been approved.

Beyond the document, a short training session with real examples from the company's day-to-day work, plus a channel for questions, goes a long way.

Free personal account or business plan

There is an important difference between an employee using a free personal account and the company contracting a business plan or using the API, the interface through which other systems access the model.

Business plans usually offer centralized account management, control over who has access, specific contractual terms on data use and retention and, in many cases, security features such as single sign-on. Personal accounts are outside the company's control: when the employee leaves, the conversation history goes with them.

Rules on data retention, use for training and privacy vary between vendors and between plans, and they change over time. So before approving a tool:

• Read the terms and privacy policy of the plan you will actually contract, not those of the free plan.
• Check whether the data you send can be used to train models and whether that can be turned off.
• Find out how long data is stored and where it is processed.
• See whether the vendor offers a data processing agreement compatible with the LGPD or with the data protection law that applies in your country.

Data protection law and the use of AI

Under the LGPD, the AI tool vendor generally acts as a processor (in the law's terms, an operador) of the data the company sends. The company remains responsible for having a legal basis for the processing, for sending only what is necessary and for ensuring security. If data is transferred outside Brazil, that transfer must also be covered under the law. If your company operates elsewhere, check how the data protection rules of your own country treat these points.

In practice, the safest approach is to avoid sending personal data to general-purpose tools and, when a process requires it, to use a solution with an appropriate contract and access controls. Our article on the LGPD for websites and software covers legal bases, processors and responsibilities under Brazilian law.

When it makes sense to integrate AI into your systems

Using AI through a chat window solves individual tasks. When the same kind of task repeats many times, with the same data, it makes sense to bring AI into the company's systems. Some signs:

• The team copies data from one system, pastes it into an AI tool and puts the result back into another system.
• Several people ask the same question about internal documents. In that case, an assistant built with RAG answers from the documents and cites the source.
• Customer service gets repeated questions that an AI chatbot could answer.
• There are multi-step tasks across different systems that could be candidates for AI agents.

Integration through the API lets you control what data is sent, log every use, apply permission rules and measure cost. It also eliminates copy and paste, which is where many leaks happen.

Frequently asked questions

Should I ban ChatGPT at my company?

A total ban tends to drive hidden use, on personal accounts and without guidance. In general, it works better to allow safe uses, define what must not be sent and provide an approved tool for work.

Does a business plan eliminate all the risks?

No. It improves account control and the contractual terms around data, but it doesn't prevent wrong answers, or stop someone from sending information they shouldn't. The use policy and human review are still necessary.

Can I use AI to analyze customer data?

Yes, provided there is a legal basis under the LGPD (or under the data protection law that applies in your country), the tool has appropriate contractual terms and only the necessary data is sent. Whenever possible, anonymize the data before analysis.

If your company wants to organize how it uses AI, or bring that use into its systems with control over data and access, we can help you assess the situation. PERVOX works remotely and can run the project in English. Explore our solutions or get in touch to talk.