Lesson 2: Choosing Approved Tools and Following Workplace Policy

Why the account matters as much as the tool

In Level 1 you saw what AI assistants can and cannot do in finance work. This level covers what you have to settle before you type anything: which tool, on which account, under which rules.

This course is general information, not accounting, tax or legal advice. Your firm's policy and your professional body's rules always come first.

The same assistant can come in different versions, and they handle your data differently. Think of the difference between a personal current account and a business banking facility at the same bank. The logo is the same, but the terms, the controls and who is responsible are not. AI tools work the same way:

• Consumer plans (free or personal paid accounts) are covered by consumer terms. Whether your chats are used to improve the vendor's models usually depends on a setting you control.
• Business or enterprise plans are covered by a business contract that your organisation signs. An administrator manages them, and the vendor usually commits not to train its models on your data by default.

Task 1: Compare consumer and enterprise versions

Here is what each vendor's own help pages said in October 2026. These pages change, so check them again before you rely on them.

• ChatGPT (OpenAI). On personal accounts, model training is controlled under Settings > Data controls > "Improve the model for everyone". Temporary Chats are not used for training, and OpenAI may keep a copy for up to 30 days. OpenAI says it does not use data from ChatGPT Business, Enterprise, Edu or its API for training by default.
• Claude (Anthropic). Consumer terms updated in September 2025 apply to Claude Free, Pro and Max. Users choose whether their chats can be used for model training. If they allow it, data from new chats is kept for up to five years. If they don't, the 30-day retention period still applies. These terms do not apply to commercial offerings such as Claude for Work (Team and Enterprise) or the API.
• Gemini (Google). In the consumer Gemini app, chats can be used to improve Google's models and a sample is read by human reviewers. Google's privacy hub tells users not to enter confidential information. With Keep Activity turned off, chats are still kept for up to 72 hours. Chats already reviewed by humans can be kept for up to three years. In qualifying Google Workspace editions, Google says your content is not reviewed by humans or used to train models outside your organisation without permission.
• Microsoft Copilot (formerly Microsoft 365 Copilot). Microsoft now calls these products Microsoft Copilot and Microsoft Copilot Chat. When you sign in with a work account, prompts and responses get enterprise data protection: they are not used to train foundation models, and they are logged for your organisation's audit. A green shield next to the New Chat button shows that this protection is on.

Do this: For each tool you might use, write down the account type (personal or work) and the date you checked its help page.

Task 2: Check a tool's settings against its official help page

Don't rely on memory, blog posts or a colleague's word. Follow these steps:

1. Identify the exact account. Are you signed in with your work email through your organisation, or with a personal login?
2. Open the vendor's official help or privacy page. For example, OpenAI's Data Controls FAQ, Anthropic's consumer terms update, Google's Gemini Apps Privacy Hub or Microsoft Learn's enterprise data protection page.
3. Find three facts: whether your data is used for training, how long it is retained, and whether humans may review it.
4. Compare with your actual settings. Open the settings or privacy menu in the tool and confirm they match. In Copilot Chat, look for the green shield.
5. Record it. Write down the tool, the account type, the three facts, the source URL and today's date.

Remember: turning off a training setting on a personal account does not make it an approved work tool. Retention, human review and your employer's contract still matter.

Task 3: Find and apply your workplace AI policy

Most firms now have an AI policy or acceptable-use policy, sometimes inside the IT or information security policy. Find it on the intranet or ask your manager, IT or compliance team. Then read these three parts first:

• Approved tools. Which products, on which account type, are allowed? Example: "Copilot Chat with a work account only; no personal ChatGPT."
• Permitted data. What kinds of information may go into each approved tool? Some policies allow anonymised or public information only. Others allow client data in enterprise tools. Level 3 covers this in detail.
• Sign-off and records. Who must review AI-assisted work before it reaches a client? Do you need to note that AI was used on the file?

Example: Priya, a bookkeeper, wants an AI draft of a client email explaining a late-filing penalty. Her firm's policy approves Copilot Chat on work accounts, allows client names but not bank details, and requires a manager to review any client-facing draft. She uses Copilot Chat, checks for the green shield, leaves out the account numbers and sends the draft to her manager for sign-off.

If your organisation has no policy, don't make your own rules. Ask in writing, and use only public, non-client information until you get an answer.

Task 4: Use the go/no-go checklist

Before each new type of task, answer these questions in order:

1. Is this tool and account type on the approved list?
2. Have I checked the settings (training, retention, human review) against the official help page recently?
3. Is the data I plan to use allowed for this tool under the policy?
4. Do I know who signs off the output and how AI use is recorded?
5. If any answer is "no" or "not sure": stop and ask before going ahead.

Try it now: Pick one task from your own week, such as drafting a client chaser email. Run it through the five questions and write down your answers.

Key takeaways

• The same brand can have consumer and enterprise versions with different data terms. The account type matters.
• Check training, retention and human review on the vendor's official help page, and date your check.
• A personal account with training turned off is still not an approved work tool unless your policy says so.
• In a workplace AI policy, read three parts first: approved tools, permitted data and sign-off.
• Use the five-question checklist. If you're unsure about anything, stop and ask.