Why this matters before you type anything
In Level 1 you saw what AI can and cannot do for a project manager. Before you use it on real work, check which tool you are allowed to use and what happens to whatever you type into it. The same chatbot can come in a consumer version and an enterprise version, and the two handle your data differently.
Think of a personal email account compared with your work email. Both send messages. Only the work account sits under your organisation's contracts, retention rules and IT controls. AI assistants are split the same way.
This lesson has three tasks:
- Find your organisation's AI policy, or the questions to ask if there isn't one.
- Compare consumer and enterprise accounts on data, retention and training.
- Write your personal list of approved tools.
Task 1: Find and summarise your organisation's AI policy
Do this now:
- Search your intranet, policy library or staff handbook for "AI", "generative AI", "acceptable use" and "information security". The rules on AI often sit inside an acceptable-use or data-handling policy rather than a separate document.
- Check your PMO's own guidance. Programme offices sometimes add rules for client or commercial data.
- Look for a published list of approved tools, often kept by IT or information security.
- Write a five-line summary: which tools are approved, which are banned, which data types are restricted, who owns the policy, and when it was last updated.
If there is no policy, don't take that as permission. Email IT or the PMO with these questions:
- Which AI tools are approved for work use, and under which account (work sign-in or personal)?
- Is a personal paid subscription allowed for work tasks?
- Which data classifications (for example public, internal, confidential, client) may go into each approved tool?
- Are prompts and outputs kept, and for how long? Who can see them?
- Are the AI features in our project tools switched on, and are they covered by our contracts?
- Who do I ask when I'm unsure?
Keep the reply. It is your evidence that you acted in good faith.
Task 2: Compare consumer and enterprise accounts
The difference is the contract and the controls, not the brand. Paying for a plan doesn't make it an enterprise one. A personal Plus, Pro or Max subscription is still a consumer plan.
Here is how the four example vendors describe it on their own help pages (checked October 2026; these pages change, so re-check them yourself):
OpenAI ChatGPT
- Consumer (Free, Plus): conversations may be used to train models unless you switch off "Improve the model for everyone" under Settings > Data controls.
- Business plans (ChatGPT Business, Enterprise, Edu): by default, OpenAI says it does not use inputs or outputs for training.
Anthropic Claude
- Consumer (Free, Pro, Max): since the terms update of 28 August 2025, chats may be used for training unless you opt out. If you allow training, new chats are kept for up to five years. If you opt out, the 30-day retention period applies.
- Commercial (Claude for Work Team and Enterprise plans, the API): not covered by that consumer training change.
Google Gemini
- Personal accounts: with Keep Activity on (the default), activity auto-deletes after 18 months unless you change it, and chats may be read by human reviewers. Chats chosen for review can be kept for up to three years. With it off, chats are still held for 72 hours.
- Google Workspace accounts: Google states it does not use customer data to train models without permission. Admins can set conversation-history retention, switch Gemini on or off, and audit activity.
Microsoft Copilot (formerly Microsoft 365 Copilot)
- Microsoft is renaming Microsoft 365 Copilot to Microsoft Copilot, and Copilot Chat follows the same pattern. Some licences still show the old names.
- When you sign in with your work account, prompts and responses get enterprise data protection: your organisation's permissions, sensitivity labels, retention policies and audit apply, and prompts aren't used to train foundation models.
Two points to remember:
- "Not used for training" is not the same as "not stored". Even with training off, providers may keep data for a period for safety or abuse monitoring.
- Check which account you're signed in to. The same app can be running on your personal account or your work account.
Do this now: for each tool you use, open its current privacy or data-controls help page and note three things: training default, retention, and admin controls.
Task 3: Record your personal approved-tools list
Write a short table you can keep beside you. Example for a fictional PM:
| Tool and account | May use for | Must not use for |
|---|---|---|
| Microsoft Copilot, work sign-in | Drafting status notes from internal documents I already have access to | Anything my policy restricts, such as client data marked for a named team only |
| ChatGPT Business (company workspace) | Restructuring plans, drafting stakeholder emails with names removed | Commercial pricing, contract terms |
| Personal Gemini account | Learning concepts, generic templates | Any work data at all |
Rules for the list:
- Name the account, not just the product.
- List data types, not tasks alone.
- Date it and update it whenever the policy changes.
- If a tool isn't on the approved list, it goes in the "no work data" row.
Checklist
- I have found the policy, or sent my questions to IT or the PMO
- I know whether each tool I use is a consumer or enterprise account
- I have checked each vendor's current help page for training, retention and admin controls
- My approved-tools list names accounts and data types, and is dated
Key takeaways
- No policy does not mean permission. Ask, and keep the answer.
- Paying for a personal plan doesn't make it an enterprise plan.
- Enterprise plans differ in three ways: training defaults, retention you can control, and admin controls such as audit.
- "Not trained on" doesn't mean "not stored".
- Vendor terms change. Date your notes and re-check the help pages.