Lesson 2: Approved Tools and Your Firm's AI Policy

Learn to choose an approved AI tool under your employer's policy by comparing enterprise and consumer versions of ChatGPT, Gemini, Claude and Microsoft 365 Copilot on data handling, training use and retention, as stated on their current help pages.

Why the account matters more than the brand

In Level 1 you saw what AI can and cannot do for an engineer. Before you paste anything into a tool, there is a duller question to settle first: which tool, and which account?

This is where many engineers get caught out. "ChatGPT" or "Claude" is not one product. A free personal login and a company-managed enterprise seat can run the same model under different contracts. One may use your conversations to train future models and keep them for years. The other may promise no training and let your IT team set how long data is kept.

Think of hiring a plant item. The same excavator can come from a properly certified hire firm with insurance and inspection records, or from someone's mate. The machine is the same, but the paperwork and your liability are not. Your firm's AI policy plays the role of that hire firm's paperwork.

Step 1: Find your firm's AI policy

Start with the intranet, the IT or information-security pages and the staff handbook, and search for "AI", "generative", "ChatGPT" or "Copilot". Many firms keep the AI rules inside a wider acceptable-use or information-security policy. When you find the policy, write a five-line summary you can keep on a sticky note:

MY FIRM'S AI POLICY - summary (read on: 2026-10-22, version/date: ____)
1. Approved tools + account type: e.g. "M365 Copilot via work login only"
2. Banned tools/accounts:          e.g. "no personal ChatGPT/Gemini/Claude for work data"
3. Data I may enter:               e.g. "public + internal; NOT client-confidential"
4. Review/record rules:            e.g. "output checked by a competent person; note AI use in file"
5. Who to ask:                     e.g. "Digital lead / InfoSec helpdesk"

If there is no policy, that does not mean anything goes. Write the questions down and send them to your line manager or IT:

Questions for IT / my manager about AI use
- Which AI tools, if any, are approved, and must I use a company-managed account?
- Do we have an enterprise agreement (with a data processing agreement) with any vendor?
- Is our data used for model training under that agreement? Who controls retention?
- Where is the data stored (UK/EU/US)? Does any client contract restrict this?
- What kinds of information are off-limits for AI tools?
- How should I record or disclose AI use in project files?

Gotcha: "Everyone in the office uses it" is not approval. If something goes wrong, the question will be whether you followed the policy, not whether your colleagues did.

Step 2: Compare consumer and enterprise versions

Check three things for each tool: training (are my inputs used to improve the vendor's models?), retention (how long are they kept?) and storage location (where are they kept?). These summaries come from the vendors' own pages as read on 22 October 2026. Terms change often, so open each page again yourself and write down the date you read it.

# Snapshot - vendor pages as read 2026-10-22. Re-check before relying on it.
ChatGPT:
  consumer (Free/Plus/Pro):
    training: "on unless you switch off 'Improve the model for everyone' (Settings > Data Controls)"
    retention: "Temporary Chats deleted from OpenAI systems after 30 days"
    source: help.openai.com/en/articles/7730893
  business (Business/Enterprise/Edu):
    training: "not used for training by default"
    retention: "qualifying orgs can configure retention"
    storage: "data residency options incl. UK and Europe for eligible Enterprise/Edu customers"
    source: openai.com/business-data
Claude:
  consumer (Free/Pro/Max):
    training: "user chooses in Privacy Settings"
    retention: "5 years if you allow training; 30 days if not"
  commercial (Claude for Work, API):
    training: "not covered by the consumer change; not trained on by default"
    source: anthropic.com/news/updates-to-our-consumer-terms
Gemini:
  consumer (Gemini app, personal Google account):
    retention: "Keep Activity auto-deletes after 18 months by default (3 or 36 selectable)"
    note: "some chats are read by human reviewers; reviewed chats kept up to 3 years"
    source: support.google.com/gemini/answer/13594961
  workspace (Gemini in Gmail/Docs/Drive etc.):
    training: "content not used to train Gemini or other generative AI models"
    source: support.google.com/docs/answer/14615114
Microsoft 365 Copilot:
  work account with enterprise data protection:
    training: "prompts, responses and Graph data not used to train foundation models"
    controls: "respects permissions, sensitivity labels, retention policies, audit"
    source: learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection

The pattern is the same across all four vendors. Consumer accounts are built around the individual: training is on by default or left to your choice, and you control retention. Enterprise accounts are built around the organisation: no training by default, and retention, logging and sometimes storage location are set by your admins under a contract.

Trade-off: enterprise tools sometimes lag behind on new features. Wanting the latest model is a reason to ask IT for access, not a reason to go round the policy.

Gotcha: the logo can't tell you which account you're in. Check for your work email or organisation name on the profile icon. Many people have both a personal and a work login in the same browser.

Best practice: "not used for training" does not mean "safe for anything". Vendors still store and process your data, and client contracts may restrict where it goes. Level 3 covers what never to paste in.

Step 3: Choose and justify in two sentences

Worked example. Task: summarise the key changes in a publicly available draft guidance note for a team briefing. Your firm approves M365 Copilot on work accounts.

Choice: Microsoft 365 Copilot, signed in with my work account (enterprise data protection shown).
Why: It is the firm-approved tool, and under Microsoft's enterprise data protection terms
(read 2026-10-22) my prompts aren't used to train foundation models and follow our retention
policies; the source is public, so the content is low-risk anyway.

A second example. Task: tidy the wording of a method statement for a named client's site. Your only option is a personal ChatGPT Plus account. The right answer is don't. A personal account is not approved for client work under most policies, whatever the training toggle says. Ask for an approved tool instead.

Try it on your own work

Find your firm's policy and fill in the five-line summary, or send the questions list.
Pick the tool you use most. Open its current privacy or help page and record training, retention and storage, with the URL and today's date.
Take one real task from this week and write your two-sentence justification.

Checklist

Policy found and summarised (or questions sent)
I know which account I'm signed into
Training, retention and storage recorded from the vendor's own page, with a date
Two-sentence justification written for one real task

Key takeaways

The same AI brand comes in consumer and enterprise versions with different data terms. The account matters more than the logo.
Consumer accounts: training is on by default or your choice (ChatGPT, Claude), and retention can be long (Claude: 5 years if training is allowed; Gemini activity: 18 months by default).
Enterprise accounts (ChatGPT Business/Enterprise, Claude for Work, Gemini in Workspace, M365 Copilot) are not used for training by default and are run by your organisation.
Always quote the vendor's current page with the date you read it, because terms change.
No policy? Ask in writing. Don't assume.

A 6-question knowledge check follows this lesson in the app, free and without an account.

By the end of this level you'll be able to