Approved Tools and Reading Your Workplace AI Policy
Level 1 covered what AI assistants can and cannot do. This level covers the two questions to answer before you type anything work-related into one:
- Is this tool approved by my organisation?
- What does my policy let me do with it?
Think of the difference between your personal mobile and a service-issued radio or tablet. Both can send a message. Only one is managed, logged, supported and covered by your organisation's rules. AI tools work the same way.
Why the Account Matters, Not Just the Brand
Many AI brands come in two versions: a personal (consumer) account you sign up for yourself, and an organisation-managed (enterprise) version your service buys and controls. The name can be the same while the data handling is very different.
| Personal consumer account | Organisation-managed tool | |
|---|---|---|
| Who holds the contract | You, under consumer terms | Your organisation, under a data protection agreement |
| Use of your chats for training | Often on by default, or your choice | Not used to train models by default |
| Your organisation's controls | None. Your employer cannot see, audit or delete what you entered | Your organisation's permissions, retention, labels and audit logging apply |
Examples, as of October 2026:
- ChatGPT Free, Plus and Pro: OpenAI uses conversations to improve its models by default unless you switch off 'Improve the model for everyone' in Data Controls. ChatGPT Business and Enterprise data is not used for training by default.
- Gemini (personal Google account): with Keep Activity on, Google uses your chats to improve its services, including training AI models, and human reviewers may read some of them. Gemini in Google Workspace does not use your prompts to train models outside your organisation without permission.
- Claude Free, Pro and Max: since Anthropic's consumer terms changed on 28 August 2025, users choose whether their chats are used for training. If you allow it, data can be kept for up to five years. Claude for Work and Claude for Government are not covered by these consumer terms.
- Microsoft Copilot: Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot and Microsoft 365 Copilot Chat to Microsoft Copilot Chat, so you may still see the old names. Prompts and responses are covered by your organisation's agreement with Microsoft and are not used to train foundation models.
Important: switching off training in a personal account does not make it approved. Your organisation still has no contract, no audit trail and no control.
Task 1: Check Which Account You Are In
Do this every time you open an AI tool for work:
- Check the sign-in. Are you signed in with your work account (your service email, through your organisation's login page) or a personal email?
- Look for the protection marker. In Microsoft Copilot Chat, a green shield at the top, next to the New Chat button, shows that enterprise data protection applies. If there is no shield, stop.
- Check the route in. Did you open the tool on a work device, from your organisation's portal or approved app list?
- If you are unsure, treat it as a consumer account and do not use it for work.
Note: even in an enterprise tool, some features follow separate terms. For example, Copilot's web searches are sent to Bing, which handles them under Microsoft's own terms. This is one more reason to read your local policy.
Task 2: Find Your AI Policy
- Search your intranet for 'artificial intelligence', 'generative AI', 'acceptable use' and 'information security'.
- Check the information governance or data protection pages. AI rules are often a section inside a wider ICT or acceptable-use policy.
- If you cannot find anything, ask your line manager, information security team or Data Protection Officer. No policy does not mean permission.
- Note the version and date. AI policies change often, so check again every few months.
For context: in September 2023 all members of the National Police Chiefs' Council endorsed the Covenant for Using Artificial Intelligence in Policing. It says AI use should be lawful, transparent, explainable, responsible, accountable and robust. Your force's local policy is how principles like these turn into day-to-day rules. Fire and ambulance services set their own policies through their own governance.
Task 3: Read the Policy for What Matters
Pick out these four things and write them on one page:
- Approved tools: which named tools and versions you may use.
- Allowed uses: for example, drafting internal emails or summarising published guidance.
- Banned uses and banned information: tasks and types of data that must never go into a tool. The next level covers this in depth.
- Who to ask, and how to report a mistake: a named team or mailbox.
Also check whether you must record or declare AI use, and whether you need training before you get access.
Task 4: Use the Tool-and-Task Checklist
Before each new type of task, answer these questions in order:
- Is the tool on my organisation's approved list?
- Am I signed in with my work account on an approved device or route?
- Does the policy list this task as an allowed use?
- Does the task involve any information the policy bans?
- Do I need to record or declare that I used AI?
- Will I check the output and take responsibility for the result?
If any answer is 'no' or 'not sure', stop and ask.
Worked examples:
- A paramedic wants to tidy up a patient handover note with personal ChatGPT on their own phone. This fails questions 1 and 2, so stop.
- The same paramedic uses Copilot Chat through their work login (green shield showing) to summarise a published national guideline for revision. This passes if the policy lists revision summaries as an allowed use.
- A police staff member uses the approved tool to draft a general email about a training rota, with no names or case details. This passes if the policy allows it.
Try It on Your Own Work
- Find your service's AI or acceptable-use policy today.
- Write your one-page summary: approved tools, allowed uses, banned uses, who to ask.
- Choose one routine task you would like help with and run it through the six-question checklist.
- If any answer is 'not sure', email the named contact before you go further.
Key Takeaways
- The account and contract matter more than the brand name. Consumer and enterprise versions handle data differently.
- Turning off training in a personal account does not make it approved for work.
- Check your sign-in, the protection marker (such as Copilot's green shield) and how you got into the tool.
- From your policy, pick out the approved tools, allowed uses, banned uses and who to ask.
- No policy is not permission. Ask first.
- Run the six-question checklist before each new type of task. Any 'no' or 'not sure' means stop.