Lesson 2: Approved Tools and Your Workplace AI Policy

Same name, very different tool

Welcome back! Last time we looked at what AI can and can't do in social work. Now for a question that comes before any prompt you write: which tool are you allowed to use?

Here's something that catches a lot of people out. "Copilot", "ChatGPT", "Gemini" and "Claude" can each mean two quite different things. One is a tool your organisation has bought, set up and manages. The other is a personal account you signed up for with your own email address. The logo looks the same, but your data goes to very different places.

Think of it like a work phone and your personal phone. They can be the exact same model. But only one is managed by your employer, covered by its contracts and allowed to hold case information.

What makes a tool "organisation-managed"?

Let's take Microsoft's tools as our first example, since many councils and trusts already use Microsoft 365. Microsoft is in the middle of renaming Microsoft 365 Copilot to Microsoft Copilot, and Copilot Chat is changing its name in the same way, so you may see both names for a while.

When you sign in with your work account, Microsoft says that "enterprise data protection" applies. In plain terms, that means:

• your prompts and Copilot's answers fall under your organisation's contract with Microsoft, and Microsoft acts as a data processor
• your organisation's own permissions, retention rules and settings apply
• your prompts and responses aren't used to train Microsoft's foundation models

One small catch is worth knowing. When Copilot searches the web for you, those search queries go to Bing, which has its own data-handling terms. So even inside an approved tool, settings matter.

Who's in control here? Your organisation is. Its IT and information governance teams decide who gets access, what's switched on and how long things are kept.

And personal accounts?

Now picture the same tasks typed into a free or personal account. With a personal account, you agreed to the provider's consumer terms, and your employer has no contract or control over what happens.

Here's how the three big consumer services work at the moment:

• ChatGPT (personal): OpenAI may use your content to train its models. You can switch this off under Settings → Data controls → "Improve the model for everyone". OpenAI says it doesn't train on business plans such as ChatGPT Business and Enterprise by default.
• Gemini (personal): Google says conversations may be used to improve its AI, and some are read by human reviewers. Its own privacy hub warns you not to enter confidential information. Work accounts on Google Workspace are handled differently.
• Claude (personal Free, Pro and Max): Since Anthropic's update in late 2025, users choose whether their chats are used for training. If you allow it, data can be kept for up to five years. None of this applies to Anthropic's commercial services, such as its Team and Enterprise plans.

Notice the pattern? Business and enterprise versions come with contracts and controls set by your organisation. With personal versions, everything depends on your own settings and the provider's consumer terms. And switching training off doesn't make a personal account approved. Your employer still has no say over it.

Finding your organisation's AI policy

So how do you know what's approved where you work? You go to the policy.

Where might it live? Try your intranet first. Search for "AI", "artificial intelligence", "generative AI" or "Copilot". If that comes up empty, look in your information governance or IT security pages. Some organisations don't have a separate AI policy and fold the rules into their acceptable use policy instead. Still stuck? Ask your manager or the information governance team. That's a perfectly sensible question to ask.

When you find the policy, read it with three questions in mind:

1. What does it allow? Look for the named tools and the tasks they're approved for. A tool such as Magic Notes might be approved for case recording, while Copilot is approved for drafting general emails.
2. What does it ban? Look for banned tools, such as personal accounts, and banned kinds of information.
3. Who do I ask? Find the named contact. That's often information governance, the data protection officer or the digital team.

It helps to jot those three answers on a sticky note or in your notebook. That way you're not hunting for the policy every time.

A quick checklist before you start

Let's make this practical. Say you want AI help to tidy up a draft letter. Before you open anything, ask yourself:

1. Is this tool on my organisation's approved list?
2. Am I signed in with my work account, not a personal one?
3. Is this task one the policy allows for this tool?
4. Does the information I'd use fit what the policy permits? (We'll go into data in detail next level.)
5. If I'm unsure, have I asked the named contact?

If any answer is "no" or "I don't know", stop and check first. It takes two minutes, and it protects the people you support and you.

Here's an example. Priya, a social work assistant, finds Copilot Chat on her work laptop and is signed in with her council account. The policy lists Copilot for drafting general correspondence. She's using it to make a generic appointment letter template easier to read. That's a yes all the way down. Now imagine she'd opened ChatGPT on her own phone to do the same job. It's the same task, but she'd be on an unapproved tool, and the answer is no.

Try it now

This week, find your organisation's AI policy and write down your three answers: what it allows, what it bans and who to ask. If you can't find a policy at all, that's useful to know too. Raise it with your manager.

Key takeaways

• The same brand can be an organisation-managed tool or a personal account, and they handle your data very differently.
• With an enterprise tool such as Microsoft Copilot, your organisation sets the controls, and the vendor works under your organisation's contract.
• Personal ChatGPT, Gemini and Claude accounts run on consumer terms. Your employer doesn't control them, even if you switch training off.
• When you read your AI policy, pull out three things: what's allowed, what's banned and who to ask.
• Run the five-question checklist before every new tool or task, and if you're unsure, stop and ask.