Why this level matters
In Level 1 you saw what AI can and cannot do in HR. Before you use any assistant on real work, you need to answer one question: which tools am I allowed to use, and on which account? The same brand can come as a personal consumer version and a business version, and the two can handle your data very differently.
This is general information, not legal advice. Your organisation's policy and your data protection lead have the final say.
Think of it like a company car and your own car. They may be the same model, but only one is insured for work, maintained by the employer, and covered by the company's rules.
Task 1: Find and summarise your workplace AI policy
DO:
- Look for the policy in the obvious places: the intranet, the staff handbook, the IT acceptable-use policy, the information security policy and the data protection policy. AI rules are often a section inside one of these, not a document of their own.
- Search for the terms "AI", "generative", "ChatGPT", "Copilot" and "large language model".
- Pull out the parts that apply to HR work and write a one-page summary under these headings:
- Approved tools: named products and the account type (for example, "Microsoft 365 Copilot, signed in with your work account").
- Banned uses: for example, making hiring or dismissal decisions, uploading CVs to unapproved tools, or using personal accounts for work.
- Conditions: human review of outputs, labelling AI-assisted content, and any training you must complete first.
- Who to ask: the policy owner, IT, or the Data Protection Officer.
- Date of the policy: an AI policy from 2024 may not mention tools you use now.
- Store the summary where you can see it while you work.
Example: A recruiter finds that the IT policy approves "Copilot Chat with work sign-in" but says nothing about ChatGPT. That silence does not mean ChatGPT is approved. See Task 3.
Task 2: Compare consumer and business versions
When you compare versions, the two settings that matter most are:
- Model training: can the vendor use your conversations to improve its models?
- Retention: how long does the vendor keep your conversations, and who controls that?
The table below was checked against vendor help pages on 22 October 2026. Vendors change these terms, so check again before you rely on it.
| Assistant | Consumer version | Business / enterprise version |
|---|---|---|
| ChatGPT | "Improve the model for everyone" is in Settings > Data Controls and is on unless you turn it off. Temporary Chats are not used for training and are deleted after 30 days. | OpenAI says that by default it does not train on ChatGPT Business, Enterprise or Edu data. Eligible organisations can set how long data is kept. |
| Claude | Free, Pro and Max users choose in Privacy Settings whether their chats are used for training. If you allow it, data is kept for up to 5 years. If you don't, it is kept for 30 days. | Claude for Work (Team and Enterprise) falls under commercial terms, and the consumer training change does not apply. |
| Gemini | Gemini Apps Activity auto-deletes after 18 months by default (you can choose 3 months, 36 months or never). Some chats are read by human reviewers, and reviewed chats can be kept for up to 3 years. | With qualifying Google Workspace accounts, Google says your content is not reviewed by humans or used to train models outside your domain without permission. |
| Microsoft 365 Copilot | n/a (personal Copilot is a different product) | Under enterprise data protection, Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. |
DO:
- Pick at least one assistant your organisation uses or is considering.
- Open the vendor's current help or privacy page for the consumer version and for the business version. Don't rely on blog posts.
- Record for each version: the training setting and its default, the retention period, who controls the settings (you or your admin), the URL, and the date you checked.
- Check which account you are actually signed in to. A business licence only protects you when you use the business account. On Microsoft and Google products, look for your work email address or a work or enterprise badge.
Key point: "Opted out of training" does not mean "safe for anything". Data can still be kept and, on some consumer services, reviewed by people. Level 3 covers what must never be pasted into any tool.
Task 3: Write your personal rule for gaps
Policies lag behind tools. You need a rule for when there is no policy, or when a tool is not on the approved list.
DO: Write your own rule in two or three sentences. Here is a template:
- Default to no. If a tool or account is not approved in writing, I do not use it for work tasks.
- Ask in writing. I email IT or the DPO naming the tool, the account type and the HR task, and I keep the reply.
- Use only what is approved while I wait. I either use an approved tool or do the task without AI.
- Never use a personal account as a workaround, even for something that seems harmless, like rewording a letter.
- Raise the gap. If there is no policy at all, I suggest to my manager that one is needed and share my comparison table from Task 2.
Example: A people manager wants to use a free AI note-taker in interviews. It isn't on the approved list, so they don't use it. They email IT asking for an assessment and take notes by hand in the meantime.
Key takeaways
- The rules for AI may sit inside your IT, security or data protection policies. Search for them and summarise approved tools, banned uses, conditions and contacts.
- Approval covers a specific tool and a specific account type. A personal login to an approved brand is not the same thing.
- Consumer and business versions differ on model training and retention. Check the vendor's current help page and note the date you checked.
- Turning off training does not end retention or human review on every service.
- When a policy says nothing about a tool, treat that as no: ask in writing, use approved tools while you wait, and never fall back on a personal account.