Why the tool you choose matters
In Level 1 you saw what AI assistants can and cannot do. The next question is practical: which tool are you allowed to use, and how? The same product can be safe in one setup and a risk in another. ChatGPT, Gemini, Claude and Microsoft 365 Copilot all come in versions for individuals and versions run by organisations. Under each version, your text is handled differently.
Think of it like a work email account and a personal email account. Both send messages. Only one of them is managed, backed up and protected by your employer, and you would not send case files from your personal Gmail. AI tools work the same way.
The UK government's AI Playbook (published 10 February 2025) sets out 10 principles. Two of them apply directly to this lesson:
- Principle 6: You use the right tool for the job.
- Principle 10: You use these principles alongside your organisation's policies and have the right assurance in place.
The Playbook also says plainly that you should follow any organisation-specific policies, especially those about security and data handling.
Task 1: Find your organisation's AI policy
DO this today. It takes about 20 minutes.
- Search your intranet for 'AI policy', 'generative AI', 'acceptable use' or 'AI guidance'. Some organisations put AI rules inside their IT acceptable-use policy instead of a separate document.
- Check the IT or digital service desk pages. There is often a list of approved software.
- Look for information governance or data protection pages. AI guidance is often published by these teams.
- If you find nothing, ask. Email your line manager or the IT service desk: 'Do we have a policy or approved list for AI tools?'
- Record what you find in a simple table:
| Tool | Approved? | Which account? | Allowed tasks | Conditions |
|---|---|---|---|---|
| e.g. Microsoft 365 Copilot Chat | Yes | Work login only | Drafting, summarising internal documents | No special category data; check all outputs |
Typical conditions you may find:
- Use only with your work login
- Certain settings must be switched on or off
- Limits on what information may be entered (e.g. by security classification)
- A human must check all output before it is used
- Some uses are recorded or declared
- Some tasks are banned outright (e.g. decisions about individuals)
Task 2: Know personal accounts from organisation-managed accounts
This is the most important difference to understand.
Personal (consumer) accounts. These are free or paid plans you sign up for yourself, such as ChatGPT Free or Plus, Claude Free, Pro or Max, and the consumer Gemini app. Your employer has no contract covering them and cannot control their settings. As of October 2026, vendor help pages say:
- ChatGPT (consumer): conversations may be used to train models unless you turn off the 'Improve the model for everyone' setting in Data controls.
- Claude (consumer): since September 2025 users choose whether chats are used for training. If you opt in, Anthropic may keep the data for up to five years. If you opt out, it keeps data for about 30 days.
- Gemini app (consumer): with Keep Activity on, chats may be used to improve Google's AI, and human reviewers may read a sample of them.
Organisation-managed accounts. These are licensed by your employer and accessed with your work login. Examples are Microsoft 365 Copilot Chat, Gemini in Google Workspace, ChatGPT Business or Enterprise, and Anthropic's commercial plans. Vendors state that:
- OpenAI does not train on ChatGPT Business or Enterprise data by default.
- Microsoft says prompts and responses in Microsoft 365 Copilot Chat with enterprise data protection are not used to train foundation models. The tool also follows your organisation's permissions, retention policies and audit settings.
- Google says chats in the Gemini app under Workspace accounts are not reviewed by humans or used to improve its models.
Key point: a managed account is not automatically allowed for every task. It sits under a contract your organisation has reviewed, and its settings are controlled by your IT team. A personal account has neither of these protections, even if you have changed its settings yourself. Vendor terms change, so check the current help page and your policy rather than relying on memory.
How to tell which one you are using:
- Check the login. Is it your work email, signed in through your organisation's single sign-on?
- Look for an organisation name or a shield or 'protected' label in the interface. Microsoft 365 Copilot Chat shows this when enterprise data protection applies.
- If you paid for it yourself or signed up with a personal email, it is a personal account.
Task 3: Run the five-step tool check
DO this before using any AI tool for a work task.
- Is the tool on the approved list? If not, stop.
- Am I signed in with the approved account? Use your work login, not a personal one. If not, stop.
- Is this task allowed? Check the policy's list of allowed and banned uses.
- Does the information meet the conditions? Check classification, personal data and confidentiality limits. Level 3 covers this in detail.
- Are the required settings and checks in place? For example, human review of output and any recording your policy requires.
If any answer is 'no' or 'not sure', pause and ask before you go ahead.
Example: A housing officer wants to tidy up the wording of a general newsletter paragraph using ChatGPT on their phone, signed in with a personal Plus account. Step 1: the council approves only Microsoft 365 Copilot Chat. Stop. They switch to Copilot Chat with their work login and continue the check.
Who to ask when you are unsure
- Line manager: whether the task is appropriate for AI in your team
- IT or digital service desk: approved tools, accounts and settings
- Data protection officer or information governance team: anything involving personal or sensitive information
- Information security team: security classification questions
Asking is part of your professional duty, not a sign of weakness. Write down the answer and the date so you can refer back to it.
Try it on your own work
- Find your organisation's policy and fill in the tool table from Task 1.
- Check which account type you use for each AI tool you have tried.
- Pick one real task from this week and run the five-step check on it.
Key takeaways
- Follow your organisation's policy. The AI Playbook expects you to use AI alongside local policies.
- Personal consumer accounts and organisation-managed accounts handle retention and training differently.
- Consumer plans may use your chats for training unless you change the settings. Managed plans are covered by organisational contracts and controls.
- Use the five-step check: approved tool, approved account, allowed task, information conditions, required settings.
- When unsure, stop and ask your manager, IT, or the data protection officer.