Before You Type a Single Prompt
Welcome back! Last time we looked at what AI can and can't do in sales. Now you're probably keen to start. You've got a prospect list, a meeting on Thursday and a blank email. So which AI assistant do you open?
It matters more than you'd think. Two tools can look almost the same and still handle your data in completely different ways. Here's something you might find surprising. In May 2024, Microsoft and LinkedIn's Work Trend Index surveyed 31,000 knowledge workers in 31 countries. It found that 78% of people using AI at work were bringing their own tools. That habit even has a name: "BYOAI", or bring your own AI. Microsoft warned that this puts company data at risk.
We don't want that to be you. So let's get the groundwork right.
Same Name, Different Rules
Think of a hotel. A guest room and the staff-only back office are in the same building, but they come with different keys and different rules. AI assistants work the same way. The brand on the login screen tells you very little. What matters is which version you're signed into.
There are broadly three tiers. Consumer versions are the ones you sign up for yourself with a personal email, free or paid. Business versions are bought by a team or company. Enterprise versions are rolled out and managed by your IT department, with admin controls and contracts behind them.
Let's look at real examples, taken from each vendor's own pages.
With ChatGPT, OpenAI's business-data page says it doesn't use data from ChatGPT Business, ChatGPT Enterprise or the API to train its models by default. On a personal account, though, there's a setting under Data controls called "Improve the model for everyone". If you switch it off, your new conversations won't be used for training. If you leave it on, they can be.
With Claude, Anthropic asks people on its consumer plans (Free, Pro and Max) to choose whether their chats can be used to improve its models. That's been the case since August 2025. Its business products, such as Claude for Work and the API, aren't covered by that consumer setting.
With Gemini, Google's consumer Gemini Apps Privacy Hub says some conversations are read by trained human reviewers. It tells you plainly not to enter confidential information. Gemini inside Google Workspace is a different story. Google's Workspace Privacy Hub says your content isn't used to train models outside your organisation without permission.
And with Microsoft 365 Copilot, Microsoft says prompts, responses and data accessed through Microsoft Graph aren't used to train its foundation models. Copilot also respects your existing permissions and sensitivity labels.
See the pattern? It's the same brand but a different deal each time. And these terms change. So don't rely on what a colleague told you last year. Check the vendor's current help or terms page yourself, and look at the date it was last updated.
Reading Your Workplace AI Policy
Next up is your own organisation's rulebook. It might be called an AI policy, a generative AI guideline, or it might sit inside the acceptable-use policy. Try your intranet, your staff handbook, or just ask IT.
When you find it, what are you looking for? Read it with these questions in mind:
- Which tools are approved? And which version or tier of each?
- How do you sign in? With your work account, or is a personal one ever allowed?
- Which tasks are fine? Drafting, research, summarising and so on.
- What information is off-limits? We'll go into this properly next level.
- Does a human have to review the output before it reaches a customer?
- Who do you ask when you're unsure?
Try summarising the answers in five lines on a sticky note. If you can't, you don't know the policy well enough yet.
What if there's no policy at all? That's more common than you'd expect. Silence doesn't mean permission. Take those same questions to your manager, and ask for the answers in writing. You'll come across as careful and switched on, not difficult.
Is This Tool Approved for This Task?
Here's the key idea. Approval isn't just about the tool. It's about the tool, the version and the task together.
Let's try a scenario. Your company has approved Microsoft 365 Copilot through your work login. You want help drafting a follow-up email after a client call. Approved tool, approved version, and drafting is a normal task. Good to go.
Now change one thing. Say it's late, and you open the free ChatGPT app on your personal phone to do the same email. It's the same task, but the tool and version aren't approved. That's a no, even if the email turns out brilliantly.
One more. You're using approved Copilot, but the policy says AI mustn't be used to generate pricing for quotes. The tool is approved, the task isn't. That's a no too.
When you genuinely can't tell, don't guess. Start with your manager. Then try whoever owns the policy, which is often IT, information security or your data protection lead. A two-line email asking "Is X approved for Y?" protects you, and it often helps the people who write the policy see where it needs to be clearer.
Your Turn
This week, find your organisation's AI or acceptable-use policy and write your five-line summary. Then list every AI tool you've actually used for work in the past month. Next to each one, write which version it was and whether it's approved. Any gaps? Ask about them.
Key Takeaways
- Consumer, business and enterprise versions of the same assistant can treat your data very differently.
- Check the vendor's current help or terms pages, and note when they were last updated.
- Your workplace policy tells you which tools, versions and tasks are allowed. If there isn't a policy, ask, and get the answer in writing.
- Approval means the right tool, the right version and the right task.
- When you're unsure, ask your manager or the policy owner before you use the tool.