Your toolbox has rules, and so does your AI
Think about the last time you started on a new site. Before you touched a thing, someone probably told you the rules. Which kit is allowed. Where the isolation points are. What needs a permit.
AI tools work the same way. In Level 1 we looked at what AI can and can't do on the tools. Now we'll ask a more practical question: which AI tool should you actually use, and are you allowed to use it?
By the end of this level you'll have a short list of approved tools for your own work. You'll also know what each one is for and what it isn't for.
Free, paid and business: what's the real difference?
Most of the big assistants come in a few versions. There's a free one, a paid personal one, and a business one. You might think the only difference is how clever it is. Not quite.
The bigger difference is what happens to what you type.
Take ChatGPT. On the Free, Plus and Pro plans, OpenAI's help pages say your chats can be used to improve its models by default. You can switch that off under Settings, then Data Controls, then 'Improve the model for everyone'. On ChatGPT Business and Enterprise, OpenAI says it doesn't train on your data by default.
Google's Gemini follows a similar pattern. With a personal Google account, Google's help page says human reviewers read some Gemini conversations to improve the service. Chats that get reviewed can be kept for up to three years, even if you delete your activity. With Gemini in Google Workspace, Google says your content isn't reviewed by people or used for model training outside your organisation without permission.
Claude's personal plans (Free, Pro and Max) have a privacy setting where you choose whether your chats can be used to improve Claude. The business plans run under commercial terms, and Anthropic says it doesn't train on that content.
Microsoft 365 Copilot comes with what Microsoft calls enterprise data protection. Microsoft says your prompts and responses aren't used to train its foundation models. Copilot also follows your organisation's permissions and admin settings.
So what's the pattern? Business versions usually add two things. One is stronger data promises. The other is admin controls, so whoever runs the account can manage users, settings and how long data is kept.
Always check the current help page
Here's the catch. These settings change. Plans get renamed and defaults get updated.
So don't rely on what a mate told you down the pub, or even on this lesson in a year's time. Before you use a tool for work, open its official help or privacy page and check three things:
- Does it use my chats to train its models, and can I switch that off?
- Can people at the company read my chats?
- How long does it keep my data, and can I delete it?
It takes about ten minutes. It's like checking the data sheet before you fit a part. You don't guess, you look.
Find the policy that applies to you
Now, who sets the rules for you?
If you're employed, your company may already have an AI policy or an IT policy. It might be in the staff handbook, on the intranet, or just in someone's inbox. Ask your manager or office: 'Do we have rules on using AI tools?'
Don't forget your clients, either. A main contractor, a housing association or a facilities firm may have their own rules about their documents and site photos. Their rules go with their work.
What if the policy says 'only use Copilot through your work login'? Then that's your answer, even if you prefer another tool at home. Putting work into an unapproved personal account is the AI version of using your own untested kit on a site that bans it.
Self-employed? Write your own one-pager
If you work for yourself, nobody hands you a policy. So write a simple one. One page is plenty. It should cover:
- Which tools you use, and which account or plan
- What you'll use them for, like drafting messages or tidying notes
- What you won't use them for, like final safety decisions or certificates
- What you'll never paste in (we'll go through this properly in the next level)
- That a human, meaning you, checks everything before it goes out
- When you'll review the policy, say every six months
Why bother? Because if a customer ever asks 'Do you use AI?', you can answer clearly and confidently. It keeps you honest with yourself, too.
Build your approved-tools list
Now let's pull it together into a short list. Picture something like this:
| Tool and plan | May use for | May not use for |
|---|---|---|
| Copilot (work login) | Drafting emails, summarising my own notes | Customer personal details outside approved systems |
| ChatGPT (settings checked) | Rewording a quote's wording, explaining a term I'm learning | Final safety or compliance decisions |
Keep yours short. Two or three tools is plenty. Stick it in your van, on your phone, wherever you'll actually see it.
Try it on your own work
Pick the AI tool you use most, or the one you'd like to start with. Open its official privacy or data help page today. Answer the three questions above. Then find your employer's or client's policy, or draft your one-pager. Finally, add the tool to your approved list with a 'may' and a 'may not'.
Checklist
- I know which plan of the tool I'm using
- I've checked its training and data settings on the current help page
- I've found my employer's or client's AI policy, or written my own
- I have an approved-tools list with clear may and may-not uses
Key takeaways
- Free, paid and business versions often differ most in how your data is handled and in admin controls.
- Always check the current official help page, because settings and plan names change.
- Your employer's and your clients' policies decide which tools you may use on their work.
- Self-employed? A simple one-page policy gives you clear rules and a confident answer for customers.
- Keep a short approved-tools list that says what each tool may and may not be used for.