Many people first try AI on their own phone or home computer with a free account. Then they start using that same account at work because it's handy. That is one of the most common ways business information ends up somewhere it shouldn't. This guide explains why, and what to do instead.
Why personal accounts are risky at work
A free or personal AI account is set up for one person, not for a business. That creates three problems.
Your chats may help train the AI. Many AI services, especially free versions, may use what you type to improve their models unless you turn that setting off. Settings vary by tool and change over time, and most people never look. If a staff member pastes client details into a personal account with that setting on, the text may be kept and reviewed.
No one at the business can see or control it. A personal account has no admin (an administrator who manages accounts for the company). The business can't set rules, check settings, or see what has been shared. If something goes wrong, there is no way to review it.
The chats belong to the person, not the company. Work conversations sit inside a personal login. When that employee leaves, their chat history, including anything about your clients, leaves with them. You can't delete it or get it back.
What business plans add
Most major AI tools, including ChatGPT, Copilot and Gemini, offer business or team plans. The details differ, so read the terms for the plan you're considering. Business plans commonly offer:
- Data controls, such as a commitment not to use your business's chats to train models, or a setting an admin can lock
- Admin controls, so one person can add and remove users and manage settings for everyone
- Company ownership of accounts, so access ends when someone leaves
- Clearer terms about how your data is stored and protected
A business plan is not a free pass. Even with good data controls, the never list (what never goes into AI) still applies, unless your business has deliberately set up a tool for that type of data and confirmed it fits your legal duties. If you handle health, legal or financial records, check with a qualified professional before using any AI tool with them.
Can this go into AI? A bookkeeper has a personal AI account on their phone and wants to paste a client's year-end expense list into it to sort the categories quickly.
Answer: No — client financial records don't belong in a personal account the business can't see or control. If your policy allows it, use the company's business AI tool, with names and account numbers removed.
A simple AI use policy
You don't need a thick binder. A one-page AI use policy answers the questions your team will ask:
- Which tools are okay? Name the tools and plans staff may use for work, and say that personal accounts are not for business information.
- What never goes in? List your never items: client data, health records, financial numbers, passwords, confidential documents.
- What needs a check? Say that a person reviews AI output before it reaches a customer, and that legal, medical and financial content goes to a qualified person.
- Who do I ask? Name one person who answers AI questions and handles mistakes.
- What if something slips? Tell people to report it right away, without fear of blame.
For a starting point, see our free AI use policy page, written for small businesses. Adapt it to your tools and your industry.
Who to ask
Every business that uses AI should have one named person for AI questions. In a small office, that might be the owner or the office manager. Their job is not to be a tech expert. It's to keep the list of okay tools, answer "Can I use AI for this?" questions, and be the person staff tell when something goes wrong.
If you are that person and aren't sure where to start, the free AI risk check shows where your business stands, and our workshops walk teams through this together.
Key points
- Personal AI accounts at work are risky: settings may let chats train models, there's no admin control, and chats leave with the employee.
- Business and team plans add data controls, admin controls and company ownership of accounts.
- Even on a business plan, the never list still applies.
- Write a one-page AI use policy and name one person to ask.
One-page AI use policy starter
Fill in the brackets to give your team a simple AI policy they can follow from day one.
- Allowed tools: Staff may use [tool and plan] with their company account for work. Personal AI accounts are not for business information.
- Never paste: client personal data, health information, card, bank or Social Security numbers, passwords or codes, and confidential documents.
- Mask first: replace names, contact details and account numbers with [placeholders] before using AI.
- Check before use: a person reviews every AI draft before it reaches a customer. Legal, medical and financial content goes to [qualified person or role].
- Decisions about people (hiring, tenants, credit, care) are made by [role], not by AI.
- Questions and mistakes: ask [name or role]. If something sensitive is pasted by mistake, report it right away. No blame for honest reports.
- Review date: we will review this policy on [date].