Safe AI rules for staff

Most teams already use AI assistants, whether or not anyone wrote down how. That is not a crisis, but it is a gap. A short set of shared rules lets people use tools like Claude with confidence, and lets managers stop worrying about what might be pasted where. Below are seven rules that work for most office teams. Adapt the wording to your company, keep the spirit, and put them somewhere everyone can find.

Start with what never goes into a chat

Rule 1: Keep sensitive data out unless policy says otherwise

Some information should not be pasted into any AI chat by default:

• personal data about clients, customers or colleagues (names with addresses, ID numbers, health or salary details)
• passwords, access codes and keys of any kind
• financial results that have not been published yet
• anything covered by a non-disclosure agreement or marked confidential

The exception is when your company has chosen a plan for exactly this purpose and a written policy says it is allowed. Until both are true, treat these categories as off limits. A useful habit: before pasting, ask yourself whether you would be comfortable forwarding the same text to an outside contractor. If not, leave it out, or replace the details with placeholders like "Client A" and "Amount X". The assistant can usually help just as well with the anonymised version.

Use the right account and know its settings

Rule 2: Work tools for work, not personal accounts

Use the company account or the tool your organisation has approved, not a personal account you signed up for on your own. Company accounts can be managed, reviewed and closed when someone leaves. A personal account cannot, and the company has no view of what was shared through it.

Rule 3: Read the data and privacy settings of your plan

Different plans from the same provider can handle your data differently. Someone on the team, ideally whoever owns the account, should read the provider's own privacy settings and terms for the plan you actually use, and write down in one or two sentences what they say about storing and using your conversations. Do not rely on what a colleague heard or what a blog post claimed, including this one. Settings change, so check again when you renew or switch plans. It is also worth asking whoever handles legal matters how your local data protection law applies.

Keep a human responsible for the result

Rule 4: A person checks every fact, number and name

AI assistants are good at drafting, summarising and restructuring. They can also be confidently wrong: a figure that looks right but is not, a name slightly misspelled, a rule that does not exist. Before anything leaves the team, a person reads it and checks every fact, number and name against the source. The person who sends it owns it, no matter who or what wrote the first draft.

Rule 5: Say when AI helped, where it matters

You do not need to label every internal email. But where trust depends on it, such as client reports, official letters, public statements or documents with legal weight, be open that a draft was prepared with AI and reviewed by a person. Agree as a team where that line sits, so nobody has to guess.

Rule 6: AI does not make decisions about people

Do not let an assistant decide on its own who gets hired, fired, promoted, graded or disciplined. It can help you organise notes, draft a structured feedback form or summarise a long document. The judgement and the decision stay with people, who can explain their reasoning and be held accountable for it.

Make the rules easy to follow

Rule 7: One shared list, one person to ask, regular reviews

Rules only work if people can find them. Keep a short shared page with three things:

• Approved uses: for example drafting emails, summarising meeting notes, rewriting text for clarity, preparing first drafts of reports.
• Not approved: the categories from Rule 1, plus anything specific to your work.
• Who to ask: one named person for questions like "is this okay to paste?".

Then put a date in the calendar to review the rules every few months. Tools change, the team learns what works, and new questions come up. A rule set that is reviewed stays useful. One that is written once and forgotten slowly gets ignored.

If you want to see what this looks like in a specific role, our post on what Claude can do for accountants walks through everyday tasks with these limits in mind.

A checklist you can copy

• No client personal data, passwords, unpublished financials or NDA material in chats, unless our plan and written policy allow it.
• Use the company account or approved tool only.
• We have read our plan's privacy settings and terms, and noted what they say.
• A person checks every fact, number and name before anything leaves the team.
• We say when AI helped with client facing or official documents.
• AI never makes decisions about people on its own.
• We keep a shared list of approved uses and a named person to ask.
• We review these rules every few months.

Not sure where AI fits in your own work yet? Take the short quiz and get a personal plan built around your role.