An AI acceptable-use policy for confidential information should answer three practical questions: Which AI tools may employees use? What information may they enter? What should they do if something goes wrong? Without clear answers, employees may make different assumptions about sensitive data and the services they use.
A policy does not need to stop employees from using AI. It needs to set boundaries that match your business, your customers’ expectations, and the tools you have actually reviewed. The National Institute of Standards and Technology identifies acceptable-use policies as one way to manage generative AI risks in its Generative AI Profile.
Use the following framework as a starting point. Adapt it to your company’s systems, contracts, and applicable industry requirements before putting it into use.
Start with a clear definition of confidential information
Employees cannot follow a rule if they are unsure what it covers. Define confidential information in everyday terms and give examples that reflect the work your business does. A simple classification model can help:
- Public: Information your business has intentionally made public, such as approved website copy or published product descriptions.
- Internal: Business information intended for staff, such as routine process notes or internal meeting summaries that do not include sensitive details.
- Confidential: Nonpublic business, customer, or employee information. Examples may include customer records, employee details, contracts, internal financial information, and trade secrets.
- Restricted: Information that requires especially careful handling, such as passwords, authentication codes, payment details, protected health information, or other regulated data.
Make clear that removing a person’s name does not automatically make information safe to share. A combination of details may still identify a customer or employee. When staff are uncertain about a category, the policy should tell them to leave the information out and ask an approved contact.
Set the default rule for AI prompts
Give employees a rule they can remember: Do not enter confidential or restricted information into an AI tool unless that specific tool and use have been approved. This applies to prompts, uploaded files, copied email threads, meeting transcripts, and information pasted into connected features.
List examples employees should keep out of unapproved tools. These may include:
- Customer names combined with account, service, or case details
- Employee records, hiring information, or performance discussions
- Passwords, access keys, authentication codes, and security configurations
- Nonpublic contracts, business plans, pricing, or financial records
- Trade secrets, source materials, and proprietary processes
- Protected health information or other regulated data
For low-risk tasks, employees may be able to use public information or carefully de-identified examples. Explain how to remove direct identifiers and unnecessary details, and remind staff that de-identification is not a reason to share information when they are unsure whether it can be recognized.
Approve tools before employees use them for work
Separate which tool is approved from how employees may use it. A tool that is acceptable for drafting public marketing copy may not be appropriate for analyzing a customer file. Personal accounts and unreviewed tools should not be treated as business-approved by default.
Before approving an AI service, assign someone to review the provider’s terms, settings, and security information. The review should cover:
- What information the service collects and how it is used
- Whether prompts or uploaded content may be retained or used to improve models
- Who can access business data and how access is controlled
- How long data is kept and whether it can be deleted
- How the provider handles security incidents and account changes
- Whether the service’s terms and available agreements fit the intended business use
Record which tools are approved, what data categories they may handle, and any restrictions employees must follow. Review the decision when the provider changes its terms or settings, when the business wants to use the tool for a new purpose, or when the information involved changes.
Address customer, employee, and regulated information
Your policy should explicitly cover information about customers and employees, not just company documents. Employees may encounter sensitive details in support requests, HR records, financial files, and routine communications. State that the same approval rules apply whether information belongs to the business, a customer, an employee, or another party.
For healthcare organizations, do not allow protected health information in an AI service unless the organization has specifically reviewed and approved that service and use. The same cautious approach applies to businesses handling financial, education, government, or defense-related information. Check relevant obligations and customer or vendor contracts with the appropriate internal or professional contacts. A general employee policy should not be treated as a substitute for that review.
Businesses reviewing broader security practices can also read Zevonix’s guide to cybersecurity for Jacksonville small businesses.
Tell employees what is allowed
A policy focused only on prohibitions can leave staff guessing. Explain acceptable use, too. For example, employees may be allowed to use an approved tool to brainstorm with public information, summarize non-sensitive material, or draft content that a person will review before it is shared.
Set expectations for human review. Employees should verify important details, check that an output does not reveal confidential information, and take responsibility for anything they send to a customer or use in a business decision. AI output should not be treated as authoritative simply because it sounds confident.
Give employees one place to check approved tools and one person or team to contact with questions. Include a way to request an exception, with approval required before confidential or restricted data is used. This makes the policy usable instead of leaving employees to decide on their own.
Include a response plan for accidental disclosure
Employees need to know what to do if they paste sensitive information into an unapproved AI tool. Tell them to report the incident promptly through a named internal contact or reporting channel. They should not try to hide the mistake or assume that deleting a prompt fully resolves it.
The response team can then identify what information was shared, which service and account were involved, and what steps may be available, such as removing content, changing exposed credentials, restricting access, or contacting the provider. Your organization should assess the situation under its own incident procedures and applicable obligations. Avoid promising employees that a disclosure is harmless before it has been reviewed.
For related planning, Zevonix also explains how IT services can support Jacksonville businesses, including cybersecurity and continuity planning.
Keep the policy current and practical
Review the policy on a regular schedule and when your business adopts a new AI tool, changes how an approved tool is configured, or begins using AI with a new type of information. Ask employees where the rules are unclear and update examples based on real work situations.
Make the final policy easy to find. Include it in onboarding and provide short reminders when employees use approved tools. A clear data rule, a maintained approved-tool list, and a known reporting path are more useful than broad warnings no one can apply.
Frequently asked questions
Can employees enter confidential business information into AI tools?
Only when the specific tool and intended use have been reviewed and approved for that information. Otherwise, employees should keep confidential and restricted details out of prompts and uploads.
What information should employees never put into an AI chatbot?
Unless explicitly approved for the service and use, employees should not enter passwords, access codes, customer or employee records, trade secrets, nonpublic contracts, or regulated information.
How should a business approve AI tools for employee use?
Review the provider’s data use, retention, security, access, deletion options, and contractual terms. Document allowed data types and restrictions, then tell employees where to find the approved-tool list.
What should an employee do after sharing sensitive information by mistake?
Report it promptly through the company’s incident process. The business can assess what was shared, which service was involved, and what response steps are appropriate.
How often should a business review its AI acceptable-use policy?
Set a regular review schedule and revisit the policy when tools, settings, data types, business practices, or relevant obligations change.
Make the rules clear before employees use AI
A practical policy helps employees work with AI without guessing about confidential information. Define data categories, approve tools for specific uses, require human review, and make accidental-disclosure reporting straightforward. If your Jacksonville business needs help aligning AI use with its broader technology and cybersecurity practices, contact Zevonix at (904) 658-0777.