Start with the task, not the document
A team member wants an AI assistant to improve a report. Uploading the full file feels like the fastest route. Yet the task may only require a clearer paragraph structure, a summary template or a fictional example of a difficult sentence. The first question is therefore not “which model is best?” It is “what information does this task actually require?”
Write the desired output in one sentence. If the goal is an outline, try requesting an outline without supplying the underlying records. If the goal is a formula, use invented column names and a small synthetic table. Reducing input is often a more useful first control than adding a long warning to the prompt.
What information is actually inside it?
Consider more than visible names. A report may contain client identifiers, financial details, participant quotations, comments, tracked changes or combinations of dates and roles that identify someone indirectly. Removing a name does not automatically make an individual unidentifiable.
Check the version you intend to share. A clean-looking export may still disclose details that the organisation has no permission to send to an external provider. If the information cannot safely leave its existing environment, use an approved internal workflow or ask the responsible owner for a decision.
Is this tool approved for this kind of data?
An employee’s personal subscription and an organisation’s managed service may have different settings, contracts and administrative controls. Do not assume that switching off one setting answers every question about storage, access or retention. Confirm the actual service, account type and organisational policy that apply to the task.
Ask who owns the decision, what categories of data are permitted, and what happens if the service is unavailable or the wrong material is submitted. A policy that only says “use AI responsibly” leaves the most consequential judgement to whoever is in a hurry. A short approved-use matrix is more actionable.
Can we complete the task with less exposure?
For a survey-analysis plan, share the question structure rather than participant responses. For a customer-service template, describe the situation without copying the customer’s full message history. For code review, remove secrets and use a controlled example that still reproduces the technical problem.
Keep a human review step. A model can produce an elegant explanation that changes the meaning of a finding or introduces an unsupported claim. Compare the output with the original evidence and document important corrections. Never let fluent language substitute for the checks the underlying work requires.
What will we do if something goes wrong?
Agree on a reporting route before the first mistake. If sensitive material is submitted, stop further sharing, preserve enough information to understand the incident, and notify the responsible internal contact. Record which tool, account, material and time were involved. Follow the organisation’s response process rather than trying to hide the error with more unapproved uploads.
For a team starting this week, choose one low-risk task, one approved tool and one reviewer. Document the minimum input and the acceptance criteria. Expand only after the team understands the workflow. Useful AI adoption is a sequence of controlled decisions, not a blanket permission to upload whatever makes a task easier.