What Should I Never Put Into AI?

SCENARIO 1 — CUSTOMER INFORMATION

The customer complaint

A customer emails you a detailed complaint containing their name, email address, account number, order history and the full complaint. You want AI to draft a reply.

Paste the full email into any AI assistant because you are only drafting a response. Minimise or remove identifying details, use only an approved environment if policy permits, and provide only the information actually needed to draft the response. Use AI only if the customer has previously communicated with your company electronically. Paste the complaint but delete the customer's name only.

SCENARIO 2 — COMMERCIAL CONFIDENTIALITY

The board presentation

Your CEO sends you a confidential presentation about a potential acquisition. You want AI to summarise it before tomorrow's meeting.

Upload it to your personal AI assistant because you are an employee of the company. Check whether the AI environment is approved for confidential corporate information and whether you are authorised to submit the material. If not, don't upload it. Remove the company logo first and upload the rest. Ask AI to promise not to retain the information.

SCENARIO 3 — EMPLOYEE DATA

The performance reviews

You have 20 employee performance reviews containing names, performance ratings, salary references, manager comments and some health-related absence information. You want AI to identify themes.

Upload them because the information is already inside the company. Treat this as highly sensitive. Check policy, purpose and authorisation, minimise or de-identify where appropriate, and use only an approved system if permitted. Remove employee names but leave salary and health information unchanged. Use a personal AI account but delete the chat afterwards.

SCENARIO 4 — PUBLIC INFORMATION

The annual report

Your company has published its annual report on its public website. You want AI to summarise the report and identify the major themes.

This is generally lower risk from a confidentiality perspective because the information is already public, subject to company rules and normal accuracy checks. Never put any company information into AI, even if it is public. It is safe because AI can never misuse public information. Only use it if the annual report is older than one year.

SCENARIO 5 — THIRD-PARTY INFORMATION

The client contract

A client has sent you a confidential contract. You want AI to identify unusual clauses before your meeting.

Upload it because the client sent the document to you. Check whether you have the right to disclose the contract to that AI system. Possessing information does not automatically mean you are authorised to submit it elsewhere. Change the client's name and upload everything else. Use any AI tool as long as you don't save the answer.

SCENARIO 6 — MEETING TRANSCRIPTS

The strategy meeting

You recorded an internal strategy meeting. The transcript includes employee names, client issues, financial performance, possible restructuring and future strategy. You want AI to produce minutes.

Upload it because everyone in the meeting works for the company. Check consent, policy, sensitivity and whether the AI environment is approved. Minimise or redact information where possible before using AI. Upload only the audio instead of the transcript. Upload it if the meeting was less than one hour long.

SCENARIO 7 — SOURCE CODE

The bug

A developer cannot find a bug and wants to paste proprietary source code into a public AI assistant.

Paste it because source code is not personal information. Check company policy, ownership, confidentiality, security implications and whether secrets are embedded. Use an approved environment or sanitised minimal example if permitted. Paste only half the codebase. Paste it as long as the AI assistant is well known.

SCENARIO 8 — FILE CONTENT

The harmless spreadsheet

You upload a spreadsheet for analysis. The file is called “Sales Forecast.xlsx” but contains customer names, emails, revenue, margin, renewal dates and contract values.

Upload it because the filename does not suggest sensitive information. Inspect what is actually inside the file, minimise or de-identify where appropriate, check authorisation and use only an approved environment if permitted. Rename the file before uploading it. Remove only the email column.

SCENARIO 9 — CREDENTIALS

The API key

An AI assistant asks you to paste your API key so it can help diagnose a technical issue.

Do not paste the key. Treat passwords, private keys, tokens, recovery codes and authentication secrets as restricted credentials. Paste it if you delete the chat afterwards. Paste half of the key first. Paste it if the AI assistant says it is safe.

SCENARIO 10 — INTELLECTUAL PROPERTY

Someone else's framework

A consultant sends you a proprietary methodology. You want to upload it to AI and ask: “Turn this into our own framework.”

Do it because AI is only helping you brainstorm. Stop. Consider ownership, licensing, confidentiality and whether you are authorised to reuse or disclose the material. AI does not erase intellectual property obligations. Remove the consultant's name and upload it. Ask AI to change 30% of the wording.

SCENARIO 11 — UNRELEASED IDEAS

Your own product idea

You have an unreleased product concept and want AI to stress-test it.

Assess the commercial sensitivity, the AI service's controls, your account/environment, company policy and how much detail is actually necessary before deciding what to share. Never discuss any original idea with AI under any circumstances. Share everything because the idea belongs to you. Share it if you haven't registered a trademark yet.

SCENARIO 12 — THE HIDDEN TRAP

The innocent screenshot

You screenshot an error message and upload it to AI. Visible in the image are an employee name, email address, customer ID, internal URL and a token embedded in the screen.

Upload it because you only want AI to look at the error message. Inspect and redact the entire image first. AI receives what you give it, not merely what you intended it to notice. Crop out only the employee's face. Upload it if the screenshot is low resolution.

YOUR AI INFORMATION JUDGEMENT PROFILE

0%overall information judgement score

—strongest awareness area

—biggest blind spot

1. Your judgement profile

2. Your biggest blind spot

3. The traffic-light rule

Green

Generally lower risk

Public information, synthetic examples and your own non-confidential content. Still follow your organisation's rules.

Amber

Stop and check

Internal data, customer or employee information, contracts, meeting transcripts, financial data, source code and unreleased work.

Red

Do not submit casually

Passwords, private keys, access tokens, recovery codes, highly sensitive data and information you are explicitly prohibited from disclosing.

4. The 5 questions to ask before giving anything to AI

1. Whose information is this?
Mine, my employer's, a customer, an employee, a client or a third party?

2. How sensitive is it?
Public, internal, confidential, personal, highly restricted or a secret credential?

3. Am I authorised to share it?
Possession is not the same as permission.

4. Where is it going?
Which AI system, account or environment will receive it? Is that environment approved?

5. What happens if this information is exposed?
Could it create privacy harm, commercial damage, legal exposure or a security problem?

5. Your before-I-paste AI check

□ Do I know what is actually inside this text, file, image or transcript?

□ Is any of it personal or confidential?

□ Does any of it belong to someone else?

□ Am I authorised to share it?

□ Is this AI environment approved for this information?

□ Can I remove or anonymise information AI does not need?

□ Would I be comfortable explaining this upload to the person or organisation the information belongs to?

If you are uncertain, stop and check before submitting it.

6. Use the minimum necessary information

Before:
“Please analyse why John Smith at ABC Mining, account #48392, spending R2.4m annually, is threatening to terminate his contract.”

After:
“A major B2B customer is threatening to terminate a high-value contract. Analyse the following complaint and identify the underlying issues.”

Principle: AI does not necessarily need to know everything you know to help you.

7. What your results suggest you should improve

8. The final rule

When you are not sure whether information should go into AI, uncertainty itself is a reason to stop and check.

AI-ERA BUSINESS EXPERIMENTS™
Don't just read about what AI is changing. Experience it.

WHAT SHOULD I NEVER PUT INTO AI?™

The customer complaint

The board presentation

The performance reviews

The annual report

The client contract

The strategy meeting

The bug

The harmless spreadsheet

The API key

Someone else's framework

Your own product idea

The innocent screenshot

1. Your judgement profile

2. Your biggest blind spot

3. The traffic-light rule

Generally lower risk

Stop and check

Do not submit casually

4. The 5 questions to ask before giving anything to AI

5. Your before-I-paste AI check

6. Use the minimum necessary information

7. What your results suggest you should improve

8. The final rule