What to do.
Each point is followed by the words it rests on and where they come from.
- 1
Assume the AI provider can read whatever you type.
“However, the query will be visible to the organisation providing the LLM (so in the case of ChatGPT, to OpenAI).”
UK NCSC blog, 'ChatGPT and large language models: what's the risk?' · Mar 14, 2023 · Old (2023); the advice on what to type in still stands
- 2
Think before you paste: client data, contracts, code and staff records need care.
“Individuals and organisations should take great care with the data they choose to submit in prompts.”
UK NCSC blog, 'ChatGPT and large language models: what's the risk?' · Mar 14, 2023 · Old (2023); the advice on what to type in still stands
- 3
Keep sensitive information out of public chatbots.
“not to include sensitive information in queries to public LLMs”
UK NCSC blog, 'ChatGPT and large language models: what's the risk?' · Mar 14, 2023 · Old (2023); the advice on what to type in still stands
- 4
Use your company's business account, not a personal one. OpenAI says business data isn't used for training by default.
“By default, we do not use your business data for training our models.”
OpenAI, 'Enterprise privacy at OpenAI' · Jan 8, 2026 · the company's own advice
- 5
Ask your admin how long chats are kept; on business plans, admins set it.
“Your workspace admins control how long your data is retained.”
OpenAI, 'Enterprise privacy at OpenAI' · Jan 8, 2026 · the company's own advice
- 6
If you must use a personal ChatGPT account, switch off training first.
“When Improve the model for everyone is off, your new conversations won't be used to train OpenAI models.”
OpenAI Help Center, 'Data controls in ChatGPT' · Oct 2026 · the company's own advice · Page shows 'Updated: 2 days ago' when read on 2026-10-19
- 7
Check facts, figures and references before work goes out under your name.
“Always verify quotes, data, technical information or references to external documents.”
OpenAI Help Center, 'Does ChatGPT tell the truth?' · Aug 2026 · the company's own advice · Page shows 'Updated: 2 months ago' when read on 2026-10-19
- 8
Never leave passwords or API keys in files or code that an AI agent can read.
“The agents got in through credentials and connection settings left exposed in app configurations”
TechCrunch, 'India becomes the latest country to report rogue AI agent activity' · Oct 16, 2026
Keep going.
How to check an AI answer before you trust it
Chatbots can state wrong things with confidence. Even AI tools built for lawyers gave incorrect information more than 17% of the time in Stanford's 2024 tests, and courts have now dealt with 2,202 cases of AI-made-up material.
PrivacyWhat not to tell a chatbot
Your chats are seen by the company that runs the chatbot. They can be used for training unless you turn that off, and they can outlive the company: states asked for protections for private chats in Character.AI's bankruptcy.
ScamsHow to spot an AI voice-clone call
Scammers can clone a loved one's voice from a short clip. The FBI counted over $5 million lost to 'loved one in distress' scams in 2025. A cloned voice can sound right, so check the story another way.