Track Your Data: From Input to Storage

What Happens to Data You Share with AI Tools

Most professionals using AI tools today are operating on a set of beliefs that feel reasonable but are quietly wrong. They paste client names into ChatGPT, upload financial reports to Copilot, and type sensitive HR notes into Gemini, all while assuming their data is private, temporary, or protected by default. That assumption is costing companies real money and real trust. Before you use another AI tool for work, you need to know what actually happens to the information you type, upload, or paste into these systems.

Myth 1: Your Conversations Are Private and Disappear When You Close the Tab

This is the most common misconception, and it's understandable. Chat interfaces feel like messaging apps, ephemeral, personal, gone when you close them. But AI platforms are not messaging apps. When you type something into ChatGPT, Claude, or Google Gemini, that text is transmitted to a server, processed by a large language model, and, depending on your account settings and the plan you're on, stored for periods ranging from 30 days to indefinitely. OpenAI's privacy policy, for instance, states that they may retain conversation data to improve their models. That data doesn't evaporate when your browser tab closes.

The mental model you need is this: typing into an AI chat interface is closer to sending an email to a company's customer service team than it is to writing in a private notebook. Someone, or some system, on the other end has access to what you wrote. The data lives on external servers. It may be reviewed by human trainers. It may inform how the next version of the model responds. This doesn't mean these tools are dangerous to use, millions of professionals use them safely every day, but it does mean you need to be deliberate about what you type.

Click to enlarge

Myth 2: Paying for a Premium Plan Automatically Protects Your Data

Many professionals upgrade to ChatGPT Plus ($20/month), Claude Pro ($20/month), or Microsoft Copilot Pro ($30/month) and assume that paying for the service means their data is protected. The logic makes intuitive sense, you're a customer now, not just a free user, so surely the company has more obligations toward you. But the paid tier of a consumer product is not the same as an enterprise data agreement. ChatGPT Plus, for example, gives you faster responses, access to GPT-4, and more features. It does not automatically exclude your conversations from being used for model training. That requires a separate opt-out in your settings.

The distinction that actually matters for data protection is not free vs. paid, it's consumer vs. enterprise. OpenAI's enterprise product, ChatGPT Enterprise, explicitly states that customer data is not used to train OpenAI models, that conversations are encrypted, and that businesses get administrative controls over user access. Microsoft's Copilot for Microsoft 365 (the business version, not Copilot Pro for individuals) operates under Microsoft's commercial data protection commitments. Google's Gemini for Google Workspace enterprise plans come with similar protections. These are meaningfully different products from the consumer versions, even when the interface looks identical.

If your company has not formally procured an enterprise AI license, meaning your IT or legal team signed a contract with the vendor, then you and your colleagues are almost certainly using consumer-grade tools, regardless of who is paying for them. A marketing manager who expenses their ChatGPT Plus subscription is still using a consumer product. The company's sensitive data is still subject to consumer-grade terms. This is one of the most common and most costly misunderstandings in professional AI adoption right now, and it affects teams at companies of every size.

Click to enlarge

Myth 3: AI Companies Are Too Big to Actually Use Your Specific Data

This myth is perhaps the most psychologically compelling one. The reasoning goes: OpenAI has hundreds of millions of users. Google processes billions of queries. Why would they care about my specific client proposal or my HR notes about a difficult employee? The scale argument makes it feel like your data disappears into an ocean of noise, too small to matter. But this misunderstands how model training and data review actually work. AI companies don't need to care about your data specifically. They need large volumes of diverse, real-world professional text, and your inputs contribute to exactly that pool.

There's also the human review factor. Multiple AI companies, including OpenAI and Google, have publicly acknowledged that human contractors review samples of user conversations to evaluate quality, check for policy violations, and improve model outputs. A 2023 TIME magazine investigation reported that OpenAI used Kenyan contractors to review and label content, including disturbing material, to train safety filters. The point isn't to alarm you about your everyday work queries. The point is that 'too big to care about my data' is not the same as 'my data is never seen by anyone.' Real people, working on real quality and safety tasks, may read samples of what users type. That's a factual feature of how these systems are built and maintained.

Myth vs. Reality: A Direct Comparison

Click to enlarge

What Actually Works: A Practical Mental Model for Data Safety

The goal isn't to stop using AI tools. They genuinely accelerate professional work, drafting, summarizing, researching, analyzing, communicating. The goal is to use them with accurate assumptions. The most useful mental model is this: treat AI chat interfaces like a public bulletin board inside a very large building. You can post useful work there, and you'll get helpful responses. But you wouldn't pin your client's confidential contract or your employee's performance review to that bulletin board. Apply the same filter to what you type into AI tools. If you wouldn't want it seen by a stranger, don't put it in unmodified form into a consumer AI product.

The practical application of this model involves three habits. First, anonymize before you paste. Replace real names, company names, financial figures, and identifying details with placeholders like '[Client A]', '[Company X]', or '[revenue figure]' before pasting into any AI tool. The AI doesn't need the real names to do good work, as the prompt example above shows, the output quality is identical. Second, know which version of the tool you're using. Consumer ChatGPT and ChatGPT Enterprise are different products with different data handling terms. Check with your IT or legal team whether your company has an enterprise agreement in place. Third, use your platform's privacy settings. ChatGPT allows you to turn off chat history and training in Settings → Data Controls. Claude's privacy page explains Anthropic's retention practices. Gemini has a My Activity panel where you can review and delete data.

One more thing: data safety with AI tools is not just an individual responsibility. It's a team and organizational one. If your company hasn't set a clear policy on which AI tools employees can use and what data categories are acceptable to input, then every person on your team is making individual judgment calls with inconsistent results. According to a 2023 survey by Fishbowl (now Glassdoor), 43% of professionals who use AI tools for work had not told their bosses they were doing so. That statistic reflects not just secrecy, it reflects a widespread absence of organizational guidance. The safest individual behavior exists inside a clear organizational framework, and Part 2 of this lesson will address exactly what that framework should look like.

Click to enlarge

Frequently Asked Questions

• Q: Does turning off chat history in ChatGPT mean my data is never stored? A: Not exactly. Turning off chat history means OpenAI won't use those conversations to train their models and won't display them in your history, but the data is still temporarily retained for up to 30 days for safety monitoring purposes, according to OpenAI's policy. It's a meaningful improvement, not a guarantee of zero retention.
• Q: Is Microsoft Copilot in Word and Excel safer than ChatGPT because it's inside Microsoft Office? A: It depends on which version your company uses. If your organization has Microsoft 365 with Copilot through a business or enterprise license, Microsoft's commercial data protection commitments apply. If you're using a personal Microsoft account with Copilot Pro, you're on consumer terms. The interface looks the same, the legal protections are very different.
• Q: Can I use AI tools to process HR data, like performance reviews or disciplinary notes? A: Only if your organization has an enterprise AI agreement that explicitly covers HR use cases, and only after confirming this with your HR and legal teams. Consumer AI tools are not appropriate for processing personal employee data, this can create violations under GDPR in Europe, and similar regulations in other jurisdictions.
• Q: If I delete my account, is all my data gone? A: Account deletion typically removes your personal profile and stops future data collection, but most platforms retain some data for a period after deletion for legal, safety, and operational reasons. OpenAI's privacy policy, for example, states they may retain certain data after account deletion as required by law or for legitimate business purposes. Check each platform's specific deletion policy.
• Q: Does using a VPN protect my data when using AI tools? A: A VPN masks your IP address and encrypts your internet connection between your device and the VPN server, but it does not change what data the AI platform receives and stores once your query arrives. The AI company still receives and processes your text input. VPNs solve a different problem than AI data privacy.
• Q: My company uses Notion AI or Grammarly AI, are those safer than ChatGPT? A: Notion AI (powered by third-party models including from OpenAI) and Grammarly AI both have their own data handling policies. Grammarly states it does not sell user data and offers enterprise plans with stronger protections. Notion's AI features are subject to both Notion's and their AI model providers' terms. The answer is always: check the specific product's enterprise terms, not just the brand name.

Key Takeaways from Part 1

1. AI chat interfaces store your inputs on external servers, data does not disappear when you close the tab, and retention periods vary by platform and plan.
2. Paying for a consumer premium plan (ChatGPT Plus, Claude Pro) does not automatically protect your data, enterprise contracts are the meaningful dividing line for data protection commitments.
3. Scale does not equal anonymity. Your inputs contribute to training data pools and may be reviewed by human contractors regardless of how many other users exist.
4. The anonymization habit, replacing real names and sensitive details with placeholders before pasting, eliminates most practical data exposure risk without reducing the quality of AI outputs.
5. Organizational policy matters as much as individual behavior. If your company hasn't established AI usage guidelines, every team member is making unsupported individual judgment calls.

Three Things Most Professionals Get Wrong About AI Data Privacy

Most professionals operating with AI tools today are working from assumptions formed in a pre-AI world, assumptions about how software stores data, who can see it, and what 'private' actually means. These assumptions aren't stupid. They made sense for email clients, cloud storage, and CRM systems. But AI tools work differently, and the gap between what professionals believe and what's actually happening creates real exposure. Three beliefs come up repeatedly in organizations, and all three are wrong in ways that matter.

Myth 1: 'I'm Just Having a Conversation. Nothing Is Being Stored'

This is the most common misconception, and it's understandable. Chat interfaces feel ephemeral, like a phone call rather than a document. You type something, get a response, close the browser, and it feels like it's gone. Many professionals assume that because they didn't upload a file or submit a form, nothing was formally 'recorded.' That mental model is wrong. Every message you send to a consumer AI tool. ChatGPT, Claude, Gemini, is transmitted to the provider's servers, processed by their models, and, unless you've actively changed your settings, retained for a period that varies by platform and plan.

OpenAI's default settings for free and Plus users retain conversation history indefinitely unless manually deleted or turned off. Google Gemini stores conversations in your Google Account activity by default. Claude by Anthropic retains conversations for a period defined in their privacy policy, which has changed over time. The practical implication: that conversation where you pasted a client's financial projections to ask for a summary, or where you described an internal HR matter to draft a response, those exchanges exist on external servers. They're not floating freely, but they are stored, and they are subject to each company's data access policies.

The critical nuance most professionals miss is the distinction between storage and training. Stored data sits in your account history. Training data is a separate question, whether your inputs are used to improve future AI models. OpenAI has settings to opt out of training data use, but the default for free accounts has historically included conversation data in model improvement. ChatGPT Plus subscribers can turn off training use in Settings → Data Controls. Claude Pro and Anthropic's API have different policies. The point isn't that your data is definitely being misused, it's that 'nothing is being stored' is simply false, and professionals deserve to make informed decisions.

Myth 2: 'My Company's Data Is Safe Because I'm Using a Business Account'

This one is more nuanced, and more dangerous because it contains a grain of truth. Enterprise and business tiers of AI tools do offer significantly stronger data protections than consumer accounts. Microsoft Copilot for Microsoft 365 keeps data within your organization's Microsoft 365 tenant. ChatGPT Enterprise explicitly states that inputs are not used for training and offers stronger encryption and admin controls. Google Workspace's Gemini for Business has similar commitments. So yes, business accounts are generally safer. But 'safer' is not the same as 'safe,' and the business account assumption breaks down in three specific ways.

First, many professionals using 'business accounts' are actually using personal accounts they access from a work device or work email. Signing into ChatGPT with your work email address does not make it a business account with enterprise protections, it makes it a personal account associated with a work email. The legal and privacy protections of enterprise agreements only apply when your organization has formally signed up for and configured an enterprise product. Second, even genuine enterprise accounts have limits. They protect against the vendor using your data for training, but they don't protect against your own employees putting sensitive data into prompts that other employees can later access through shared workspaces.

Third, and this is where real incidents happen, many organizations have employees using a mix of personal and business AI accounts, often without IT or legal's knowledge. A marketing manager uses ChatGPT Plus personally and pastes a client brief into it at home. A salesperson uses a free Claude account to draft a proposal because the company's approved tool feels slow. These shadow AI habits are extraordinarily common. A 2023 survey by Fishbowl found that 68% of professionals who use AI tools at work had not told their bosses. When sensitive data leaves through personal accounts, enterprise agreements offer zero protection.

Myth 3: 'If I Don't Include Names, The Data Is Anonymous'

Professionals often try to protect privacy by removing obvious identifiers, names, email addresses, phone numbers, before pasting information into an AI tool. This is a good instinct, but it's based on an outdated understanding of what makes data identifiable. Modern data privacy research has repeatedly demonstrated that individuals can be re-identified from datasets that appear anonymous, using combinations of indirect attributes. A 1997 study by Latanya Sweeney showed that 87% of Americans could be uniquely identified using just zip code, birth date, and sex. The same principle applies to the information you paste into AI prompts.

Consider a realiztic workplace example: a consultant pastes a description into Claude that reads, 'A 52-year-old VP of Operations at a manufacturing company in Cincinnati, Ohio, who was placed on a performance improvement plan in Q3 after missing two consecutive quarterly targets.' No name. No email. But in a company of 200 people, that description narrows the field to one or two individuals immediately. Combine that with the date of the interaction and the consulting firm's identity, and re-identification becomes trivial for anyone with access to that data. Anonymization requires systematic, deliberate technique, not just deleting the name field. For most professionals, the practical rule is simpler: if describing the situation would let a colleague figure out who you're talking about, it's not truly anonymous.

Click to enlarge

Myth vs. Reality at a Glance

Click to enlarge

What Actually Protects Your Data

Effective data protection with AI tools isn't about avoiding AI, it's about building three habits that take less than five minutes to establish. The first is settings hygiene. Every major AI platform has privacy settings that most users never visit. On ChatGPT, go to Settings → Data Controls and turn off 'Improve the model for everyone' if you're on a paid plan. On Google Gemini, review your Gemini Apps Activity settings in your Google Account. On Claude, check Anthropic's current privacy policy for your account type. Do this once, confirm it, and revisit it whenever a platform announces a policy update. Platforms do change defaults. OpenAI has revised its data practices multiple times since 2022.

The second habit is input discipline, deciding before you type what category of information you're about to share. A practical framework used by data privacy professionals is the 'newspaper test in reverse': instead of asking whether something would be embarrassing if published, ask whether the information you're about to type could cause harm to a specific person or competitive damage to your organization if it appeared in a breach or a policy review. Client names, unreleased financial figures, employee performance details, proprietary pricing, and legal matters fail this test. Generic descriptions, publicly available information, and your own work product typically pass. This takes two seconds and catches most high-risk inputs before they're sent.

The third habit is using the right tool for the right task. Consumer AI tools, free ChatGPT, personal Claude, free Gemini, are appropriate for tasks involving your own thinking, public information, and non-sensitive drafting. Sensitive professional work belongs in tools your organization has formally approved and configured: Microsoft Copilot within your Microsoft 365 environment, ChatGPT Enterprise with your IT team's configuration, or similar enterprise-grade solutions. If your organization hasn't made that determination yet, that's a gap worth raising with IT or leadership, not a gap worth ignoring while you use whichever tool is fastest. The cost of a data incident far exceeds the inconvenience of using an approved tool.

Frequently Asked Questions

• Q: If I delete my ChatGPT conversation history, is the data really gone? A: Deleting your history removes it from your account view, but OpenAI's privacy policy indicates that data may be retained in backup systems for a limited period before full deletion. The practical answer: deletion is meaningful for reducing ongoing access and training use, but it is not instant or guaranteed across all systems. For truly sensitive data that should never have been entered, deletion is damage control, not a clean undo.
• Q: Does using Incognito or private browsing mode protect my AI conversations? A: No. Incognito mode prevents your browser from saving local history on your device. It has zero effect on what the AI platform's servers receive, process, and store. Your conversation is transmitted to OpenAI, Anthropic, or Google's servers regardless of your browser mode. Incognito is a local privacy tool, not a network or server privacy tool.
• Q: My company uses Microsoft 365. Does that mean Copilot is automatically safe for sensitive work? A: Microsoft Copilot for Microsoft 365 is designed with enterprise data boundaries, your data stays within your Microsoft 365 tenant and is not used to train foundation models. However, 'safe' depends on your organization's configuration and user permissions. If colleagues share a workspace, they may access AI-generated content. Your IT or compliance team should confirm how Copilot is configured in your specific environment before you use it for highly sensitive matters.
• Q: Can AI companies be compelled to hand over conversation data to law enforcement? A: Yes. Like any technology company, AI providers can receive and respond to legal process, subpoenas, court orders, and government requests. OpenAI, Google, and Anthropic all publish transparency reports documenting government data requests. This is a low-probability scenario for most professionals, but it matters for legal, compliance, and law enforcement contexts where privilege or confidentiality is at stake.
• Q: Is it safer to use AI tools that run locally on my device rather than in the cloud? A: Yes, significantly. Tools that run entirely on your local hardware, like certain configurations of open-source models, don't transmit your inputs to external servers. However, locally-run AI tools generally require technical setup beyond most non-technical professionals' comfort level, and they typically offer less capability than cloud-based tools. For most professionals, the answer is using enterprise cloud tools with strong data agreements, not switching to local models.
• Q: What should I do if I accidentally shared something sensitive with an AI tool? A: Act immediately: delete the conversation from your history, document what was shared and when, and notify your IT or compliance team if the information involved client data, employee records, or regulated information. Don't wait to see if anything happens, early disclosure is almost always better than late disclosure in data incident management. Your organization may have a formal incident response process, and this kind of event may need to be logged even if the risk is low.

Key Takeaways from Part 2

1. Consumer AI conversations are stored by default, the privacy-protective settings are opt-in, not opt-out, and most users have never changed them.
2. A business email address on a personal AI account provides zero enterprise data protections. Only formally licensed enterprise accounts carry contractual data safeguards.
3. Removing names doesn't make data anonymous. Role, location, date, and context can re-identify specific individuals, especially in organizations where a description fits only one or two people.
4. Human reviewers at AI companies can and do access conversations for safety, quality, and policy enforcement purposes. Treat AI conversations as potentially readable by a third party.
5. Three habits protect you: settings hygiene (audit and adjust privacy controls), input discipline (decide before you type), and tool selection (match the tool to the sensitivity of the task).
6. Shadow AI use, employees using personal accounts for work tasks, is widespread and bypasses every enterprise agreement your organization has in place. This is a people problem, not just a technology problem.

The Truth About AI Data Privacy: Three Myths That Put Your Work at Risk

Most professionals believe their AI conversations are private by default, that free tools are basically as safe as paid ones, and that once they close the chat window, their data disappears. All three beliefs are wrong, not slightly off, but dangerously incomplete in ways that can expose client information, violate company policy, and in some cases breach data protection regulations. Here is what is actually happening, backed by how these platforms work, and what you can do differently starting now.

Myth 1: 'My Conversations with AI Are Private'

The assumption feels reasonable. You are sitting alone at your laptop, typing into a chat window. No one else is in the room. But privacy in the legal and technical sense means something specific: it means the company operating the tool cannot access, review, or use what you type. For most free-tier AI tools, that is not the case. OpenAI's data usage policy, for example, has historically allowed human reviewers to read conversations for safety and quality purposes. That policy has been updated and refined, but the baseline assumption should never be 'this is private.'

When Samsung engineers used ChatGPT in early 2023 to help debug proprietary source code, the content they pasted became part of OpenAI's servers. Samsung subsequently banned internal use of generative AI tools on company devices. The incident made headlines, but the underlying behavior, employees sharing sensitive work content with AI tools, happens in thousands of organizations every week, quietly, without incident reports. The risk is not theoretical.

The corrected mental model: treat every AI chat box like a shared Slack channel that your IT department, the tool's vendor, and potentially their subcontractors can read. That framing is not paranoia, it is accurate. ChatGPT Plus users can disable chat history in settings, which opts out of training use. Claude Pro and Microsoft Copilot for enterprise have stronger contractual data protections. But 'stronger' is not the same as 'private.' Always check the privacy settings before you type anything sensitive.

Click to enlarge

Myth 2: 'The AI Forgets Everything After I Close the Window'

Closing a browser tab does not delete data from a server. When you submit a prompt, that text travels to a remote data center, gets processed, and a response is sent back. The input is logged. How long it is retained, whether it is used for model training, and who can access it depends entirely on the platform's terms of service, not on whether you closed the window. OpenAI retains conversation data for up to 30 days for safety monitoring even when history is disabled, according to their privacy policy.

This matters most when you paste document content, client names, financial figures, or draft contracts into a prompt to get feedback or a summary. That content does not evaporate. It exists in server logs, potentially in training datasets (if you have not opted out), and within the vendor's data infrastructure for a period defined by their retention policy, not yours. Microsoft Copilot in its enterprise version offers stronger commitments: Microsoft states it does not use that data to train foundation models. The free web version of Copilot does not carry the same guarantee.

The corrected mental model: think of your prompt like an email you sent to a vendor. You would not assume the vendor deleted that email the moment you hit send. You would expect it to sit in their inbox, possibly their archive, until their retention policy expires. The same logic applies here. This does not mean you should stop using AI tools, it means you should be intentional about what you put in them, just as you would be intentional about what you put in an email to an outside party.

Myth 3: 'Enterprise Tools Are Automatically Compliant and Safe'

Paying for ChatGPT Plus or using Microsoft Copilot through a business license does not automatically make your AI use compliant. Enterprise agreements shift some liability and offer stronger data protections. Microsoft's commercial Copilot does not use your data to train models, and OpenAI's enterprise tier offers a zero data retention option. But 'the tool is compliant' and 'your use of the tool is compliant' are two different things. You can use a fully enterprise-licensed tool in a non-compliant way by sharing data you are not authorized to share.

A marketing manager summarizing a confidential merger briefing in Copilot, even on an enterprise license, may be violating their organization's information security policy, not because the tool is insecure, but because the policy prohibits processing that category of data outside approved systems. Compliance is not just about the tool. It is about what data you put into the tool, what classification that data carries, and whether your organization's policies permit that use. Most employees have never read those policies. Now is a good time to find them.

What Actually Protects You

The most effective protection is a habit called data minimization: never paste more into an AI tool than the task strictly requires. If you need help rewriting a client email, describe the situation rather than pasting the original with the client's name and company. If you need to analyze a contract, ask the AI for a framework and apply it yourself. This approach gives you the full benefit of the tool while keeping sensitive specifics off external servers. It takes slightly more thought upfront and saves significant risk downstream.

The second protection is knowing your settings. In ChatGPT, go to Settings → Data Controls and turn off 'Improve the model for everyone.' This opts your account out of using conversations for training. In Google Gemini, you can pause activity storage. In Claude, Anthropic states it does not train on Pro user conversations by default, but you should verify this in current terms. These settings are not visible by default, you have to look for them. Spend five minutes in the settings of every AI tool you use regularly.

The third protection is organizational: know your company's AI use policy before you need it. Many organizations now have written policies specifying which tools are approved, what data classifications can be used with them, and what the consequences are for violations. If your organization does not have one yet, that is a conversation worth starting. The professionals who avoid AI-related data incidents are not the ones who stopped using AI, they are the ones who built simple, consistent habits around what they share.

Click to enlarge

Frequently Asked Questions

• Can AI companies sell my conversation data to advertisers? OpenAI, Anthropic, and Microsoft state they do not sell user data to third parties. However, data may be shared with subprocessors (infrastructure vendors) and reviewed internally. 'Not sold' is not the same as 'completely private.'
• Does using Incognito mode protect my AI conversations? No. Incognito mode prevents your browser from saving local history. It has no effect on what is transmitted to and stored by the AI vendor's servers.
• Is it safe to use AI tools for HR tasks like drafting performance reviews? Be cautious. Avoid including employee names, specific incidents, or salary details. Describe the situation generically, 'a mid-level employee who missed three deadlines', and apply the AI's framework to the real situation yourself.
• What is the difference between ChatGPT Plus and ChatGPT Enterprise for privacy? ChatGPT Plus ($20/month) gives you opt-out controls for training. ChatGPT Enterprise offers zero data retention by default, SOC 2 compliance, and a formal data processing agreement, making it appropriate for more sensitive business use.
• Does Grammarly AI read all my documents? Grammarly processes your text on its servers to provide suggestions. Its business tier offers a data processing agreement and does not use your content to train its AI models. The free version has less restrictive terms. Review their privacy policy for your specific tier.
• If I delete a conversation, is it gone permanently? Deleting removes it from your visible history, but vendors typically retain server-side logs for a period defined in their privacy policy (often 30 days) for safety and abuse monitoring. Deletion is not the same as immediate permanent erasure.

Key Takeaways

• Free-tier AI tools do not offer confidentiality protections, treat your prompts like messages to a third-party vendor, not private notes.
• Closing a chat window does not delete your data from vendor servers. Retention is governed by the platform's privacy policy, not your actions.
• Enterprise licenses improve data protections but do not automatically make your specific use of the tool compliant with your organization's policies.
• Data minimization, describing situations without pasting sensitive specifics, is the most practical and effective habit you can build.
• Check privacy settings in every AI tool you use. Opt-out options for training data exist but are not turned on by default.
• Know your organization's AI use policy. If one does not exist, advocate for creating one, it protects you as much as it protects the organization.