What employees should never paste into AI tools

Employees should treat AI tools like any other third-party system: useful, but not automatically approved for every kind of data. The safest default is simple: if information is confidential, regulated, contractual, personal, or proprietary, do not paste it into an AI tool unless your organization has approved that exact tool and use case.

Never paste these without approval

• Client names, files, contracts, case notes, account details, or project materials.
• Employee records, resumes, performance notes, payroll information, or HR complaints.
• Customer lists, private emails, call transcripts, CRM exports, or support tickets.
• Financial statements, bank details, tax records, invoices, payment data, or forecasts.
• Legal advice, litigation strategy, settlement information, privileged communications, or regulated filings.
• Passwords, API keys, access tokens, private links, system prompts, internal credentials, or security logs.
• Proprietary strategy, unreleased product plans, pricing models, vendor terms, source code, or trade secrets.
• Health, biometric, children's, precise location, government ID, or other sensitive personal data.

Why this matters

Generative AI security risk is not limited to someone intentionally doing the wrong thing. OWASP's 2025 guidance for LLM and GenAI applications highlights risks such as prompt injection and sensitive information disclosure. A normal-looking document can contain instructions that attempt to manipulate an AI system, and an AI system can expose or mishandle sensitive information if the surrounding controls are weak.

NIST's Generative AI Profile also emphasizes risks such as data privacy, harmful bias, confabulation, and misuse. For business teams, that translates into a practical rule: employees need clear boundaries before they start using AI on client or company material.

Safer ways to use AI

Use public or low-risk examples when practicing. Replace identifying details with placeholders. Summarize a problem in general terms instead of copying the source document. Ask AI to create a checklist, outline, draft structure, or review rubric rather than processing confidential raw data.

Good prompt:

Create a checklist for reviewing a vendor contract for missing renewal, cancellation, and confidentiality clauses.

Risky prompt:

Review this full signed vendor contract and tell me if we should cancel it.

Team policy checklist

Every organization should decide:

1. Which AI tools are approved.
2. Which data types are prohibited.
3. Which use cases require manager approval.
4. When output needs human verification.
5. How employees should report accidental data sharing.

Sources

• OWASP Top 10 for LLM Applications 2025
• OWASP LLM01: Prompt Injection
• OWASP LLM06: Sensitive Information Disclosure
• NIST AI RMF Generative AI Profile

Reviewed: June 12, 2026.