AI 101: Use Document AI Safely

What to understand

• Classify before you paste. Four classes carry different rules: PUBLIC (already published - marketing copy, public filings), INTERNAL (not secret but not for outsiders - process notes, draft plans), CONFIDENTIAL (commercially sensitive - pricing, unsigned contracts, strategy), and SENSITIVE (PII, health, financial, staff, or customer records, plus anything regulated). The action you want - summarise, rewrite, extract, share - changes the answer for each class. The grid below is the whole decision in one view.
• The same prompt is not equally safe everywhere - the plan tier decides. On consumer Claude (Free/Pro/Max), Anthropic's August 2025 terms changed the default: unless you opt out, new chats can be used for model training and retained up to five years (Anthropic, Aug 28 2025). On personal ChatGPT, chats are retained and can be used to improve models unless you turn it off. On business/enterprise tiers (ChatGPT Enterprise/Team/Edu and the API; Claude for Work/Enterprise/Education), the default flips: business inputs and outputs are NOT used for training, with shorter or configurable retention (OpenAI Enterprise Privacy; Anthropic Privacy Center, 2026). The tool name is not the control - the tier is.
• 'Deleted' does not always mean gone. A 2025 US federal court ordered OpenAI to preserve consumer ChatGPT and API logs - including chats users had deleted - as evidence in the New York Times copyright case; in November 2025 the court ordered 20 million de-identified logs produced to plaintiffs. ChatGPT Enterprise was explicitly excluded from the preservation order (OpenAI, 2025; National Law Review, Nov 2025). Lesson: legal hold can override a retention promise on consumer tiers, so sensitive material should not live there at all.
• Redaction is not magic, and it fails on indirect identifiers. Removing a name leaves the date, the rare job title, the team of three, the unusual diagnosis, the small town. Combined, those re-identify a person. Treat redaction as risk reduction, not anonymisation - and prefer a synthetic stand-in (a realistic but fake document) for prompt-building and testing whenever the real content is sensitive.
• Local-first is the defensible default for regulated or high-harm material. When a document contains health data, legal privilege, unreleased financials, or large volumes of customer PII, do the AI work on a controlled local or approved private environment first, and only send a redacted or synthetic version to a cloud tool - if at all. 'Local first' is a workflow rule, not a product.
• Scope permissions to the smallest set that does the job. A connector pointed at an entire Google Drive or SharePoint gives the AI - and anyone who can prompt it - reach over everything. Point it at one folder, or one file, and grant read-only where possible. Broad scope is the most common quiet over-exposure in document AI.
• Audit trails and a human checkpoint make the workflow reviewable. A one-line log - filename, date, tool + tier, data class, owner, approval status - turns 'we used AI on a document' into something you can defend to a client, an auditor, or a regulator. And for any legal, financial, medical, or employment judgement, AI output is a draft for a qualified human, never the decision.
• Frameworks are converging on exactly this discipline. GDPR already treats the AI vendor as a data processor you must contract with (Art. 28) and bans uncontrolled cross-border transfer; the EU AI Act (Reg. 2024/1689) adds transparency and governance duties, with most obligations applying from 2 Aug 2026. A simple classify-and-log policy is the practical floor those rules assume.

Deeper dive

Where can this document go? Tier decides the default

The same upload carries very different risk depending on the plan tier - because training defaults, retention, and legal-hold exposure differ. Verify your own account's settings; defaults change and admin policy can override them.

Sources (as of June 2026): OpenAI - Enterprise privacy · OpenAI - Response to NYT data demands · Anthropic - Updates to consumer terms (Aug 2025) · Anthropic - Is my data used for training? · Anthropic - Certifications

Step by step

Production prompt examples

ROLE: You are a pragmatic data-protection officer helping a non-technical team use AI on business documents safely. Plain English, no legal jargon, no hedging.

CONTEXT: I am about to use an AI tool on a document. Before I do, classify it and tell me the rules. Here is what I can share about the document (I am deliberately NOT pasting the sensitive content):
- Document type: [e.g. customer support transcript / unsigned supplier contract / quarterly P&L / staff performance note]
- Does it contain personal data (names, emails, IDs, addresses, health, financial)? [yes/no + which]
- Whose data is it? [our staff / our customers / a third party / no one identifiable]
- What do I want to do? [summarise / rewrite / extract fields / draft a reply / share externally]
- The tool + tier I plan to use: [e.g. personal ChatGPT / ChatGPT Enterprise / consumer Claude / Claude for Work / local model]

TASK: Return a short handling decision.

OUTPUT FORMAT:
1. DATA CLASS: Public / Internal / Confidential / Sensitive - and one line on why.
2. VERDICT for my requested action on this tier: ALLOW / ASK-FIRST / NEVER - one line on why.
3. IF NOT 'ALLOW': the safer path (redact what specifically / use a synthetic example / move to an enterprise tier / keep it local).
4. REDACTION CHECK: list the indirect identifiers I must remove or mask (dates, locations, rare roles, small group sizes), not just names.
5. AUDIT LINE: a ready-to-paste log entry - filename, date, tool+tier, data class, owner, approval status.
6. ONE escalation question I should ask my manager/DPO before proceeding, if any.

CONSTRAINTS: Do not ask me to paste the sensitive content. If my chosen tier is a consumer plan and the data is Confidential or Sensitive, say so plainly and recommend an enterprise tier or local handling.

Common mistakes to avoid

• Using a personal ChatGPT or Claude account for Confidential or Sensitive documents - consumer defaults retain and (unless you opt out) may train on what you paste.
• Assuming 'delete' means gone - a legal hold (as in the 2025 NYT v. OpenAI case) can preserve even deleted consumer chats.
• Treating redaction as anonymisation while leaving indirect identifiers - dates, locations, rare roles, small group sizes - that re-identify the person.
• Letting AI output replace expert review for legal, financial, medical, or employment judgement instead of treating it as a draft.
• Giving a connector access to a whole drive or SharePoint when one folder or one file, read-only, would be enough.
• Writing a policy so detailed that no one can apply it under time pressure - complexity is itself a security risk.

Source conflicts to review

• Provider training and retention defaults change frequently and differ by region and plan - treat every figure here as 'verify in your own account's settings', not a guarantee.
• The Anthropic consumer training change had a moving deadline (reported 28 Sep then ~8 Oct 2025); use 'late 2025' and confirm your account's 'Help improve Claude' toggle directly.
• Enterprise exclusion from the 2025 OpenAI preservation order applied to that specific case; it is not a blanket promise that enterprise data is immune to all legal process - your DPA and counsel govern.
• Compliance certifications (SOC 2, ISO 27001/42001, HIPAA BAA availability) are point-in-time and scope-specific; request current reports from each vendor's trust centre before relying on them.