The short answer

Check what information the task actually needs, who is allowed to use it, which service receives it and what happens afterwards. A tool being available to your team does not make every document suitable to put into it.

Follow the information through the whole task

Write a simple path: the source information, the tool or workflow that reads it, any provider it is sent to and where the output ends up. Include logs, shared documents and onward connections in that discussion.

This makes the questions specific. An internal instruction document is different from a customer file, and preparing a summary for one authorised person is different from publishing it to a whole team.

Check the actual service and settings

Avoid assuming that a personal chat account, a business workspace and an API integration have identical controls. Review the current terms and settings for the specific service and account you intend to use.

OpenAI states that API data is not used to train its models unless you opt in. That does not mean no information is retained: logging and application-state rules depend on the feature and configuration. Check the current data-controls documentation for the proposed implementation.

Use only what the task needs

If the workflow only needs an approved service description, it does not need access to an entire customer folder. Begin with the smallest useful information scope and review permissions deliberately.

Use fictional or appropriately redacted examples while exploring an idea. Think about whether details can still identify a person when combined; removing a name alone does not settle that question.

Questions to resolve before implementation

Work through these with the person responsible for your information and systems. Where personal information is involved, use current ICO guidance and obtain appropriate advice for your situation.

  • What is the purpose of using this information?
  • Who can access the source, the workflow and its output?
  • Which providers receive it, and where might it be stored?
  • What retention and deletion settings apply?
  • Who checks the output and handles a mistake?
  • What changes when someone leaves the business or a connection is removed?

Make the answers part of the implementation

Access and information handling should shape the workflow, rather than sit in a separate document that nobody uses. The interface, permissions, approval steps and handover need to reflect the agreed boundaries.

This is an implementation checklist, not a finding that a particular use is compliant or risk-free. At Get AI Working, we discuss the intended information scope before building the connection, and identify questions that need the right specialist input.

Be specific about the information, the service, the people and the result before connecting anything.

Further reading

Use the linked provider documentation to check current product capabilities and access for your particular setup.

Explore the connected topic

Put the idea to work

AI Setup & Integration

You already have the knowledge. It is in your documents, your software and the heads of the people doing the work. We help put the right parts within reach of a useful AI workflow.

How we can help