Using AI tools safely at work: data, accuracy and policies
In short: AI assistants save time, but they can leak confidential data, invent facts and write insecure code. Use approved tools, never paste secrets or personal data into public services, and verify everything before you act on it. A short AI acceptable use policy makes the rules clear for everyone.
The three big risks
Generative AI tools are useful for drafting emails, explaining error messages, writing scripts and summarising documents. Used carelessly, they create three main risks:
- Data leakage: text you paste may be stored, reviewed or used to improve a service, depending on the product and its settings. Consumer accounts and enterprise plans often have very different terms.
- Inaccuracy: models can produce confident but false answers, often called hallucinations, including commands that do not exist or options with a different meaning.
- Shadow AI: staff using unapproved tools or browser extensions, so the organisation cannot see or control where data goes.
Protecting data
Follow your organisation’s data classification. As a rule of thumb, never paste passwords, API keys, private keys, customer records, health or payroll data, or unreleased financial results into a public AI service. Before sharing a configuration file to get help, replace real IP ranges, hostnames, usernames and secrets with placeholders.
! Before asking for help, sanitise the config
hostname <site-router>
interface GigabitEthernet0/1
ip address 192.168.10.1 255.255.255.0
username admin secret <removed>
snmp-server community <removed> ROPrefer enterprise tools your IT team has approved, with contracts that address data retention, training on your data, data location and access controls.
Checking the output
For engineers, the most common mistake is running AI-generated commands straight on production equipment. A suggested command might be for a different software version, use a deprecated option, or be destructive. Test in a lab or on a spare device first, read the vendor documentation for anything unfamiliar, and follow your normal change control. AI-written code needs the same review as any other code: check input validation, error handling and secrets handling, and run your usual security scans.
Tip: ask the assistant to explain each line of a script it wrote. If the explanation and the code disagree, you have found a problem.
A simple AI acceptable use policy
| Section | What it says |
|---|---|
| Approved tools | Which AI services and features may be used, and how to request new ones |
| Data rules | Which data classes may be entered into which tools |
| Verification | Users must review and are accountable for AI-assisted work |
| Disclosure | When AI use must be declared, such as in customer documents or assessments |
| Prohibited uses | For example, automated decisions about people without review, or impersonation |
| Reporting | How to report a data leak or harmful output |
Students should also check their institution’s rules on AI use in assessments: using a tool where it is not allowed, or without declaring it, can be treated as academic misconduct.
Practice
A colleague pastes a full router configuration with SNMP community strings into a free chatbot. What is the risk?
What is a hallucination in generative AI?
What is shadow AI?
Key takeaways
- Never paste secrets, customer data or personal data into public AI tools.
- Use approved enterprise tools with clear data terms.
- Verify every command, fact and line of code before using it.
- You remain accountable for AI-assisted work.
- A short acceptable use policy sets clear, shared rules.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.