Public safe-use check

Can I Put This Into AI?

A first check for staff, managers, founders and directors before entering information into an AI tool. General guidance only. Do not enter confidential, personal, privileged or regulated information into public AI tools.

Three routes

Check the information before you enter it

Decide by the most sensitive information involved. This is a starting point, not a substitute for a tailored classification.

Green route

Bounded public work.

Public information, general research and your own drafts with no identifying or commercially sensitive detail.

Verify the output before relying on it.

Amber route

Controls first.

Internal or commercially sensitive information, supplier or operational detail.

Use an approved route, a named approver and a record of material use.

Red route

Keep it out of public AI.

Personal, client-confidential or privileged material, credentials or regulated records.

Use a separately approved secure route or keep the task outside AI.

Check the boundary for this task

Choose the most sensitive information involved. The result is generic and does not replace a tailored classification.

Do not enter source material. This selector does not ask for, process or retain task content.

Why personal information needs special care

Input can be a use or disclosure of personal information

Entering personal information into an AI tool can itself be a use or disclosure, which is why privacy obligations may apply before you even see an output.

AI-generated information can itself be personal information

Information an AI produces about an identifiable person can also be personal information, so the output deserves the same care as the input.

Public AI versus an approved business AI route

A public tool and an approved business route configured for your organisation handle data differently. Treat them as separate boundaries and do not assume a public tool is safe for business-sensitive work.

What to do when the answer is Amber

Minimise the information, use an approved route, and name the person who reviews the result before it is used. If you cannot do those things, treat the task as Red.

Move recurring questions into governance controls

When the same questions keep recurring, turn them into policy and controls via an AI policy and an AI risk register, or the scoped AI Governance Starter Pack. Keep the PDF checklist beside the work in the meantime.

FAQ

Frequently asked questions

Can I put personal information into AI?

As a best practice, keep personal information, especially sensitive information, out of publicly available generative AI tools unless a separately approved secure route is in place.

What does the Amber route mean?

Amber means proceed only with controls: minimise the information, use an approved tool route and name the person who reviews the result.

Is a public AI tool the same as an approved business AI route?

No. A public tool has different data handling to an approved business route configured for your organisation. Treat them as different boundaries.

Can AI output itself be personal information?

Yes. Information an AI produces about a person can itself be personal information and carry privacy obligations.

OAIC — Privacy and commercially available AI products.