# What information is safe to put into an AI tool?

Original 5HO practice material. Fictional example. Reviewed 5 October 2026.

## Useful result

You'll finish with a record of what information is allowed and who approves exceptions.

Before uploading a document, work out whether it belongs there. “It was in my Downloads folder” is not a sharing policy. This exercise helps you choose a lower-risk starting point.

## Set up

Allow 15 minutes. Read your organisation’s AI and information-handling rules first. For practice, use only the invented descriptions below; do not paste the real records.

## Practice input

A: public opening-hours leaflet. B: spreadsheet of customer names and personal phone numbers. C: fictional sales figures invented for training. D: internal contract with pricing and access restrictions.

## Do the task

1. List the owner, sensitivity and permitted destination for each item.
2. Ask AI to identify the questions you need answered; use your actual policy to decide.
3. Choose public or fictional material for the first test and document exclusions.

## Prompt

Using these descriptions only, draft a data-use decision record. For each item list owner approval needed, identifying information, permitted account to confirm, and a safer substitute. Do not declare legal compliance.

## Refine

Assume no workplace policy has been supplied. Mark permission as unverified instead of treating an AI subscription as approval.

## Expected checks

Public and fictional inputs are simpler starting points. Customer details and contracts need a real authority check; removing a name alone may not make a document anonymous.

## Save

Save the decision and the policy reference you used. If ownership or permission remains unclear, pause the upload.

## Sources

- Connected apps and access: https://help.openai.com/en/articles/11487775-connected-apps-in-chatgpt