Using AI at work without leaking company or tenant data

Staff are already using AI tools, whether the company has a policy or not. A quick copy of a lease clause or a tenant message into a free chat tool can feel harmless, and it can expose information that should have stayed inside the company. A short, clear policy protects the business without banning useful tools.

Start with approved tools

Decide which tools staff may use for work. For each one, check the terms: whether your inputs are stored, whether they are used to train the provider's models, where the data is held, and what business or enterprise options exist. Business plans often give stronger controls than free accounts. Publish the list, and update it.

Sort information into three levels

A simple scheme people can remember:

• Public. Marketing text, published material, general questions. Safe in approved tools.
• Internal. Procedures, plans, non-sensitive internal documents. Only in approved tools with business terms.
• Restricted. Personal data of tenants, owners and staff, passports and ID, bank details, contracts with named parties, legal matters, anything under a confidentiality agreement. Not in general AI tools. Use only systems specifically approved for it.

Five rules staff can remember

1. Use approved tools only.
2. No personal or financial data in prompts unless the tool is approved for it.
3. Remove names and identifiers when you can. Ask your question about "a tenant", not a named person.
4. Check every output. You are responsible for what you send.
5. Do not use AI output as legal, financial or safety advice without a qualified person reviewing it.

Handle review and accountability

AI output can be wrong, biased or out of date. For anything that goes outside the company, someone must read it first. For anything that affects a person, such as a tenancy decision, a human decides and records why.

Name an owner

Give the policy to a named person or small group. Their job: keep the approved list current, answer questions, learn from mistakes without blame and update the rules as tools change. Policies written once and forgotten fall out of date quickly.

Train briefly and often

Half an hour with real examples works better than a long document. Show a good prompt, a risky prompt and the safe way to do the same task. Repeat it for new staff.

Be clear about regulation

Data protection rules differ by country and by sector. If you handle personal data of residents or clients, check what applies in your market and take professional advice. This article is general guidance, not legal advice.

The aim

The goal is not to slow people down. It is to let them use AI confidently, knowing where the lines are. Teams with clear rules usually adopt useful tools faster than teams where everyone is guessing.