Identify the risk before selecting a tool
For data security, ask whether information may be stored, used for service improvement, accessed by another party or exposed through an internal mistake.
For copyright, ask whether you have the right to use the source material, whether the output can be used commercially and whether attribution or additional permission is required.
A secure transfer does not create copyright permission. A licensed source does not make it appropriate to upload confidential project data.
Classify information before uploading it
Use a simple three-level model.
1. Public information
Published web pages, public specifications and material already approved for external release generally carry lower confidentiality risk.
2. Internal but non-confidential information
Working sketches, meeting notes and unpublished design versions need a defined workflow. Remove unnecessary identifiers and confirm which AI service and account type may be used.
3. Confidential or protected information
Client contracts, tender documents, personal data, detailed costs, negotiation positions and professional seals should not be uploaded by default.
The issue is not that every AI service will leak data. The issue is that a project team cannot make a blanket guarantee for every provider, integration, account and retention setting.
Use the minimum information required
When AI is used to summarize regulations, prepare a presentation outline or organize interview notes, reduce the exposure surface.
- 01Provide a summary instead of the original file whenever possible.
- 02Replace names, sites and budgets with neutral codes.
- 03Define a reproducible output, such as a checklist with source fields.
- 04Use an approved account or enterprise environment where required.
- 05Set a retention rule for conversations, files and generated artifacts.
Prompts are data too. Typing confidential design details, client contact information or cost strategy into a chat is still disclosure, even when no file is attached.
Ask three copyright questions
Do you have the right to use the input?
Uploading another designer's image, report or drawing may require permission. “It was available online” is not a complete rights analysis.
Can the output be used for this purpose?
Platform terms, source licenses and local law may differ. Internal discussion, public publication, tender submission and commercial sale are not equivalent uses.
What will a responsible reviewer need to verify?
Before external use, the team should be able to identify the source, responsible reviewer, material changes and approval decision.
Example: an AI-assisted tender presentation
Suppose a team wants AI to generate narrative structure, captions and key messages.
A controlled workflow can look like this:
- 01AI proposes the presentation structure and alternative wording.
- 02Drawings, numbers, images and quotations come from original or licensed sources.
- 03A person reviews every page before external release.
- 04The team records the source and reviewer for critical claims.
This creates evidence of process if a client or partner later asks how the material was prepared.
Build review into the workflow
Compliance work becomes slow when all project information is sent into one step and reviewed only at the end.
A more efficient approach is to use AI for repeatable, lower-risk work; keep high-risk material in controlled systems; and use prompt templates that specify the required sources, uncertainty labels and approval points.
The team then spends time reviewing focused risks rather than rebuilding the entire deliverable.
Common mistakes
- 01Treating typed prompts as harmless. Text can contain the same confidential information as a file.
- 02Assuming a plausible output is compliant. Fluent language is not evidence of permission or accuracy.
- 03Using one rule for every data class. Public references and client contracts require different controls.
- 04Ignoring account and retention settings. Provider, plan, workspace and integration choices affect the data path.
- 05Failing to document external use. Public and commercial material needs a source and review trail.
Limits and professional advice
No responsible workflow should promise that information “can never leak.” Risk depends on provider policy, technical settings, internal access and actual behavior.
Contractual and copyright questions also vary by jurisdiction and use. For material legal decisions, consult qualified counsel. AI can help organize questions; it should not provide the final legal conclusion.
A practical next step
List the AI uses already present in your organization. For each one, record:
- -data class: public, internal or confidential;
- -use: internal, external or commercial;
- -approved service and account;
- -human review point;
- -retention and deletion rule.
This small inventory moves the organization from informal use toward a manageable workflow.
AI is an accelerator. It is not a release from responsibility.
---
