Is it safe to use ChatGPT at work?

It can be, if your business has approved it, staff use a business account rather than a personal one, and nobody enters personal data, client confidential information or passwords. Check the provider's current terms on how business data is used and stored.

Can Microsoft 365 Copilot see all of our files?

Microsoft says Copilot only uses content that the signed in user already has permission to access. The risk is that many organisations have overshared files over the years, so Copilot can make those files easier to find. Reviewing permissions before rollout is important.

Is Copilot Chat free?

Microsoft states that Copilot Chat is available at no additional cost to users signed in with a work account on an eligible Microsoft 365 subscription. The full Microsoft 365 Copilot, which works with your emails and files inside the Office apps, is a paid additional licence.

Do we need an AI policy?

Yes, even a short one. A clear policy tells staff which tools they may use, what information must never be entered and that they remain responsible for checking anything AI produces. It protects the business and gives staff confidence.

Using AI Safely at Work: Copilot, ChatGPT and Your Data

Key takeaways

Use AI tools your business controls, signed in with work accounts, rather than personal accounts on free consumer tools.
Never paste personal data, client confidential information, passwords or financial details into an AI tool your business has not approved.
Microsoft 365 Copilot can only see what each user already has access to, so fix oversharing in SharePoint and Teams before you roll it out.
A short acceptable use policy and some practical training give staff confidence to use AI well.
Always check AI output before you rely on it or send it to a client.

Whether or not your business has a plan for artificial intelligence, your staff are probably already using it. Someone is asking a chatbot to tidy up an awkward email, someone else is summarising a long report, and another person is getting help with a spreadsheet formula. Used well, these tools save genuine time. Used carelessly, they can leak client information, produce confident nonsense or create data protection problems that are hard to undo.

This guide is for business owners and managers who want their team to get the benefits of AI without the risks. It focuses on the tools most small businesses meet first: Microsoft 365 Copilot, Copilot Chat and ChatGPT.

Know which AI tools your team is using

The biggest risk is not AI itself but unmanaged AI: staff using personal accounts on free tools, where the business has no control over what happens to the information typed in. Consumer versions of some AI tools may use conversations to improve their models unless the user changes their settings, while business versions generally come with contractual commitments about how your data is handled. The details differ by provider and change over time, so always read the current terms.

For businesses on Microsoft 365, there are two main options to understand:

Microsoft 365 Copilot Chat. Microsoft says this is available at no additional cost to users who sign in with a work account on an eligible Microsoft 365 subscription, with enterprise data protection. It is a web grounded chat assistant that works with what you give it in the conversation.
Microsoft 365 Copilot. A paid additional licence that works inside Outlook, Word, Excel, PowerPoint and Teams and can draw on your organisation's emails, files, chats and meetings. Since December 2025 Microsoft has also offered a Copilot Business licence aimed at organisations with up to 300 users.

Pricing and features change regularly, so check current details with Microsoft or your IT provider before buying. Whatever you choose, the principle is the same: decide which tools are approved, make sure staff sign in with work accounts and make it easy for people to use the approved option rather than reaching for something else.

What not to paste into an AI tool

A useful rule of thumb is to treat any AI tool your business has not approved like a public forum. If you would not post it there, do not paste it in. That includes:

Personal data about customers, staff or anyone else, such as names with contact details, health information, HR records or anything covered by UK GDPR.
Client confidential information, including contracts, case files, financial statements and anything covered by a non disclosure agreement.
Passwords, API keys and access codes. These should never be shared with any tool.
Payment and banking details.
Commercially sensitive material such as unreleased pricing, tender responses or plans for acquisitions.

Even with approved business tools, apply common sense and data minimisation, a core UK GDPR principle: only include the information the task genuinely needs. You can often get the same result by removing names and identifying details first. The Information Commissioner's Office (ICO) publishes guidance on AI and data protection which is worth reading if you plan to use AI with personal data in any significant way.

Fix oversharing before you roll out Copilot

Microsoft 365 Copilot works within your existing permissions. According to Microsoft, it can only surface content the signed in user already has access to. That sounds reassuring, and it is, but it exposes a problem many organisations have quietly lived with for years: people have access to far more than they should.

Think about the HR folder that was shared with "everyone" to save time, the SharePoint site that anyone in the company can open, or the spreadsheet of salaries sitting in a Teams channel. Previously nobody stumbled across these because they were buried. With Copilot, a simple question such as "what is the pay range for managers?" could bring them straight to the surface.

A practical permissions tidy up

Review sharing links. Look for files and folders shared with "anyone with the link" or with the whole organisation, and tighten them.
Check SharePoint sites and Teams. Make sure each one has a named owner and only the members who need it. Private content should not live in public teams.
Find sensitive data. Locate HR, payroll, finance and client files and confirm they are only available to the right people.
Use sensitivity labels where your licence supports them, to mark and protect confidential documents.
Archive or delete stale content in line with your retention policy, so old material is not dragged into answers. Our guide to UK GDPR data retention can help.

Microsoft offers additional tools for finding oversharing, including reports in SharePoint Advanced Management, but even a manual review of your most sensitive areas makes a real difference. This is good practice whether or not you adopt Copilot.

An acceptable use policy for AI

A short, clear policy helps staff use AI confidently. It does not need to be long. A one or two page document covering these points is enough for most small businesses:

Section	What to cover
Approved tools	Which AI tools staff may use for work, and that they must sign in with work accounts.
Prohibited information	The types of data that must never be entered, as listed above.
Checking output	That staff remain responsible for anything they send or publish, and must check facts, figures and tone.
Transparency	When AI use should be disclosed to clients or colleagues, for example in formal reports.
Decisions about people	That AI must not be used to make decisions about individuals, such as hiring or disciplinary matters, without human review.
Intellectual property	Care with copyrighted material and with content generated for clients.
Reporting problems	Who to tell if something sensitive is entered by mistake.
Review	When the policy will be reviewed, as the tools change quickly.

Pair the policy with some practical training. Staff who understand why the rules exist are far more likely to follow them. Our security awareness training can include safe use of AI alongside topics such as phishing.

Practical ways AI can save time

With sensible guardrails in place, AI tools can genuinely help a small team. Some of the most useful everyday tasks include:

Drafting and rewriting: first drafts of emails, letters and proposals, or turning rough notes into something clearer.
Summarising: long documents, email threads and, with Microsoft 365 Copilot, Teams meetings, so people can catch up quickly.
Spreadsheets: explaining formulas, suggesting how to analyse data or building a chart.
Presentations: creating a first outline from an existing document.
Research starting points: getting a quick overview of a topic before checking reliable sources.
Process documents: turning a list of steps into a clear how to guide for new starters.

The common thread is that AI produces a first draft and a person finishes it. AI tools can be wrong while sounding entirely confident, so facts, figures, names and legal points always need checking.

Safe AI checklist

Decide which AI tools are approved and turn off or discourage the rest.
Make sure staff use work accounts, protected by multi factor authentication.
Write a short acceptable use policy and share it.
Review SharePoint, OneDrive and Teams permissions before rolling out Copilot.
Label or restrict your most sensitive content.
Train staff on what not to share and how to check output.
Review the policy and your licences regularly.

How Cyber Fits can help

We help businesses across Sunderland and the North East get more from Microsoft 365, including checking permissions, tightening sharing and preparing for Copilot in a measured way. If you would like an honest view on whether Copilot is worth it for your team, or help writing a sensible AI policy, start with a free IT review.