Using AI safely with client information

AI is safe to use in a small business if you follow a few plain rules. Most of them are common sense; the rest are settings you change once.

The one rule: treat a public AI chat like a postcard

It's fine for your own ideas, your own business details and public information. It's not the place for someone else's personal details. Before you paste anything in, take out names, addresses, phone numbers, and anything about health, money or family. "Client A, a bakery in Gosford" works just as well as the real name.

What the Australian guidance says

• The privacy regulator (OAIC) advises, as best practice, not to enter personal information, and especially sensitive information, into publicly available AI tools, and to say in your privacy policy if you use AI. Many small businesses with a turnover under A$3 million are exempt from the Privacy Act, but clients still expect the same care, and the advice is still good practice.
• The Australian Government's Guidance for AI Adoption (October 2025) sets out six practices and includes free templates for an AI policy and an AI register.
• The Australian Cyber Security Centre, with the small-business peak body COSBOA, says: remove or anonymise personal details, set rules on what can't be uploaded, check what AI produces, and keep a person in the decision.
• Consumer law applies to AI content the same as anything else. Misleading content is illegal whether or not you meant to mislead, and fake testimonials are illegal. An AI-made "customer" presented as real would be a serious risk.
• A new right to sue for serious invasions of privacy started in Australia on 10 June 2025.

In the US and the UK the same common-sense rules apply. If you work in health, finance, law or with children, check your industry's own rules before using AI with client material.

A one-page AI policy you can copy

1. We don't put clients' personal details into public AI tools.
2. "Use my data for training" is switched off on every AI account we use.
3. A person reads and checks everything AI drafts before it's sent or published.
4. Realistic AI images, video or voices are labelled as AI.
5. Our privacy policy says that we use AI tools, and what for.

Why business plans are different

The business versions of the main assistants (Claude Team, ChatGPT Business, Perplexity Enterprise, Google Workspace with Gemini) don't train on your data by default. If you regularly work with client documents, that's the reason to upgrade, more than the extra features. The steps to switch training off on personal plans are in Choosing an AI assistant.

Labelling AI content on social media

• Facebook, Instagram and Threads: Meta asks you to use its disclosure tool for photorealistic video or realistic audio made or changed with AI. The label shows as "AI info".
• YouTube: you must disclose realistic content that shows a real person saying or doing something they didn't, or a realistic event that didn't happen. Clearly animated content and AI help with scripts or captions don't need it.
• TikTok: label AI content showing realistic scenes or people. TikTok also labels some content automatically.

More on this in AI video, avatars and digital twins.