In short
Three in four knowledge workers already use AI at work, approved or not. The rules, policy and training that make ChatGPT and Copilot safe to use.
Yes, it can be, as long as staff use tools your organisation has approved, keep personal and confidential data out of anything that isn't, and check every output before it's used. Most people who use AI at work already bring their own tools, so the answer isn't a ban. Clear rules and practical training are what make it safe.
This is general information rather than legal advice, and your own data protection lead should have the final say on your policies. The basics apply to every organisation, from a ten-person firm to a council department.
Are your staff already using AI?
The research says a large share of them are, approved or not. Microsoft and LinkedIn's 2024 Work Trend Index, which surveyed 31,000 people across 31 countries, found that 75% of knowledge workers use AI at work and that 78% of AI users bring their own AI tools to work. When people bring their own tools, nobody in the organisation is checking what goes into them.
The UK picture is the same. The ONS reported in July 2026 that 55% of employees in Great Britain say they use AI for work or education. Yet only 11% of businesses with 10 or more employees say more than half their workforce has received AI-related training. Staff are picking up AI faster than their employers are training them to use it.
What are the real risks?
They come down to three things.
The first is data. When someone pastes a client email, a payroll spreadsheet or a draft contract into a consumer AI tool, that information has left your control, and the tool's own terms and settings decide whether it is stored or used to train models. Your organisation is still responsible for the personal data it handles. The ICO's guidance on how to use AI and personal data, published in November 2022, is explicit that procuring an AI system from a third party does not absolve you of responsibility for complying with data protection law.
The second is accuracy. AI tools write fluently and confidently, even when they're wrong. A made-up figure, a misread policy or a summary that drops the key caveat can slip into a client letter or a board paper if nobody checks.
The third is judgement. AI is good at drafting and summarising. It shouldn't be deciding who gets hired, which supplier wins or how a complaint is resolved. When decisions affect people, a person needs to make them and be able to explain them.
Is Copilot safer than ChatGPT?
The tool matters less than how it's set up and who approved it. Business versions of both come with data commitments that free personal accounts don't. Microsoft states that prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models behind Microsoft 365 Copilot, and that Copilot only surfaces organisational data a user already has permission to view. OpenAI states that it does not use business data from ChatGPT Business and Enterprise to train its models by default, and workspace admins control access and how long data is kept. Your IT team or supplier can confirm exactly what applies to your licences.
So the first rule of any staff AI policy is a simple one: for work, use the tools we've approved, signed in with your work account, and nothing else.
What should an AI policy for staff include?
It doesn't need to be long. A one or two page policy that people actually read beats a twenty-page document nobody opens. A good one covers:
- Which AI tools are approved, and how to ask for a new one
- What must never go into any AI tool, such as special category data, passwords and bank details
- What can go into approved tools, and what still needs care
- Who checks outputs before they're used outside the organisation
- Which decisions always stay with people
- Who to ask when you're unsure.
The same ICO guidance takes a risk-based approach and is clear that "You must complete a DPIA when your processing is likely to result in high risk to people." If you're planning to use AI on personal data in a bigger way, that's a conversation to have with your data protection lead before you start.
Why does training matter as much as the policy?
A policy tells people what not to do. Training shows them what to do instead, and that's what changes behaviour. Staff who can't get a useful answer from the approved tool have every reason to go back to the free one that seemed to work.
Few employers have closed that gap. The Work Trend Index found only 39% of AI users had received AI training from their company, and the ONS figures above show the same shortfall in the UK.
Good training puts safe use inside every exercise rather than on a slide at the end. People practise on realistic versions of their own work, learn what to strip out before they paste anything and build the habit of checking what comes back. Once that's routine, AI stops feeling risky and starts saving time.
Where should we start?
With the people who handle the most sensitive information: HR, finance, customer service and anyone working with client files. Then widen it out to everyone else.
Our AI training for staff is hands-on and built around your own tasks and policies, for groups of up to 12, at your premises anywhere in the UK, at a venue or online. Our AI training for finance teams and AI training for HR teams go further on data protection, because those teams hold some of the most sensitive information in any organisation. For teams with Copilot licences, the natural starting point is Microsoft Copilot for Business.
DLR Media has committed to the Responsible AI Use Campaign's 10 principles, which include human oversight, transparency, privacy, security, fairness and accuracy, and we're registered with the ICO as a data controller. We hold ourselves to the same standards we teach.
Frequently asked questions
Can staff use ChatGPT at work?
Yes, if your organisation approves it and staff follow clear rules on what data goes in. Use a business plan, or Copilot within Microsoft 365, rather than free personal accounts, because that's where business data terms and admin controls apply.
Should we ban AI tools at work?
No. The 2024 Work Trend Index found that 78% of AI users bring their own tools to work, so a ban leaves you with no say over how that use happens. Approved tools, a short policy and training give you that control.
What should staff never put into an AI tool?
Personal or special category data, passwords, bank details and confidential client or commercial information, unless the tool is approved for it. Your policy should spell this out.
How long does safe AI training take?
A half day covers the essentials, with safe use built into every exercise. A full day or a short series gives more time to practise.
Get your team using AI safely
Want a session your team will actually use? Tell us which tools you have and which teams handle sensitive data. Call +44 1382 699595 or tell us about your team.
