What your employees paste into AI tools

Whatever an employee pastes into ChatGPT, Copilot or a similar tool leaves the company: depending on the tool and its settings, the text may be kept by the provider, or even reused. The simplest rule to write fits on one line: no customer data, no credentials.

What gets shared most often

• A contract or quote to summarise, with names and amounts.
• An extract from a customer file to format.
• An error message containing a password, an access key or a server address.

The rule to write

The CNIL recommends governing these uses with an internal rule that states clearly what is allowed and what is forbidden, using only business accounts, and turning off data reuse when the tool allows it. For an SME, one page is enough: the approved tools, and a ban on entering customer data, personal data and credentials.

A rule needs explaining: a few minutes in a meeting are worth more than a memo nobody reads.

To check this week

Questions about your situation? Describe my needs

Sources consulted on 19 October 2026: CNIL – Les questions-réponses de la CNIL sur l’utilisation d’un système d’IA générative (18 July 2024).
Article written by IT CyberWall.

Backup and restoration are operated by WeDoBack.