AI Never-Share Policy: Set Clear Data Boundaries

A “never share” rule should name the information that cannot be entered into unapproved AI tools and explain what to do instead. The exact boundary depends on the tool, contract, data, and work being done.

Start with these categories for review:

• Passwords, recovery codes, authentication tokens, and private keys.
• Personal, medical, financial, or child-related information.
• Client or employee information covered by confidentiality, privacy, or contract requirements.
• Internal strategy, non-public financials, and security details.

For each category, name the approved tool or workflow, permitted data, reviewer, and escalation path. Redact examples before using them in a public tool. AI output that would send messages, change records, approve a request, or move money should require an authorized person to review and confirm the action.

Do not paste sensitive material into a tool solely because its interface is convenient. If you do not know its data-use terms or whether the organization has approved it, pause and ask the responsible owner. This is a starting policy checklist, not a determination that a particular tool or use complies with a law or contract.