Generative AI can save a small business real time: drafting first versions, turning rough notes into clearer copy, creating meeting agendas and helping teams think through routine work. The danger begins when “use AI sensibly” is the only rule staff receive. In a busy business, somebody will eventually paste a customer email thread into a public chatbot, upload a supplier contract for a summary, or connect an AI assistant to a mailbox without checking what it can read.
That is not necessarily a technology failure. It is a classification failure. People need a fast, practical answer to one question before they type, attach, record or connect anything: what kind of information is this, and which AI environment—if any—is approved for it?
A “Do Not Paste” list turns a vague fear of data leakage into a repeatable decision. It gives every employee a traffic-light system for prompts, files, meeting transcripts and connected apps. It also helps founders allow useful, low-risk AI work rather than forcing staff towards unapproved workarounds.
This matters because business data is a genuine operational asset, not just an IT concern. The UK Business Data Survey 2026, based on fieldwork with 4,450 UK businesses between October 2025 and January 2026, examines how firms use, share and protect digitised data. For a small company, the most useful starting point is simple: treat AI as another route by which information can leave, be processed or be retained outside your direct control.
Start with the right goal: safer use, not an unrealistic ban
A blanket “no AI” policy is rarely durable. Staff may already use AI features embedded in office software, search tools, CRM systems, transcription platforms, design products and browsers. A total ban can drive activity onto personal accounts, leaving the business with less visibility and fewer safeguards.
Instead, define a narrow safe lane. Allow approved tools for genuinely low-risk tasks, make red-line information unmistakable, and create a simple route for people to ask when a task sits in the middle. The policy should apply whether the AI tool is free, paid, built into another product, accessed through an employee’s personal account or presented as an “agent” that can connect to company systems.
The UK Government’s guidance to civil servants offers a useful principle for any founder: do not put sensitive information or personal data into web-based generative AI tools where compromise or loss could cause harm. It also stresses that convincing AI output still needs human judgement and fact-checking. Read the guidance here.
Your Do Not Paste list is not a substitute for UK GDPR compliance, contractual confidentiality or cyber security controls. It is the everyday behaviour layer that makes those obligations easier to follow.
Build the list around four information families
Do not begin with individual documents. Begin with the types of information the business holds. Most SMEs can create an effective first version around four families: customer information, employee information, financial information and commercially sensitive information. Add credentials and security information as a fifth, always-red family.
Customer information
This includes obvious personal data such as names, email addresses, phone numbers, delivery addresses, account numbers and recordings of calls. It also includes less obvious material that can identify a person in context: a complaint history, a detailed order, a support ticket, a customer’s location, a unique job description or a small combination of facts that makes the person recognisable.
Take particular care with information about health, ethnicity, religion, political views, trade union membership, biometrics used for identification, sexual life or sexual orientation. The ICO explains that these are special category data and need extra protection. Criminal-offence information has separate protections too. See the ICO’s explanation of special category data.
A customer’s name is not the only risk. “Summarise this difficult complaint from the owner of the vegan café on Market Street who ordered our £8,400 package last Tuesday” may identify someone even if the name has been removed. Pseudonymising data by replacing a name with “Customer A” is not the same as anonymising it if your business can readily reconnect the details.
Employee and candidate information
HR material is especially tempting to paste into AI because it is text-heavy. That does not make it appropriate for a public tool. Treat CVs, interview notes, performance reviews, sickness absence details, grievances, disciplinary records, payroll information, right-to-work documents and workplace investigation notes as red by default.
Even a request such as “make this performance feedback kinder” may expose confidential employment information. A safe alternative is to ask for a generic template: “Create a constructive performance-feedback structure covering expectations, evidence, support and review dates.” The manager can then complete it without putting the individual’s details into an unapproved system.
Financial information
Financial data is not limited to card numbers. Your list should cover bank account details, payment records, invoices that identify customers or suppliers, payroll, tax returns, VAT workings, management accounts, cash-flow forecasts, funding applications, debt information and pricing models.
Some figures can move from red to amber only after careful aggregation. For example, an approved AI tool might help explain a fictionalised cash-flow scenario with rounded figures and no customer, supplier or bank details. It should not receive a live spreadsheet exported from accounting software merely because the task is “summarise the numbers”.
Commercially sensitive information
This category protects the information that gives your business its edge or binds it to commitments. Include non-public strategy, product roadmaps, unreleased marketing plans, bids and tenders, supplier terms, client contracts, legal advice, acquisition discussions, pricing negotiations, formulas, designs, source code, research, sales pipeline detail and internal board papers.
Commercially sensitive does not always mean personal data. It can still be harmful to disclose. A prompt revealing a planned price rise, the precise weakness in a supplier relationship or the terms of a pending deal may be damaging even if no individual is named.
Credentials, security and access information
Make this category unequivocally red. Never paste passwords, API keys, access tokens, recovery codes, private keys, configuration files containing secrets, customer database exports, vulnerability reports, security logs with identifying details or diagrams that reveal how a system can be accessed.
Developers should be able to use AI for general coding help, but must use synthetic examples with fake data and remove secrets. The government’s own guidance highlights the risk of revealing code or system information that should not be public, including details of an application’s security posture.
Turn classification into a traffic-light prompt system
The label must lead to an action. A three-colour model is easier to remember than a long legal policy and can appear in onboarding, browser bookmarks, team handbooks and AI-tool guidance.
Green: public, generic and low-risk
Green content may be used in an approved AI tool, provided the task itself is sensible and the output is checked. Typical examples include publicly available web-page text, published product descriptions, generic job-description structures, standard meeting-agenda formats, fictional scenarios, non-confidential brainstorming and public regulatory material.
Green does not mean “publish the answer without review”. AI can be inaccurate, omit context or make up sources. Staff should verify facts, calculations, citations, brand claims and legal or technical assertions before relying on the output.
Amber: use only in an approved, configured environment
Amber is information that is internal or potentially sensitive but may be suitable for a specific approved enterprise tool after the business has assessed the use case. Examples might include an internal procedure with customer details removed, aggregated sales trends, a sanitised meeting summary, non-production code without credentials, or a draft policy that is not commercially market-moving.
Amber requires conditions, not optimism. The tool should be on the approved register; the account must be a company-managed account; access should be limited to people who need it; and the supplier’s contractual, retention, security, data-location and training-use terms must have been reviewed for that use. If personal data is involved, confirm the lawful basis, transparency information, processor arrangements and any transfer requirements. The ICO’s international transfers guidance is a sensible starting point where data may be accessed outside the UK.
Amber should also come with a minimisation rule: remove names, direct identifiers, unique reference numbers, unnecessary dates, addresses and free-text detail before use. Only include the minimum information needed to complete the task.
Red: do not paste, upload, dictate or connect
Red content must not enter public or unapproved third-party AI services. This includes all special category data, employee case files, identifiable customer records, bank and payment details, confidential contracts, legally privileged advice, secrets, credentials, live exports and sensitive commercial strategy.
Crucially, “do not paste” is wider than the chat box. It means do not upload the file for summarisation, dictate the material into an AI note taker, add it to a custom knowledge base, use it to train a bot, or authorise an AI agent to retrieve it through an app connection. A person may never copy a red document into a prompt, yet still expose it by granting a tool access to SharePoint, Google Drive, email, a CRM or an accounting platform.
Apply the same rules to prompts, files, transcripts and connected apps
Employees often assess only what they type. Founders should make the four routes explicit.
- Prompts: A short question can disclose a great deal. Replace named, factual scenarios with generic or fictional ones wherever possible.
- Files: Assume an uploaded spreadsheet, PDF, slide deck, image or audio file may contain metadata, comments, hidden tabs, tracked changes or more information than the selected passage suggests. Classify the whole file, not only the visible paragraph.
- Transcripts: Meeting recordings can capture names, personal circumstances, client negotiations, commercial decisions and informal remarks. Do not enable automatic recording or AI summaries by default for sensitive meetings. Decide in advance whether the meeting may be recorded, who will receive the output and where it will be stored.
- Connected apps: Treat permissions as data sharing. Before connecting an AI assistant to email, calendars, drives, CRM, HR, finance or helpdesk systems, identify exactly what it can read, write, search, export and retain. Start with read-only, least-privilege access and a small pilot group.
The National Cyber Security Centre advises organisations to establish whether processing happens inside their own system, the supplier’s system or a third-party platform; whether data is stored by the vendor; where it is hosted; and what protection applies in transit. Its guidance on dealing with data is directly relevant to AI procurement, even for a small firm.
Create a short approval process for exceptions
A red label should not make useful innovation impossible. It should trigger a controlled exception process. For example, a law firm may want an approved private environment to search its own precedent bank, or a recruitment business may want AI assistance with candidate documents. These are not ordinary “paste it into a chatbot” tasks. They need a documented use case, appropriate technical and contractual controls, and professional advice where necessary.
Keep the process proportionate. Ask the requester to state the business purpose, data categories, tool, proposed inputs, users, expected output, retention period, access permissions, supplier location and what happens if the tool makes an error. The owner of data protection or information security can then decide whether the request is declined, redesigned using anonymised data, approved with controls, or needs a formal data protection impact assessment.
The ICO provides an AI and data protection risk toolkit for organisations assessing risks to people’s rights and freedoms. For higher-risk processing, do not treat a traffic-light label as a replacement for a proper DPIA.
Make the list usable on a Monday morning
The best policy fits on one page. Put a decision check above the traffic lights: “Would I be comfortable sending this exact information to an external supplier, and have we approved that supplier and purpose?” If the answer is no or uncertain, do not proceed.
Give people approved alternatives. Supply prompt templates that use placeholders, a secure internal place for sensitive analysis, a named person for fast decisions and a route for reporting mistakes without blame. Training should use examples drawn from each team: sales, HR, finance, operations and development. Employees are more likely to follow rules when they can see how they apply to the documents on their desk.
Review the list every quarter and whenever you introduce a new AI tool, switch supplier, enable a new integration or change the type of information the business processes. Government guidance notes that off-the-shelf generative AI tools may require additional guardrails, such as pre- and post-prompt filters, alongside testing and monitoring. The UK Data and AI Ethics Framework also recommends data minimisation, human oversight and ongoing evaluation.
Conclusion: make the safe choice the easy choice
A Do Not Paste list is not about treating every employee as a risk. It is about recognising that good people make fast decisions with the tools placed in front of them. Clear classification gives them a practical way to protect customers, colleagues and the commercial value they help create.
Start this week: list the AI tools already in use, identify your four information families, publish green, amber and red examples, and name the person who can approve an exception. Then train the team to pause before every prompt, file upload, transcript and app connection. That small habit can turn AI use from an uncontrolled data-leakage concern into a capability your business can use with confidence.
