What never goes in
Every business needs a short list of things that never go into a general-purpose AI tool. Short, specific and written down, because a vague rule is the same as no rule.
Why “be careful” fails
“Use your judgement with confidential information” gives a receptionist under pressure at 4:55pm nothing to work with. A list of five specific things they must never paste in does, and it takes about twenty minutes to write.
The categories that are almost always on it
- Identifiable records about the people you serve — patients, clients, participants, tenants.
- Anything that identifies a person indirectly: rare conditions, small-town detail, combinations that narrow to one household.
- Credentials, access codes and account details, including in screenshots.
- Material you hold under someone else's confidentiality terms, which is often tighter than privacy law.
- Work where a wrong output is a regulated harm: clinical decisions, advice, safety sign-off, tax positions.
De-identification that survives a bad day
A rule only works if it's faster than breaking it. The version that holds up is a habit: roles instead of names, ranges instead of dates, the detail that makes the document useful without the detail that makes it identifiable. We practise it on the business's own documents until it's automatic.
Assume it's already happening
In most businesses we look at, someone is already pasting things in on a free account. The useful response is a rule and a tier decision, not an investigation — and the audit part of an engagement is designed to find out without turning into a disciplinary process.
Where this sits
The never list is the personal-behaviour half. The organisational half is your team's AI policy, and the vendor half is tiers and what happens to your data. All three are short documents.
What this module covers
The boundary, written in the terms of your own documents rather than as generic categories. Generic lists get nodded at and ignored; a list that names the actual file types people handle gets followed.
- Which account and which tier, named — the fact that matters more than the brand.
- What never goes in, using your documents as the examples.
- What can go in once it's de-identified, and how to do that properly rather than by deleting a name.
- The reframe that resolves most objections: the majority of time-sink work involves no client information at all.
- What to do about the six months before there was a rule.
What someone can do afterwards
Knows, without asking, whether the thing in front of them can go into a tool — and knows who to ask about the cases the rule doesn't cover.
Where it sits in the order
First, in any regulated setting. In allied health, legal, conveyancing and NDIS work this module is the product, and everything else is easier once it's settled.
Where this module stops
It is not legal advice and it doesn't certify compliance. Where your obligations turn on professional rules we name what needs checking and who should check it. Clinical privacy content should be reviewed by someone qualified in your field, and we say so before the engagement rather than during it. The free version of the content is on the never list guide.
The questions we get asked about this
Our information is confidential. Does that rule us out?
Almost never. Most of the work costing your team time — tenders, policies, induction material, standard explanatory letters, reports from de-identified inputs — involves no client information at all. That reframe is usually where the conversation turns.
What if someone has already put client material in?
You establish which account, roughly when and what kind of document, fix the setting, write the rule and move on. Handling it as misconduct guarantees you never hear about the next one.
Get a training plan built for your business. Nine questions about how your business actually runs. You get a plan ordered for your work, a reading on where you're exposed, and one clear place to start. No account needed. Build your plan.
Start an enquiry