Hands holding a private handwritten letter over a folder stamped “Personal & Confidential,” next to a padlock and a “Check Before You Share” card.

Sub-Module 2.1

Before You Paste

Pasting information into an AI system is an action with consequences. What you put in may be stored, logged, used for training, or seen by others depending on the tool, account type, and organizational agreement.

Generally safer to paste

  • Public information
  • Generic drafts
  • Synthetic examples
  • Non-confidential text already cleared for external sharing

Not safe without approval

  • Personal data
  • Financial data
  • Secrets and proprietary material
  • Regulated data
  • Legal filings
  • Medical records
  • HR decisions
  • Compliance records
Rule: If you would not post it in a public forum, do not paste it into an AI system until you understand the vendor, account type, data retention policy, and your organization’s approved use.
Maintenance note: Vendor data-handling policies change. Verify current policy directly with your vendor before relying on any opt-out procedure.

How to verify

Look for the vendor’s privacy policy, data processing agreement, or help documentation. The answers change — these questions do not:

  • Is my data used to train the model?
  • How long are prompts and outputs retained?
  • Who has access to them?
  • Is there an opt-out, and where is it?

EU AI Act resources provide regulatory context on data handling obligations for organizations operating in or serving European markets. See the Appendix for the primary source and a readable summary.