AI Governance in Practice
The short list of data that stays out of a chat tool
5 min read · Updated 2026-11-08
Name the material, not the fear
"Do not paste anything sensitive" is too vague to follow on a deadline. Write the categories your organization actually handles. For many teams that list is: personal data about customers or staff, health information, payment details, passwords and access keys, unpublished financials, and anything a contract says you must keep inside named systems.
If a category does not apply to you, leave it off. A short true list beats a long list people skim.
Say where the material may go instead
A ban without an alternative creates a workaround. If staff cannot paste a contract into a public chat tool, tell them which approved tool can summarize it, or tell them to ask a named colleague. Business accounts with terms you have read are different from a personal login. Write that difference in the same paragraph as the ban.
Exceptions should be rare and written down: who approved the paste, which tool, and why. An exception that lives only in a chat message will be forgotten.
Review the list when the tools change
Add a line when you adopt a tool that is allowed to hold a category you used to ban. Remove a line when you stop using a system. Read the page twice a year with the people who actually paste things. If they are surprised by a rule, the rule was not where they work.
This is general education, not legal advice. Privacy duties depend on the kind of data and on the countries involved.
This article is general education, not legal advice. ComplianceEU Alliance is an independent private initiative, not a regulator or certification body.