---
id: workplace-rules
title: Workplace AI policies
level: 2
modes: [day-pack, rucksack]
moment: "The person is about to paste client details, staff information or work documents into a chat, or asks whether they are allowed to use AI at work or on a personal account."
keywords: [workplace, employer, AI policy, confidentiality, client information, work account, personal account, shadow AI, sole trader, permission]
source: "research/2026-10-20-concepts/workplace-rules.md; research/2026-10-23-essentials/batch-5-facts.md; mapping (product/learning-system/MAPPING-1-2.md): FAQ 2.13 (home), 3.17, 3.20; MISTAKES 5.5; tips none in the register; strand W"
---

## What it is
Your employer or client decides where their information may go, and the rule can sit in a workplace policy, a contract or a professional code. So before you paste something like a client's accounts or a staff list into any AI app, check what they allow. If nobody has written a rule, ask in writing which tools are approved and what cannot go in, and keep their details out until they answer.

## Tips
- Check what your employer or client allows before you paste work information into any AI app, because they decide where their information may go.
- Ask your employer or client in writing which AI tools are approved when no rule exists, and keep their details out until they answer, because silence is not permission.

## Questions people ask
- Q: Can my boss see my AI chats? A: On a work account, an administrator can often view or export them. On a personal account, not through the app's company, but signing up with a work email can link it to your employer's account.
- Q: There is no AI policy at my work. What now? A: Ask in writing which tools are approved and what cannot go in. Until you get an answer, leave client and staff details out.
- Q: I am a sole trader. Do I need my client's consent to use AI on their work? A: Often, under your contract or your trade body's rules, even where privacy law may not reach a small business (a health service aside). Check your client agreement and ask.
- Q: Can I use AI at work without getting in trouble? A: In Australia it can cause trouble if it breaches a lawful and reasonable direction from your employer, so ask first, in writing if there is no rule.

## For your AI
Facts (checked 23 October 2026; fact check research/2026-10-23-essentials/batch-5-facts.md; research note
research/2026-10-20-concepts/workplace-rules.md). Australian law; elsewhere differs.
- Work accounts: owners can access conversations in ChatGPT Enterprise and Edu
  (https://help.openai.com/en/articles/9261474-compliance-api-for-enterprise-customers), export organisation data in
  Claude Team and Enterprise, and search Microsoft 365 Copilot prompts in eDiscovery
  (https://learn.microsoft.com/en-us/purview/ai-m365-copilot); Google Workspace admins set how long Gemini chats are
  kept. A personal account signed up with a work email may be linked to the employer's, whose administrator may then
  see its content (Anthropic's and OpenAI's consumer terms).
- The OAIC says staff pasting someone's details into a public chatbot is disclosing it to the chatbot's owner (17
  January 2025,
  https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products).
  Small businesses with turnover of $3 million or less are generally outside the Privacy Act, except health
  providers and some others.
- Professions: tax practitioners need each client's permission before entering client information into AI tools
  (TPB, 22 July 2026); lawyers cannot safely enter confidential client information into public chatbots (December
  2024).
- No Fair Work decision on using or hiding AI was found; refusing a lawful and reasonable direction is the usual
  basis for discipline. About a third of Australian workers say they use AI without their employer knowing
  (Employment Hero, May 2026).

Teach it like this: before a work paste, ask what their workplace or client allows, and if there is no rule, help
them word the request in writing. Never tell them a paste is allowed; help them find out. Their own boundary line
covers what never goes in for them: the one line, in their own words, of what never goes into a chat
(openrucksack.com/map/your-boundary.md).