AI, data and processes
Is it safe to put company data into AI? What really happens to it
By the Long Lever team · 8 min read · Last checked 6 November 2026
The short answer
It can be, if you use business accounts and set a few simple rules. The main AI providers say they don't use data from their business plans to train their models by default; the real risk is staff pasting company or customer information into free personal accounts, where the settings and terms are different and the business has no control.
What actually happens to what you type into AI?
When someone types a question or pastes a document into an AI assistant, it's sent to the provider's servers, processed, and the answer comes back. What happens next depends on the account. On a business plan, the provider normally acts on your instructions, keeps your data separate, and doesn't use it to train its models unless you choose to let it. On a free or personal plan, conversations may be used to improve the models unless the user changes a setting, and the business has no say over that.
So the question isn't really whether AI is safe. It's which account your staff are using, and whether the business controls it.
Which AI assistants are businesses using, and how do they compare?
Four general-purpose assistants cover most of what a UK business needs. They're more alike than the adverts suggest; each is good at writing, summarising and analysing, and each has a business version with stronger data protection. The best choice is usually the one that fits the software you already use.
| Assistant | Best fit | Business data | Cost to think about |
|---|---|---|---|
| Microsoft 365 Copilot | Businesses already on Microsoft 365: works inside Outlook, Word, Excel and Teams, with your own files and emails | Work accounts come with Microsoft's enterprise data protection; prompts aren't used to train its foundation models | A per-user add-on on top of Microsoft 365, so it adds up quickly with a large team |
| ChatGPT Business or Enterprise | Flexible all-rounder for writing, analysis and shared team projects | OpenAI says business plan data isn't used for training by default, and admins control the workspace | Per user per month; cheaper than most bespoke tools, but only buy seats people will use |
| Claude for Teams or Enterprise | Long documents, careful writing, analysing contracts, tenders and reports | Anthropic says commercial plan data isn't used for training by default | Per user per month, similar to the others |
| Gemini for Google Workspace | Businesses on Gmail, Google Drive and Docs; also strong at images | Google says Workspace content isn't used to train models outside your organisation without permission | Included in or added to Workspace plans, depending on the plan |
Our honest view: if you're a Microsoft business, Copilot is often the favoured choice because it works where your team already does, but licensing every user can be costly. Many businesses get better value by licensing Copilot for the people who live in Outlook and Excel, and one other assistant for the few who do heavy writing or analysis. Prices and plan names change often, so check the current terms before you buy.
For a wider list, see our top 10 AI tools for small businesses.
Why are free personal accounts the real risk?
Because the business doesn't control them. When an employee uses their own free account for work, the company can't see what's been shared, can't set retention rules, can't remove access when they leave, and may be relying on a setting the employee never changed. If that information includes customer or staff details, the business is still responsible for it under UK GDPR.
This is sometimes called shadow AI, and it's common. Banning AI rarely stops it; giving people an approved business account and clear rules usually does.
What does UK GDPR mean for using AI?
UK GDPR applies to personal data whether it's in a spreadsheet or an AI tool. Your business stays the controller, so you need a lawful reason to use the data, should only use what's necessary, and need to be able to explain what you're doing with it. The Information Commissioner's Office has published guidance on AI and data protection that sets this out.
- Check the provider's terms for business data, retention and where data is stored. Some plans offer UK or European data storage.
- Sign or accept a data processing agreement with the provider. Business plans normally include one.
- Do a short data protection impact assessment before using AI with personal data at scale, especially staff or customer records.
- Update your privacy notice if AI is used in a way customers or staff would want to know about.
- Keep a person in the loop for any decision that affects someone, such as recruitment, pay or credit.
What rules should staff follow?
Keep it to one page and make it easy to follow:
- Use only the company's approved AI accounts for work, never personal ones.
- Don't paste in customer, staff or financial details unless your rules say that use is allowed.
- Never paste passwords, bank details or anything marked confidential by a client.
- A person checks anything that leaves the business.
- If you're unsure, ask before you paste.
What this won't do
This article is a practical guide, not legal advice, and provider terms change. A business account isn't a guarantee on its own: it still needs the right settings, sensible rules and someone checking the output. AI can also be confidently wrong, so it should never be the final word on anything that matters to a customer, an employee or a regulator.
Questions people also ask
Does ChatGPT use my business data to train its models?+
OpenAI says data from ChatGPT Business, Enterprise and Edu, and from its API, isn't used for training by default. Free and personal accounts are different, which is why businesses should give staff a business account.
Is Microsoft Copilot safe for company data?+
Copilot used with a work account comes with Microsoft's enterprise data protection, and prompts aren't used to train its foundation models. It also respects the file permissions you already have, so tidy those first.
Which AI is best for a small UK business?+
Usually the one that fits the software you already use: Copilot for Microsoft businesses, Gemini for Google Workspace, with ChatGPT or Claude as strong all-rounders. They're more alike than different; the account type matters more than the brand.
Do we need an AI policy?+
Yes, but it can start as a one-page rule sheet covering approved accounts, what can be shared and who checks the output. We help businesses write a fuller AI and data policy when they're ready.
Sources
- OpenAI: Business data privacy, security and compliance
- Microsoft: Enterprise data protection in Microsoft 365 Copilot
- Anthropic: Is my data used for training? (commercial products)
- ICO: Artificial intelligence guidance for organisations
Facts and rates last checked 6 November 2026. We review every article at least every six months.
About the Long Lever team
Long Lever Partnerships is a collective of business owners and operators: people who have built, run and sold businesses, some with multi-million-pound turnovers, and people who have spent their careers in the field. We have no software to sell and no commission from any provider.
We guide, you build and own it.
Want to know where this fits in your business? The free discovery check takes a few minutes, and the first conversation costs nothing.