{"guide":{"slug":"staff-are-using-public-ai","title":"Our staff are already using public AI. What do we do first?","description":"What leadership should decide in the first week when staff paste work into public AI tools: which accounts, what already went out, and what the rule is.","reviewed":"2026-10-25","published":"2026-10-25","services":[{"label":"Governance","href":"https://idg.consulting/services/#service-governance"},{"label":"Training","href":"https://idg.consulting/services/#service-training"}],"sections":[{"heading":"Assume it is already happening","body":"If your firm has not given staff an AI tool, some of them have picked their own. In a 2025 study by the University of Melbourne and KPMG, 48% of employees said they had uploaded company information, such as financial, sales or customer information, into public AI tools. 57% said they had used AI in ways they did not disclose, such as presenting AI output as their own work. The survey covered more than 32,000 employees in 47 countries and was anonymous; the authors say the figures may still under-report.\n\nThe same study found that 34% of employees reported a policy guiding generative AI at work, 6% a ban, 41% no policy and 19% did not know.\n\nThis guide is for the owner or managing partner who has to act on that. It sets out what decides where the data went, the order we would take the first steps in, and what the professional rules ask of law firms and tax preparers. It is not legal or tax advice. Where a rule applies to your firm, your counsel or ethics adviser decides how."},{"heading":"The account decides what happens to the data","body":"The same product name covers two sets of terms. A consumer account that a person signs up for with a personal email runs under consumer terms. A business account the firm pays for and administers runs under business terms. What the vendor does with a pasted client file depends on which one was used.\n\nHere is what each vendor's own pages said when we checked them on 2026-10-25. Vendors change these pages often, so check them again before you rely on them.\n\n- OpenAI: \"When you use our services for individuals such as ChatGPT, Sora, or Operator, we may use your content to train our models.\" On Free, Plus and Pro, \"data sharing is enabled by default\" until the user turns off \"Improve the model for everyone\". OpenAI also says that by default it does not use content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces to train its models.\n- Anthropic: consumer users of Claude Free, Pro and Max choose whether their chats are used for training. If they allow it, data may be kept in de-identified form for up to 5 years. For commercial products such as Claude for Work and the API, Anthropic says it will not use inputs or outputs to train its models by default.\n- Microsoft: when organizations use Copilot, Microsoft says \"the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models\", under Microsoft's Data Protection Addendum with Microsoft acting as a data processor. For the updated consumer Copilot app available since 2026-08-18, Microsoft also says prompts, responses and file contents \"aren't used to train foundation models\", but a personal account runs under the Microsoft Services Agreement and the Copilot Terms of Use, not the business addendum. Microsoft's FAQ for the older consumer app says that, except for certain categories of users and those who opted out, it uses Copilot conversations for AI training.\n- Google: the consumer Gemini app says human reviewers read some chats and asks users not to enter \"confidential information that you wouldn't want a reviewer to see\". For Gemini used with a qualifying edition of Google Workspace, Google says content is \"not human reviewed or otherwise used for Generative AI model training outside your domain without permission.\"\n\nTwo things follow. First, an employee on a personal ChatGPT Plus account and a colleague on the firm's ChatGPT Business workspace are using \"the same tool\" under different terms. Second, a personal account that does not train, by default or by setting, is still a personal account. The firm has no administrator, no contract of its own with the vendor and no record of what was pasted. Opt-outs also have exceptions. OpenAI says that if a user gives thumbs-up or thumbs-down feedback, \"the entire conversation associated with that feedback may be used\" for training, and its temporary chats may be kept for up to 30 days for safety. Anthropic stores the whole conversation for up to 5 years when a consumer user gives feedback."},{"heading":"Day 1 and 2: find out which tools and which accounts","body":"We start by asking. Ask every person which AI tools they use for work, whether on a personal or a work account, and what kind of material they put in. Say in writing that honest answers will not be punished. You want the truth more than you want a culprit.\n\nA survey alone will under-count, given how many people in the Melbourne and KPMG study said they hid their use. So ask your IT lead, in parallel, to pull what they can already see: web or DNS logs for AI sites, sign-ups to AI services with work email addresses, browser extensions, and AI features switched on inside software the firm already pays for.\n\nNIST's voluntary profile for generative AI recommends the same first move in its own words: \"Enumerate organizational GAI systems for incorporation into AI system inventory\" and \"Inventory all third-party entities with access to organizational content\". The result should be one list: tool, account type, who uses it, and for what."},{"heading":"Day 2 and 3: decide what has already gone out","body":"Some of what you find will be harmless. Some will be a client file, a tax return, a personnel record or a draft deal document in a personal account. For each of those, write down the tool, the account type, the date and the kind of data. Every step is written down, including this one.\n\nDeleting the chat does not undo what the vendor keeps. Retention depends on the account and its settings. On Google's consumer Gemini app, chats with Keep Activity off are kept for 72 hours, and chats a reviewer has read are kept for up to 3 years. Anthropic may keep consumer data for up to 5 years when training is allowed. Feedback and safety flags can extend retention on some services.\n\nWhether a paste is a reportable incident is a question for counsel. Client contracts, professional rules and breach-notification law can each require notice, and this guide does not cover notification duties. For tax preparers, the regulation discussed below is directly in play. The IRS Office of Professional Responsibility tells tax firms to \"Prepare clear procedures for handling breaches or errors\". That is good practice for any firm."},{"heading":"Day 3 and 4: give people an approved tool before you take one away","body":"In our view, a ban with nothing in its place pushes use out of sight. In the Melbourne and KPMG study, uploading sensitive company information to public tools and similar behaviors were reported by 67% of employees whose organization banned generative AI, against 33% where there was no policy. That is a correlation. It does not show that bans cause leaks, and firms with more sensitive data may also be more likely to ban. The authors still read it as a sign that \"outright bans may be ineffective\".\n\nOur view is that the first week should end with one approved tool on a business account, configured before anyone is told about it. The firm may already pay for one inside Microsoft 365 or Google Workspace. Configuring it means the administrator settles, in writing:\n\n- who can use it, signed in with work accounts;\n- how long chats are kept;\n- whether staff can send feedback to the vendor;\n- which internal systems it can connect to;\n- where its usage records live and who reviews them.\n\nA business account is necessary and is not the whole answer. Defaults vary. On Claude Enterprise, for example, Anthropic says \"data is retained indefinitely unless a custom retention period is set\", and projects are kept indefinitely by default. Connectors also widen what the tool can read. Our rule here: nobody reaches anything through AI they couldn't already open.\n\nIf the bigger question is whether a business account is enough or whether the system should run somewhere you control, [Where your AI should run](/guides/where-your-ai-should-run) covers that decision."},{"heading":"Day 4 and 5: publish a one-page interim rule","body":"Write one page, mark it interim and put a review date on it. A long policy can follow. A short rule people read this week does more than a long one nobody opens. In our view it should say:\n\n- which tool or tools are approved, and that personal AI accounts are not used for firm work;\n- which kinds of data do not go into any unapproved tool: client-identifying material, tax return information, personnel files, passwords and credentials, and unreleased financials;\n- that a person reviews any AI output before it leaves the firm, because a person approves anything consequential;\n- who to ask, and who to tell after an accidental paste, with a promise that reporting it is the right move;\n- that it applies to contractors and temporary staff too.\n\nThe rule is the firm's decision, owned by leadership. NIST's generative AI profile lists acceptable use policies among its governance actions, and both ABA Formal Opinion 512 and the IRS guidance below expect the firm to set one."},{"heading":"Law firms: what ABA Formal Opinion 512 asks of the firm","body":"The American Bar Association's Formal Opinion 512, issued on 2024-07-29, applies the ABA Model Rules of Professional Conduct to generative AI. The ABA says the Model Rules \"serve as models for the ethics rules of most jurisdictions\", but your lawyers answer to your state's own rules and ethics opinions. Ask your state bar's ethics counsel or your firm's ethics partner how those treat AI.\n\nThe parts that land on the managing partner:\n\n- Confidentiality. \"Before lawyers input information relating to the representation of a client into a GAI tool, they must evaluate the risks that the information will be disclosed to or accessed by others outside the firm\".\n- Consent for self-learning tools. Because many such tools could reveal client information through their output, \"a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool.\" The opinion adds that \"general, boiler-plate provisions to engagement letters\" are not sufficient. Using a tool for idea generation without client information does not need consent.\n- Supervision. \"Managerial lawyers must establish clear policies regarding the law firm's permissible use of GAI, and supervisory lawyers must make reasonable efforts to ensure that the firm's lawyers and nonlawyers comply\".\n- Training. The opinion says it \"could include the basics of GAI technology, the capabilities and limitations of the tools, ethical issues in use of GAI and best practices for secure data handling, privacy, and confidentiality.\"\n- Vendors. Drawing on earlier opinions about cloud computing and outsourcing, it says lawyers should, among other checks, ensure a tool is \"configured to preserve the confidentiality and security of information\" and determine whether it retains information or \"asserts proprietary rights\" to it.\n\nAn associate who pastes a draft settlement into a personal chatbot account touches all of these at once. In our view, the first week above is a start on the supervision duty. Whether the firm needs client consent for its approved tool is a separate call for your ethics adviser."},{"heading":"Tax preparers: section 7216 covers everyone who works on a return","body":"Internal Revenue Code section 7216 and its regulations at 26 CFR 301.7216 govern how preparers disclose or use tax return information. The regulation's definitions are wide:\n\n- \"Tax return information\" includes \"a taxpayer's name, address, or identifying number\" and anything furnished in connection with preparing a return.\n- \"Disclosure\" means \"the act of making tax return information known to any person in any manner whatever.\"\n- An employee of a preparer who, as part of the job, performs services that assist in preparing a return counts as a tax return preparer. That reaches the junior staff member, not just the signing preparer.\n\nThe penalties, as the regulation states them: a criminal misdemeanor with up to 1 year in prison, a fine of up to $1,000, or both; and a civil penalty of $250 for each prohibited disclosure or use, up to $10,000 a calendar year.\n\nThere are permitted routes, and none is automatic. The regulation allows disclosure to a contractor for \"programming, maintenance, repair, testing, or procurement of equipment or software\" used for return preparation, to the extent the contracted service needs it, and on condition that each person who receives the information gets a written notice. Outside the exceptions the regulation lists, the taxpayer's written consent is needed, with specific required contents, and the regulation says there is \"No retroactive consent\". A consent obtained next month does not cover a return pasted into a chatbot last month.\n\nIn June 2026 the IRS Office of Professional Responsibility issued guidance on AI in tax practice. It says \"Practitioners must strictly handle all client data using only secure, enterprise-approved AI\" and that firms must put AI policies and procedures in place under Circular 230 section 10.36, including \"Comprehensive training on use of AI\", vetting of third-party tools, and \"all steps and processes documented\". The guidance does not say how the contractor route or consent applies to any particular AI vendor. Ask your tax counsel which route your approved tool falls under before return data goes into it."},{"heading":"Day 5: brief everyone, and put the consent question on the agenda","body":"Hold one short session for the whole firm. Show the difference between a personal account and the firm's account on screen, walk through the one-page rule, and say again how to report a mistake. A policy file in an inbox does less. Adoption is most of the work.\n\nThen leadership makes one decision and writes it down. For client data in AI tools, the firm will do one of three things for now:\n\n- keep client data out of AI tools entirely while the approved tool is reviewed;\n- use the configured business tool under an analysis counsel has signed off, such as the section 7216 contractor route for a tax practice;\n- ask clients for informed consent first, in the form the applicable rules require.\n\nEach is defensible in the right firm. Not deciding is the risky option, because staff will decide for you."},{"heading":"After the first week","body":"The first week stops the worst exposure and gives people a safe place to work. The rest is slower:\n\n- a fuller policy that replaces the interim page;\n- a written review of each approved vendor against the checks ABA 512 lists, such as retention and proprietary rights;\n- data-loss and browser controls where the IT lead judges them worth it;\n- training by role, repeated as the tools change;\n- a quarterly recheck of every vendor page you relied on, since several cited here changed in 2026.\n\nOnce staff are on a safe tool, the next question is usually which tasks deserve more than a chat window. [Is anything worth building](/guides/is-anything-worth-building) covers how to decide that."}],"sources":[{"title":"Trust, attitudes and use of artificial intelligence: A global study 2025 (University of Melbourne and KPMG)","url":"https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf","date":"2025-04-29"},{"title":"OpenAI: How your data is used to improve model performance","url":"https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/","date":"2026-03-13"},{"title":"OpenAI Help Center: Data controls in ChatGPT","url":"https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt","date":"2026-10-25"},{"title":"Anthropic: Updates to Consumer Terms and Privacy Policy","url":"https://www.anthropic.com/news/updates-to-our-consumer-terms","date":"2025-08-28"},{"title":"Anthropic Privacy Center: Is my data used for model training? (consumer)","url":"https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training","date":"2026-03-16"},{"title":"Anthropic Privacy Center: Is my data used for model training? (commercial)","url":"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training","date":"2026-08-18"},{"title":"Anthropic Privacy Center: How long do you store my data?","url":"https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data","date":"2026-07-01"},{"title":"Anthropic Privacy Center: Configure custom data retention controls for Enterprise plans","url":"https://privacy.claude.com/en/articles/10440198-custom-data-retention-controls-for-claude-enterprise","date":"2026-10-23"},{"title":"Microsoft Learn: Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection","date":"2026-08-18"},{"title":"Microsoft Support: Microsoft Copilot for individuals: your data, privacy, and responsible AI","url":"https://support.microsoft.com/en-us/privacy/microsoft-copilot/overview","date":"2026-08-18"},{"title":"Microsoft Support: Microsoft Copilot for individuals: your activity history","url":"https://support.microsoft.com/en-us/privacy/microsoft-copilot/activity-history","date":"2026-08-18"},{"title":"Microsoft Support: Privacy FAQ for Microsoft Copilot (older app)","url":"https://support.microsoft.com/en-us/topic/privacy-faq-for-microsoft-copilot-27b3a435-8dc9-4b55-9a4b-58eeb9647a7f","date":"2026-08-31"},{"title":"Google: Gemini Apps Privacy Hub","url":"https://support.google.com/gemini/answer/13594961","date":"2026-10-23"},{"title":"Google: Generative AI in Google Workspace Privacy Hub","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub","date":"2026-10-22"},{"title":"NIST AI 600-1: Artificial Intelligence Risk Management Framework, Generative Artificial Intelligence Profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","date":"2024-07-26"},{"title":"ABA Formal Opinion 512: Generative Artificial Intelligence Tools","url":"https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf","date":"2024-07-29"},{"title":"ABA: Model Rules of Professional Conduct","url":"https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/","date":"2026-10-25"},{"title":"26 CFR 301.7216-1: Penalty for disclosure or use of tax return information","url":"https://www.ecfr.gov/current/title-26/part-301/section-301.7216-1","date":"2026-10-22"},{"title":"26 CFR 301.7216-2: Permissible disclosures or uses without consent of the taxpayer","url":"https://www.ecfr.gov/current/title-26/part-301/section-301.7216-2","date":"2026-10-22"},{"title":"26 CFR 301.7216-3: Disclosure or use permitted only with the taxpayer's consent","url":"https://www.ecfr.gov/current/title-26/part-301/section-301.7216-3","date":"2026-10-22"},{"title":"IRS Office of Professional Responsibility, Issue Number 2026-19: Introductory Guidelines for Responsible AI Use in Federal Tax Practice","url":"https://www.irs.gov/pub/opr-taxpros/issue-number-2026-19-introductory-guidelines-for-responsible-ai-use-in-federal-tax-practice.pdf","date":"2026-06-24"}]},"session":null}