Can your team use AI with customer information safely?

Short answer: yes, with conditions, and the conditions are more about process than technology.

This is general information only. It isn’t legal advice, and if your industry has its own regulator or licensing rules, those come first.

What you actually need to think about

Three things sit behind every question about AI and customer information.

Privacy. Many Australian businesses are covered by the Privacy Act and the Australian Privacy Principles. Plenty of small businesses are exempt, with exceptions depending on turnover and what you do, so it’s worth checking where you sit. Either way, putting a customer’s details into a third-party tool is sharing that information, and your customers expect you to be careful with it.

Getting it wrong at scale. AI tools can produce confident, plausible, wrong output, and the same wrong answer sent to two hundred customers quickly becomes a business problem.

Records. If a quote, decision or piece of advice was shaped by something in a chat window that nobody kept, you can’t show how you got there if it’s ever questioned.

Three questions before any tool touches customer data

Ask these of every product, and get the answers from the vendor in writing.

1. Where is the data processed and stored? In Australia, overseas, or both, and which countries.
2. Is our information used to train their models? The answer should be no, by default. Business and enterprise versions of the major tools generally say no. Free and personal versions often say yes.
3. How long is it kept, and can we delete it? Short retention for abuse monitoring is common. Indefinite retention with no way to delete it is a red flag.

If a vendor can’t answer all three plainly, that tells you what you need to know.

What’s generally safe today

Tidying up things you wrote. Tightening an email, turning notes into a proper message, adjusting the tone. You supplied the substance and you check the result.

Summarising documents for internal use. A long contract, spec or policy boiled down into the points that matter, as a working note for your team. It informs your decision and stays internal.

Pulling details out of documents, with a human check. Taking the key figures from a supplier quote or plan into a table. It saves real time, and it does get things wrong, so the check isn’t optional.

Answering internal “how do we do this” questions. A tool working from your own written procedures, answering the questions your team would otherwise ask each other.

Meeting notes. With the other person’s knowledge, handled the same way you’d handle any recorded call.

What isn’t safe yet

Anything sent automatically without a person reading it. If AI output reaches a customer unchecked, you’ve handed your judgement to a tool that can’t tell when it’s wrong.

Free and personal accounts with customer data in them. The free version of anything, a personal login, a browser extension nobody checked. This is where most of the real risk sits in small businesses, and it’s almost always well-meaning staff trying to save time.

Sensitive information. Health details, financial records, anything under a confidentiality agreement. The upside is small and the downside is big.

The one-page policy, which is the actual work

Most businesses have an understanding about AI. Very few have it written down. A single page turns that understanding into something your team can follow.

It covers seven things:

• Which tools are approved, by name and account type. “ChatGPT” isn’t specific enough. “The company’s ChatGPT Business account” is.
• What can go in. Be concrete. Public documents and your own templates, yes. Customer names, addresses, financial details, no, unless the tool is approved for it.
• What must never go in, whatever the tool. Passwords, confidential agreements, sensitive information.
• Who checks the output, and the rule that nothing reaches a customer unread.
• What gets kept on file. If AI output shaped a decision, save it with the job or customer record.
• What to do when something goes wrong. Who to tell, and a clear statement that speaking up won’t get anyone in trouble. Punishing mistakes gets you silence.
• When it gets reviewed. Put a date on it. Six months is realistic.

Then do the part that matters most: take twenty minutes and walk the team through it. A policy nobody has read doesn’t change anything.

Start with what your team already uses

If you haven’t got a policy, your team is already using these tools. They’re trying to get through a busy day.

Ask, with no consequences attached, what people are using and for what. You’ll find the genuine time savings and your actual risk in the same conversation. A ban just produces the same use with less visibility.

Where this leaves you

The businesses handling this well decided what’s allowed, wrote it on a page, gave the team a safe tool, and kept a person in front of every customer-facing output.

That’s a week of thinking and an afternoon of writing. The free Business Systems Scorecard includes four quick questions on AI and customer data if you want to see where you stand.