Is your team pasting customer details into ChatGPT?

Someone on your team has probably used ChatGPT this week. Maybe to tidy up a quote, reply to a grumpy customer or summarise a long email. That’s smart: it saves time. But if they pasted in a customer’s name, phone number or invoice to do it, your business may have just handed that information to a company you’ve never signed anything with.

Why this is in the news

This month, small business groups told a federal parliamentary inquiry into small business cyber security that owners need plain-language guidance on using AI safely. It’s not a theoretical problem. The Australian Signals Directorate says the average cyber incident reported by a small business cost $56,600 in 2024–25, up 14% on the year before.

The good news: you don’t need to ban AI. You need a few simple rules.

What actually goes wrong

When you type something into a free AI chatbot, it leaves your business. Depending on the tool and the settings, it may be stored on the provider’s systems and even used to train future versions of the tool. The Australian Cyber Security Centre’s guide for small businesses lists data leaks and privacy breaches as the first risk to manage.

Picture a hypothetical physio clinic. A receptionist pastes a patient’s details and injury notes into a free chatbot to draft a letter to their insurer. Quick, helpful, and a privacy problem. Health providers are covered by the Privacy Act whatever their size, and the privacy regulator recommends businesses don’t enter personal information, especially sensitive information, into publicly available AI tools.

Even if your business is too small to be covered by the Privacy Act, your customers still expect you to look after their details. Losing that trust costs more than any fine.

The other common risk is simply trusting the answer. AI tools sound confident even when they’re wrong. A made-up figure in a quote or a wrong date in a customer email is your mistake, not the chatbot’s.

Five simple rules for using AI safely

You don’t need a 20-page policy. Most small businesses can cover the basics on one page:

1. Decide what never goes in. Customer names and contact details, health or financial information, passwords, and anything you’d be embarrassed to see leaked. If in doubt, leave it out, or swap real names for “Customer A”.
2. Use a business account, not free personal ones. Paid business versions of the main AI tools generally give you more control over your data. Check the settings and switch off any option that lets the provider use your information to train its AI.
3. Pick one or two approved tools. It’s much easier to keep things safe when everyone uses the same tools, set up the same way, than when each person has their own favourite free app.
4. A person checks before anything goes out. AI can draft. A human reads it before it reaches a customer, especially anything about money, health or legal matters.
5. Show your team how. A short session on what’s fine and what’s not does more than any written rule. Most people are only trying to save time, so give them a safe way to do it.

These line up with the joint guidance from the Australian Cyber Security Centre, New Zealand’s National Cyber Security Centre and the Council of Small Business Organisations Australia, which recommends setting clear rules on what can be shared, checking how your data is used, training staff and fact-checking AI answers.

Don’t stop at “safe”

Getting the rules right isn’t about slowing your team down. It’s what lets you use AI more, with confidence. Once the basics are sorted, AI can take a real load off: drafting quotes and replies, summarising meetings, answering common customer questions from your own information, and cutting the admin that eats your evenings.

The businesses that get the most from AI aren’t the ones that rushed in. They’re the ones that decided how it fits their work first. Technology added to an unprepared business just makes the mess move faster.

Where to start this week

• Ask your team which AI tools they’re already using, and what for. No blame, just a list.
• Write down your “never paste” list and share it.
• Choose your approved tool and set it up properly on a business account.
• Pick one time-wasting job where AI could help safely, and try it there first.

This is what our AI & Automation service covers: choosing the right tools, setting them up safely and training your team to use them well. If you’d like the wider security basics sorted at the same time, our IT & Cyber Security service looks after accounts, devices and email too.