Before You Put a Client Document Into an AI Tool, Ask These Questions

Identify the data before choosing the tool

A document may contain more than the details needed for a summary: employee names, customer records, financial information, credentials, or confidential project plans. Before uploading it, identify whose information appears and what the AI task actually requires. A request to extract milestones may need a short, redacted excerpt rather than the entire client folder. Include attachments and comments in that inventory.

NIST describes its Privacy Framework as a voluntary way to identify and manage privacy risk, including risks across data-processing activities. Apply that lens to the proposed workflow: what data enters the tool, who can access the output, where will copies remain, and when will they be removed under your organization’s policy? These are operational questions, not a claim that one blanket rule fits every document.

Check permission and purpose

Possession of a file does not by itself answer whether your team may send its contents to an outside AI service. Check the client’s instructions, confidentiality commitments, internal policies, and the tool’s applicable terms and data-handling settings. If the authorized purpose is unclear, seek an internal decision or ask the client before proceeding. Record what was permitted and which materials that decision covers.

Be precise when discussing consent. Do not assume every AI-assisted edit legally requires the same form of consent, and do not imply that a generic notice cures every restriction. The FTC has warned AI companies to honor privacy and confidentiality commitments, including commitments about data use. For a service team, the practical lesson is to avoid making promises about client-data handling that its actual workflow cannot support.

Minimize what goes in and what comes out

Prepare a working excerpt with only the facts needed for the task. Replace unnecessary names with roles, remove identifiers that add no value, and keep a secure reference to the original so a reviewer can check the output. Redaction is not foolproof: context can still identify a person or reveal sensitive business information. Have someone inspect the excerpt before sharing it with a tool.

Apply the same discipline to outputs. An AI-generated brief can repeat private information in a new document or put it in a title that is more widely visible. Review recipients and access settings before distribution. The FTC’s business guidance recommends understanding the personal information an organization holds and considering the practices of outsourced service providers; both questions matter when a document leaves the original work environment.

Keep a usable decision record

For repeatable work, create a short intake record: document category, approved purpose, permitted tool or environment, data removed, reviewer, and retention instruction. Do not place sensitive details into the record just to prove that you considered them. The aim is to help the next teammate follow the same boundary without reinterpreting an informal conversation.

If a client later changes its instructions, pause the workflow and update that record before reusing earlier inputs or outputs. When permission is uncertain, leave the external AI step on hold until the question is resolved. AI may help with extraction or drafting, but it does not determine who is entitled to share someone else’s information.

Sources and further reading

• NIST — Privacy Framework
• FTC — AI Companies: Uphold Your Privacy and Confidentiality Commitments
• FTC — Protecting Personal Information: A Guide for Business