Drawing a perimeter people can actually follow

A rule that says "do not put confidential information into AI tools" produces two outcomes. People who were never going to use the tools comply. Everyone else redefines confidential until their task fits. A usable perimeter has to be specific about content, about destination, and about what to do when the answer is no.

Sort by content, not by tool

The instinct is to classify tools: this one is approved, that one is not. That is necessary and insufficient, because the same approved tool is fine for one paste and not for the next. Sort by what is in your clipboard.

Never leaves, regardless of tool. Special category data: health, biometric, religious or political views, trade union membership, criminal proceedings. Credentials and access tokens. Material held under a confidentiality obligation to someone else. Anything about a person who is not your customer and never received a notice.

Leaves only to an arrangement your organisation has assessed. Ordinary personal data of customers and staff: names, contact details, account histories, correspondence. Internal commercial material: pricing, strategy, unreleased product information.

Leaves freely. Content already public. Content with no personal data and no commercial sensitivity. General questions that contain no case detail.

Most refusals dissolve under the last category, because the underlying question is usually general and only the example is specific.

The reformulation habit

This is the technique that makes the perimeter survive contact with real work, and it is worth teaching explicitly.

You want help replying to a difficult complaint. The instinct is to paste the complaint. But what you actually need is help with the shape of a reply to a customer who is angry about a delay, believes they were told something different by phone, and is threatening to go to an ombudsman. None of that requires a name, a policy number, a date of birth, a medical detail or a quoted sentence.

Reformulating takes about ninety seconds and usually improves the answer, because the specifics that identify a person are rarely the specifics that determine good advice. It also has a property no policy can give you: it fails safe. If you never pasted the detail, nothing turns on whether the vendor's retention terms said what you thought.

Where the detail genuinely is the question, for instance because you need a document summarised, that is a task for a tool with an assessed arrangement, not for a browser tab.

Retention, training and the difference between them

Two separate questions are routinely merged. Whether your input is used to train a model is one. How long it is retained, by whom, in what jurisdiction, and who can access it is another. A vendor can truthfully say it does not train on your data while retaining it for thirty days in a country you have not assessed.

For Article 19 purposes, both matter, because the duty concerns recipients and cross-border transfer rather than training. For Article 6 purposes, retention is part of proportionality. The question to ask a vendor is not "do you train on our data" but "where does it go, who can read it, and for how long".

Free accounts are a different product

The consumer version of a tool and the enterprise version are usually governed by entirely different terms. Staff often have both, and the browser does not remind them which one is logged in. A perimeter that assumes the enterprise arrangement while people use the free account is a paper perimeter.

What to do when the answer is no

The most important part, and the part most policies omit. If there is no route, people find one. Give the refusal somewhere to go: a named person to ask, a tool that is approved for the sensitive case, and a route to request assessment of a new tool that takes days rather than a quarter. A perimeter without a gate is a perimeter with a hole.

As of 24 September 2026.