# The Golden Rule of AI Privacy
Source: https://humanspark.ai/frameworks/golden-rule-ai-privacy/

*Private AI vs. Non-Private AI: know which one you are using before you share.*

**When to use:** Before sharing work information with any AI tool.

Never enter *confidential, client, personal or private business information* into Non-Private AI.

> **Two types of AI:** Before sharing information with an AI tool, you need to know which type of AI you are using.

Private AI

Approved for work use

**AI with suitable privacy protections, approved by your organisation for work use.**

Examples may include:

- Company-provided AI business or enterprise accounts, such as ChatGPT Business or Microsoft 365 Copilot.
- Secure AI systems hosted within your organisation.
- Properly secured local AI models running on your own equipment.

**You CAN use Private AI for:**

- Public information.
- Internal business information.
- Confidential or client information, where your organisation has approved that use.

**Important:** Private AI does not mean that every type of sensitive information is automatically permitted. Follow your organisation's rules.

Non-Private AI

Not approved for private information

**AI that has not been approved for handling your organisation's private information.**

Examples include:

- Personal AI accounts, including paid personal subscriptions, unless specifically approved.
- Unapproved AI websites, browser extensions and apps.
- New AI tools whose privacy protections have not been checked.

**You CAN use Non-Private AI for:**

- Public, non-sensitive information.
- Published articles and marketing material.
- Completely fictional examples and test data.

**You MUST NOT enter:**

- Confidential client information.
- Non-public personal information.
- Internal business documents.
- Financial records or proprietary business information.

Your organisation's responsibility

Who is responsible?

- Check the privacy and security protections of AI tools.
- Decide which AI systems are approved.
- Decide what types of information can be used with them.
- Make the rules clear to staff.

Your responsibility

Who is responsible?

- Use the correct approved AI account or workspace.
- Follow the rules for the information you are handling.
- Never enter private information into an unapproved tool.

> **The two-question privacy check:** Before entering work information into AI, ask: **1. Is this an approved Private AI system?** **2. Am I allowed to use this information here?** If the answer to either question is NO, or you are unsure, do not enter the information.

> **When in doubt:** **If you don't know whether an AI tool is Private, treat it as Non-Private until you have checked.**

> **One final point:** We're classifying the AI account or environment you're using, not the AI brand itself. The same AI provider may offer both Private and Non-Private environments.

The Golden Rule: *Know which one you're using before you share.*

## Related frameworks

- [What Counts as Private AI?](https://humanspark.ai/frameworks/what-counts-as-private-ai/) - The three environments behind Private AI
- [The Vendor Evaluation Card](https://humanspark.ai/frameworks/vendor-evaluation-card/) - How an organisation checks a tool