The Clipboard Is Not a Filing Cabinet: Governing What Staff Paste Into Generative AI

The risk sits between the two clicks

A supplier contract lands in the inbox on Monday. By Tuesday a member of staff has pasted three clauses into a chat window and asked for a plain-English summary. By Wednesday the conversation has been superseded, forgotten, and is sitting in a vendor's data centre under terms nobody in the business has read.

That sequence is now ordinary. It is also, for most UK SMEs, entirely undocumented. The tool itself is rarely the problem; the problem is the paste. A generative AI service that never sees your data cannot leak it.

What follows is a workable framework: an approved list, a short set of vendor tests, a retention clock, a logging rule and a single page of staff guidance. It is not a legal opinion, and anything touching a regulated sector or a large customer contract should be checked against those obligations separately.

Separate the tools into three tiers

Binary allow/block lists fail because they are unenforceable and staff route around them. Three tiers work better.

• Tier 1 — Approved. A business account with a signed data processing agreement, training disabled at tenant level, defined retention, and single sign-on. This is where most work should happen.
• Tier 2 — Conditional. Permitted for non-personal, non-confidential drafting: marketing copy structure, code snippets with no client identifiers, agenda drafting. No customer names, no contract text, no figures.
• Tier 3 — Blocked. Free consumer accounts on personal devices, browser extensions that sit over webmail, and any tool that cannot produce a processor agreement. Block at the network where you can; explain the reason where you cannot.

Publish the tier list with the name of the person who owns it. An unowned list becomes stale within a quarter.

What the vendor contract must actually say

Before anything reaches Tier 1, four points need answering in writing. Sales pages are not evidence.

1. Is there a processor agreement? Under UK GDPR Article 28 you need one, with defined subject matter, duration, and sub-processor terms. If the vendor will only offer consumer terms, the vendor is not a processor and you are making a disclosure to an independent controller.
2. Is training on your content switched off, and at what level? Tenant-level settings are worth more than a promise in a blog post. Ask for the setting name and a screenshot.
3. What is the retention window on prompts and outputs? Enterprise tiers commonly offer zero or short windows; consumer tiers commonly do not. Get the number in days.
4. Where does processing happen, and on what transfer mechanism? The UK addendum or an adequacy decision, named in the contract.

Record the answers in one row per tool in your software register. Four columns, four answers, a review date. That row is what you will reach for if a customer asks.

Sort the output before you set the clock

Retention only becomes decidable once you classify what is being kept. Three classes cover almost everything.

• Ephemeral. Exploratory prompts and their answers. Delete at the end of the working day. There is no business reason to keep a chat history full of half-formed questions.
• Working. Output that will be edited into something else. Keep for 30 days in the tool, then move the useful part into the document management system or shared drive with the rest of the file.
• Record. Output that informed a decision, a client deliverable, or a financial entry. It leaves the tool immediately and is retained under the record retention schedule that already applies to that file type — not under a separate AI policy.

The important move is the third one. An answer that shaped a quote, a contract position or a pricing decision is a business record. Chat history is not a records system, is not backed up on your terms, and will not survive a vendor migration.

Set a default retention of 30 days at tenant level, with the shortest window the vendor offers for ephemeral use. Then write down the deletion evidence you will keep: a screenshot of the setting, the date checked, and who checked it. Deletion you cannot evidence is deletion you will be asked to prove anyway.

Rights requests and the awkward exceptions

If a subject access request arrives, prompts and outputs containing personal data are in scope. That is a strong argument for keeping chat histories short and personal data out of them. A 30-day default makes the search finite.

Two exceptions need naming explicitly, because they cut against automatic deletion.

• Litigation hold. If a dispute is live or reasonably anticipated, the deletion clock stops for the relevant material. Staff need to know to flag it rather than quietly tidy up.
• Regulated records. Some outputs sit inside a file that must be kept for six years. The AI policy must not become an argument for deleting them early.

Log, but do not surveil

The proportionate logging set is small: who has an account, when accounts were last used, and what the tenant retention setting is. Usage metadata is enough to spot dormant licences and unexpected adoption.

Do not build prompt-content logging by default. It creates a second copy of exactly the material you are trying to minimise, and it changes the relationship with staff from guidance to monitoring. If a regulated client contract demands content logging, scope it to that team and say so plainly.

The one-page rulebook

Staff will not read a policy. They will read a page stuck next to the kettle. Keep it to six lines.

1. Use the approved tool. Do not use a personal account for work.
2. No customer names, account numbers, addresses or contract text unless the tool is Tier 1 and the task needs it.
3. Never paste payroll data, bank details or unredacted financial statements. Ever.
4. Check the output before it leaves the building. You are accountable for it, not the model.
5. If the output informs a decision, save it to the client file and delete the chat.
6. If you are unsure, ask the person named at the bottom of this page.

A fortnight's roll-out

Week one: agree the tier list, close the obvious consumer accounts, and chase the four contract answers for your main tool. Week two: set the tenant retention window, write the one-pager, and run a twenty-minute session with the two teams most likely to be using these tools already.

None of this requires a committee. It requires a named owner, four answers in a register, and a retention clock someone actually winds.