AI Governance
5 things to never paste into an AI chat
The short version
- The model isn't the risk. The paste is. Once it leaves your machine, you can't call it back.
- Five inputs cover most of the everyday danger: credentials, other people's data, regulated records, NDA material, un-cropped screenshots.
- Governance doesn't have to start where it's meant to end. It just has to start.
In marketing, every experience is content. In AI, every glitch is a tip.
These five are tips. They're my OGs, the rules I wrote for myself before I had a framework, each one earned through research, mistakes, and glitches.
Most small businesses didn't skip AI governance on purpose. They adopted faster than they wrote anything down. 77% of small businesses use AI daily.1 Ask how many have written a single rule about what goes into it.
Here's the part that gets skipped. A policy isn't a brake. When nobody knows what's allowed, the careful people quietly stop using the tool, and the less careful ones use the free version on their phone where nobody's watching. You get the worst of both. Roughly half of employees say they're using AI tools their employer never approved, and most of those are on free tiers with weaker protections.2
So the boundary isn't what's slowing adoption down. The absence of one is. People don't use a tool confidently until they know where the edge is.
What should you never paste into an AI chat?
Five things. Each one has a reason, and the reason is what makes it stick. A rule you understand survives a busy Tuesday. A rule you were handed doesn't.
-
01
Keys, tokens and passwords
API keys, access tokens, database connection strings, the whole config file that holds your secrets.
INSTEADSwap the real value for YOUR_KEY_HERE and say the key lives in an environment variable. It can debug the code around a secret without ever seeing it.
-
02
Other people's personal data
Client lists, contact exports, donor records, a screenshot of someone else's inbox. It was given to you for one purpose, and this isn't it.
INSTEADSwap names and emails for Client A and Client B. The model reads the pattern just fine without knowing who anyone is.
-
03
Health, financial and ID records
Diagnoses, account and card numbers, Social Security or passport numbers, student files. These carry legal duties that follow the record wherever it goes.
INSTEADAsk about the rule, not the record. Describe the situation and leave the file closed.
-
04
Anything under someone else's NDA
A signed agreement, an employer's internal deck, unreleased work you were shown in confidence. Your access was personal. It wasn't transferable.
INSTEADAsk about the clause type in the abstract. You can learn plenty about a non-compete without pasting the one you signed.
-
05
Un-cropped screenshots
The window behind the window. Open tabs, notification banners, a client name in the sidebar, a token sitting in a terminal you forgot was running.
INSTEADCrop to the one thing you're asking about, then look again before you send. This is the one that catches careful people.
All five have the same fix: describe it instead of pasting it. You almost never need to hand over the raw material to get the answer you actually want.
How do you write an AI policy in an hour?
Most people stall because they picture the finished thing. Twelve pages, a legal review, a training module. Then they decide they don't have time for that this quarter, so nothing gets written and the tool keeps getting used anyway.
Start with the smallest version that's true. One page, three parts.
Part 2 is the one people cut, and it's the one that does the work. A rule without a reason gets routed around the first time it's inconvenient. A rule with a reason can be applied to a situation you never thought of. That's the only kind of governance that survives contact with real work.
Tip 🚨
Governance feeds adoption when it's built on reasons, not rules.
What if you already pasted something you shouldn't have?
Rotate the credential if one was exposed. Delete the conversation. Check whether your plan trains on your data, because the answer changes by product and by tier. Then write it down in one line so the policy learns from it.
And don't punish the person who reported it. A policy people are afraid of is a policy that hides incidents. You want a team that tells you fast, not a team hoping you never find out.
A rule with the why attached gets followed. A rule without one gets routed around.
It doesn't have to start where it ends. It just has to start.
I'm proud of where I started. I'm even more proud of where I am today. Reach out if you'd like help getting started. 🚀
Questions people ask about this
Straight answers, in case you skimmed.
What should you never paste into an AI chat?
Five things: API keys, tokens and passwords; other people's personal data such as client lists and contact exports; health, financial and government ID records; anything covered by someone else's NDA; and un-cropped screenshots that capture more of your screen than you meant to share. In each case, describe the situation instead of pasting the raw material.
Does a small business need a written AI policy?
Yes, and one page is enough to start. 77% of small businesses use AI daily, while most have nothing written down. A minimum viable policy lists the inputs staff shouldn't paste, the reason for each, and the person to ask when a case isn't clear.
Why does AI governance increase adoption instead of slowing it down?
Because people don't use a tool confidently until they know where the edge is. Without a written boundary, cautious staff avoid the tool entirely and less cautious staff use unapproved consumer versions. A short policy that explains why each limit exists gives everyone permission to work inside a line they understand.
What is the minimum viable AI policy?
One page, three parts: the inputs that never go into an AI tool, one sentence of reasoning under each, and a named owner plus a review date. It takes about an hour to write and covers most of the everyday risk for a small team.
What should I do if I already pasted something I shouldn't have?
Rotate the credential if one was exposed, delete the conversation, check whether your plan trains on your data, and write the incident down. Don't punish the person who reported it. A policy people are afraid of is a policy that hides incidents.
Sources & Notes
- 77% of small businesses report using AI daily. Intuit 2026 AI Impact Report, a survey of more than 34,000 small and mid-sized businesses, reported by Forbes, 19 July 2026.
- 49% of employees reported using unapproved AI tools, and 58% of those relied on free versions that may lack robust data protections. BlackFog / Sapio study of 2,000 employees, reported in the same Forbes piece. That sample was drawn from firms with 500 or more employees, so read it as workplace shadow AI generally, not a small-business figure.
- "Describe it instead of pasting it" is a habit, not a legal standard. Nothing here is legal advice. If you handle regulated records, your obligations come from the regulation that covers them, and an hour with a lawyer who knows your sector is worth it.