Free, and yours
The Three Lists
What never goes into an AI tool. What is fine. And what needs a rule first.
Most people using AI at work have never been told what they may type into it. Not because anyone decided to keep it from them — because nobody got round to deciding at all. So everyone guesses, and everyone guesses differently, and the first time it matters is the time it goes wrong.
This is the page we hand people before anything gets switched on. It takes about four minutes to read. It sorts information, not tools, which is why it will still be right next year.
List one — never
Whatever the tool, whatever the plan, whatever the settings say today.
- Anything that identifies a patient and their care. A name with a diagnosis. A date with a procedure. Consultation notes. Health information is governed by law, and a law does not have a settings page.
- Card numbers, bank details, and government ID numbers — passport, social security, tax ID. There is nothing an AI tool does with these that is worth what happens if they leak.
- Passwords, API keys, access tokens and recovery codes. Pasting a configuration file to ask why it is broken is the most common version of this, and the keys are always in the file.
- Anything covered by a confidentiality agreement with someone else’s name on it. A client’s unreleased figures. A partner’s roadmap. A document marked under NDA. It is not yours to disclose, and disclosing it is what this is.
- Employee and candidate files. A performance note, a grievance, a medical accommodation, a salary, a reference. These are somebody’s private life.
- Anything a lawyer is handling. Legal privilege is easy to break and cannot be put back afterwards.
Six items. They are the whole of list one, and none of them is a judgement call.
List two — fine
Type it. Do not think about it.
- Anything already published. Your website copy, your public prices, a press release, a brochure that has been printed.
- Something you wrote yourself, in which nobody else appears.
- A draft with the names, the numbers and the identifying details taken out. “A client in logistics” instead of the client.
- Public research. What does this term mean. How is this format usually structured. Summarise this public article.
- Your own work about your own work — your to-do list, your notes on your own tasks, your own calendar described in general terms.
- Invented example data you made up in order to test something.
If most of what somebody does all day is on this list, they can start today and nobody needs to approve anything.
List three — needs a rule first
Not dangerous. Not decided. These are fine the moment somebody has said how, and a problem for exactly as long as nobody has.
- Customer lists and contact details
- Internal financials that are not published yet
- A supplier contract, or its terms
- Anything a colleague wrote — their draft, their email, their notes
- Recordings and transcripts of meetings other people were in
- Product plans, and anything unreleased
- Anything that will end up in front of a customer — a chatbot, a reply, a page
A rule here is three sentences, not a policy document. Which tool, on which account. Who is allowed to do it. What happens to it afterwards.
Write those three down and list three empties into list two overnight. Leave them unwritten and every item on it stays a guess that somebody is making alone.
The question that sorts anything not on these lists
If this appeared in a screenshot in a news story tomorrow, whose problem would it be?
If the answer is mine, it is a judgement call and you are allowed to make it. If the answer is somebody else’s — a client’s, a patient’s, a colleague’s — it belongs on list one, and it was never yours to decide.
We spent a decade in newsrooms, where that question is the job.
Why the settings are not the rule
The obvious objection: can’t we just turn training off?
You can. It is worth doing. It is not a rule, for three reasons.
The defaults are not the same as each other. On ChatGPT’s consumer plans — Free, Plus and Pro — conversations are used to improve the model unless you turn it off under Settings, and then Data Controls. On OpenAI’s business products — ChatGPT Business, Enterprise, and the API — they are not, by default. On Claude’s consumer plans the default runs the other way again: conversations are not used to improve the model unless you choose to allow it. Two companies, the same year, opposite defaults.
They are set per person, not per company. A setting on your account says nothing about the account of the person two desks away.
And they change, without anyone typing into the box being asked. In 2025 a court order in the New York Times’ case against OpenAI required it to retain consumer ChatGPT conversations — including ones users had deleted. ChatGPT Enterprise and Edu were excluded; Free, Plus, Pro and Team were not. That obligation ended in September 2025 and deletion went back to roughly thirty days. Nobody typing during those months chose it, and nobody was asked.
Settings are a good thing to get right. They are not a thing you can learn once.
Checked against OpenAI’s and Anthropic’s own published documentation on 19 September 2026.
What to do with this page
Send it to everyone. Not as a policy — as the thing you are all now working from. Then ask two questions out loud, in a room:
- Has anyone already done something on list one? Ask it in a way that is safe to answer. The answer is usually yes, it was usually months ago, and knowing is better than not.
- Which item on list three costs us the most by being undecided? Write the three sentences for that one. Only that one. Next week, the next.
That is the whole method, and there is no version of it that starts with buying something.
If you would like the three sentences written for your own list three, that is the first hour of every engagement we run, and the thirty-minute call is free.