Is AI safe to use with customer data, and will it make things up?
Short answer: Yes, if you set it up carefully. Use business accounts that don't train on your data by default, connect only the systems each workflow needs, keep sensitive data out unless your contract covers it, and have a person approve AI output before customers see it. AI does make things up sometimes, so build every workflow on the assumption that it will.
The first thing the Lab checks in any engagement is which accounts people are actually using. It's common to find staff pasting customer emails into a personal ChatGPT login because nobody gave them an approved option. That's the real risk, and it's fixable in an afternoon.
Does AI use your business data for training?
It depends on the plan. Free and personal accounts may use your conversations to improve the vendor's models unless you opt out. Business plans generally don't by default. OpenAI, for example, says it does not train on data from ChatGPT Business, Enterprise or the API by default (OpenAI enterprise privacy), and Google publishes its commitments for Gemini in Workspace in the Workspace generative AI privacy hub. Read the current terms for your exact plan before customer information goes in.
How does the Lab keep customer data safe when using AI?
These are the controls the Lab puts in place on every project:
- Business accounts owned by the business. Not personal logins, and not an employee's account that leaves when they do.
- The minimum connections. A lead follow-up workflow needs your inbox and calendar. It doesn't need your bank account.
- An Access Sheet. One page per workflow listing what it can read, write and send.
- Two-factor authentication on every account the AI connects to.
- A short team rule for what never goes into AI: card numbers, Social Security numbers, passwords, and health details unless a contract covers them.
Will AI give customers wrong answers?
Sometimes. Language models can state wrong things with confidence. You reduce that through how you set it up:
- Give it your facts. A short, current document of services, prices, hours and policies, with an instruction to answer only from it.
- Tell it to admit when it doesn't know. If the answer isn't in the document, it offers a callback instead of guessing.
- Keep a person approving. Every customer-facing message gets approved until the workflow has a track record.
- Test on real cases. Before go-live, run it on a batch of real past inquiries and read every answer.
- Spot-check after launch. Every week or two, read a sample of outputs and update the facts document when something changes.
What about health, legal or financial information?
Be stricter. Medical and dental practices covered by HIPAA should only use AI tools whose vendor will sign a Business Associate Agreement; HHS explains what those contracts must include in its business associate guidance. Law firms should check their bar's guidance on AI and confidentiality. When in doubt, the Lab keeps that data out entirely and automates the parts that don't touch it, like scheduling, reminders and general questions.
Isn't it safer to just ban AI?
In the Lab's view, usually not. A ban tends to push people toward free tools on their own phones, where you can't see what's shared. A business account plus a one-page policy gives you more control than a rule nobody follows.
Common questions
Should you tell customers the business uses AI?
We recommend it. A line in your privacy policy, and a straight answer if a customer asks, is a sensible baseline. Check any rules specific to your industry.
What's the single most important safety step?
Keep a person approving anything customer-facing until the workflow has proven itself on real cases. It's the step that catches wrong answers before they cost you a customer.
