Skip to content
Step 1 / –
flagIntroduction

What happens to what you type?

An AI tool feels like a conversation on your own screen. With an online service, what you type or upload usually goes to the provider. What happens to it after that depends on the service, the account, the settings and the agreements.

targetWhat you will learn in this module
  • check_circleWhy AI can sound confident, even when it is wrong
  • check_circleWhat happens to your text and files at the provider
  • check_circleWhy you only use an approved tool and account
psychologyHow AI works

A language model predicts text

A language model, like the models behind many AI chatbots, produces text by predicting which words fit. A fluent answer does not mean it has checked the facts.

What that means in practice:

  • It can sound very confident, even when the answer is completely wrong.
  • It can use organisational data that you enter or that is available through connected files and systems. That access has to be approved too.
  • It can make things up, such as figures, quotes or sources.
lightbulbFluent is not the same as correct

A well-written answer is not yet a correct answer. You will learn how to check the result in module 4.

cloud_uploadYour text travels

Where does your text go?

With an online AI service, your text and files usually go to the provider’s servers. The location and access depend on the service and the agreements. Some AI systems run locally. With an online service, your input can:

  • be kept for a while;
  • be read by the provider’s staff, for example during an abuse check;
  • be used to further Training on your dataThe provider uses conversations from users to improve the AI model. Pieces of what you typed can end up in answers to other people later on. the AI model, so that pieces of it may later surface in answers to other people.

Whether that happens depends on the terms, settings and agreements for that specific service. Turning off training alone does not make an application suitable for personal data.

badgeFree or business

Free or personal account versus business account

A free or personal account, including a paid subscription in your own name, is not automatically approved for your work. Your organisation may not have assessed the agreements, settings and management behind it.

A business account can offer agreements on data use and central management. But the label “business” does not guarantee that:

  • there is an appropriate Data processing agreementA contract on the processing and security of personal data on behalf of your organisation. The GDPR requires this when the provider acts as a processor. The contract is not in itself a legal basis for using the data.;
  • your input is never used for training;
  • every task and every type of data is permitted.

Your organisation has to check this beforehand, together with, among other things, the legal basis, necessity, security and any transfer outside the EEA.

gavelFor work: only what has been approved

Use only the combination of tool, account, task and data that your organisation has approved. A paid or business account and a disabled training option are not, in themselves, permission.

checklistYour tools

Which tools may you use?

A good AI policy contains a list of tools, each with one of these statuses:

  • Permitted, including with personal data: only for the tasks and types of data that have been explicitly approved. That is not a blanket permission for all customer or staff data.
  • Permitted, but without personal data: handy for general questions or texts, but no names or other personal data in it.
  • Not permitted: you do not use it for work.
helpIs a tool not on the list?

Then it is not permitted until you have requested it and it has been approved for your use. You will learn how that works in module 7.

quizWhat would you do?

A colleague’s handy habit

smartphone
A colleague uses the free ChatGPT app on her phone to rewrite quotes, with the customer's name and address in them. "It's handy, isn't it?", she says. This personal account has not been approved by the organisation.

What do you do?

quizPractice · question 1 of 2
infoJust practice, this does not count toward your progress
Why can an AI answer sound confident while being wrong?
Correct: AI predicts text. That produces fluent, confident sentences, even when the content is wrong.
quizPractice · question 2 of 2
What do you check before you put customer data into an AI tool?
Correct: the approval has to cover your task and your data. A business label or a contract alone is not a general free pass.
summarizeSummary

What you take away from module 2

  • boltA language model predicts text and can sound confident, even when it is wrong.
  • boltWith online AI services, your input usually goes to the provider. What happens to it depends on the service, settings and agreements.
  • boltUse only a tool and account that have been approved for your task and your data. Business does not automatically mean safe for every use.
  • boltYour organisation's AI policy says, per tool, whether it is permitted and whether personal data is allowed.
workspace_premiumModule complete

Module 2 complete 🎉

You now know where your text goes and why the account matters so much. In module 3 you will learn what you can and cannot put into an AI tool, using a simple traffic light.

lock_open 2 of 8 modules

On your way to the “Using AI safely” practice quiz

Complete all 8 modules and try the free practice quiz. The official exam with a certificate of attendance is in the GDPRWise app’s paid plans.

check_circle Modules 1-2 completeradio_button_unchecked Modules 3-7radio_button_unchecked Final exam ≥ 70%
workspace_premium