Guides › New to AI

Using AI at work before it's approved: an honest playbook

Updated Oct 30, 2026 · Level: Beginner–Intermediate · Every product fact comes from the vendor's or government's own pages.

If your employer hasn't approved AI tools, keep work information out of personal AI accounts, even ones with training switched off. Meanwhile, you can build real skills on your own time with public information, and help your workplace say yes with a small, well-designed pilot. Below: what's off-limits, what official Canadian guidance says, and a one-page proposal template.

Start here: what does your policy actually say?

Look for an existing rule in these places:

• Your acceptable-use or IT security policy, and any newer guideline on generative AI.
• The intranet or IT service portal, which may list approved software.
• Privacy, records and code-of-conduct policies, which often apply even when AI isn't named.
• Your manager, the IT service desk or your privacy officer.

If the policy is silent, that isn't permission. Ask your manager in a short email whether AI tools are allowed, which ones, and for what. A written answer protects you either way.

Why is your employer hesitating?

Caution usually isn't fear of new technology. It reflects real obligations that a personal chatbot account doesn't meet out of the box.

• Confidential data. Anything you paste leaves your organization's systems. On personal accounts, most assistants can use your chats to improve their AI unless you turn that off; here's where the setting is in each app.
• Privacy law. Organizations must protect personal information about clients, residents, patients and staff. Sending it to an outside service without authorization can be a privacy breach.
• Accuracy. AI states wrong things confidently. A mistake in a public letter or report carries the organization's name.
• Records and disclosure. Public bodies and regulated industries must keep certain records and may have to release them on request. Work done in a personal account sits outside those systems.
• Licensing and terms. A personal plan is an agreement between you and the vendor, not your employer. Business plans exist partly to fix that, with contracts, admin controls and data settings.

What does official Canadian guidance say?

Two official sources are worth reading, even if you don't work in government.

The Government of Canada's Guide on the use of generative AI was last modified in September 2026. It tells federal public servants not to enter personal information into publicly available online AI tools, and goes further: sensitive or personal information shouldn't go into any tool the government doesn't manage. ¹

The guide warns that some suppliers may inspect what you type or use it to train their models. It also says not to treat AI output as authoritative: check it against trusted sources, say when you used generative AI, and tell your manager. ¹

In December 2023, Canada's federal, provincial and territorial privacy commissioners issued joint principles for generative AI. They advise organizations to use anonymized or de-identified information in prompts where possible, and personal or confidential information only where authorized. They add that, unless otherwise required, prompts shouldn't be kept, reused for other purposes or disclosed. ²

These were written for government staff and organizations, but they describe what any cautious employer is weighing.

What's clearly off-limits?

Until you have approval, these are out, however convenient they seem:

• Pasting work emails, documents, meeting notes, spreadsheets or code into a personal AI account.
• Uploading screenshots or photos of work material, including from your own phone.
• Connecting a work email, calendar or drive to a personal assistant.
• Installing AI browser extensions or agents on a work computer.
• Doing work tasks at home on a personal account. It's still work data.
• Presenting AI-drafted work as entirely your own where disclosure is expected.

Is it OK if I remove the names first?

Usually not, though it feels safe. A job title, a street, a date and a dollar figure together can identify someone, and confidential business information is sensitive without any names. The commissioners' advice on de-identified prompts is for organizations using authorized tools, not a loophole for personal accounts.

What can you do on your own time?

Plenty. Clear prompting, checking output and knowing the privacy settings carry over to any task. Use a personal account, personal time, and public or made-up information.

• Practise on your own life. Plan meals, a trip or a household budget. Same skills, no risk.
• Work with public documents. Summarize a published annual report, a council agenda or a government guide, and ask it to explain the jargon.
• Rehearse with invented scenarios. Make up a fictional organization with fake data, then practise the workflow you'd want at work.
• Learn to catch mistakes. Ask questions you already know the answers to, and note where it goes wrong.
• Keep an idea list. Note repetitive tasks at work that AI might help with, described in general terms. That list becomes your pilot proposal.

Try this with any public document:

For learning on your own, a free plan is usually enough. If you're weighing a paid one, see Should I pay for AI? and the best $20 AI plan.

How do you make the case for an approved pilot?

A narrow, time-boxed pilot is easier to approve than a vague request for "AI access."

1. Find the decision-makers. Usually your manager, plus IT security, privacy, and records or information management.
2. Pick low-risk uses. Choose work with no personal or confidential information, like rewriting published text in plain language.
3. Choose a business-grade tool. Propose a plan with a contract and no training on your data by default, or one your organization already licenses.
4. Keep it small and measured. Three to five people, 60 days, clear data rules, and honest measures of time saved and errors.

Which business plans are built for this?

All five vendors below say they don't train on business customers' data by default. Prices are in US dollars per user per month as of Oct 30, 2026, can differ by country, and exclude taxes.

• Microsoft bundles: Microsoft 365 Business Standard with Copilot costs $23.50 and Business Premium with Copilot $32 per user per month, paid yearly. The $18 add-on price is for existing Microsoft 365 customers with an eligible Business plan, needs a yearly commitment and applies to the first year only. ¹²

Your IT team will likely want to review security documents, data location and contract terms. That review is the point of a pilot, not an obstacle to it.

Your one-page pilot proposal template

Copy this, fill in the brackets, and keep it to one page.

Fill it in yourself, not with a personal AI account. Team workloads and budgets are still work information. The proposal is also more convincing when you've followed the rules you're proposing.

Does your employer already have an approved AI tool?

Check before proposing a purchase, since many organizations already pay for software that includes AI.

• Google Workspace workplaces: Gemini on a work Google account depends on your organization's Workspace edition, and admins decide whether it's on and how long chats are kept. Google says Workspace content and prompts aren't used to train its AI models outside your organization without permission. ¹⁵
• Microsoft 365 workplaces: Microsoft includes Copilot Chat at no extra cost with eligible Microsoft 365 plans. Signed in with a work account, it comes with enterprise data protection, and prompts and responses aren't used to train foundation models. The fuller Microsoft 365 Copilot is a paid add-on, so ask IT what's licensed and approved for your account. ^12,13
• Home Copilot isn't work Copilot: Microsoft 365 Personal (US$9.99/month · CA$11.50) includes Copilot in Word, Excel, PowerPoint and Outlook. It's still a personal plan, so using it on work files is like pasting work into any personal AI account. ¹⁶
• Government and public bodies: the federal guide separates public tools from tools the government manages. Ask whether your organization offers a managed one. ¹

Approved tools come with oversight a personal account can't give. On Claude Team and Enterprise, for example, an owner must enable each connector before staff can use it. ¹⁷

Even with an approved tool, the habits stay the same. Share only what the rules allow, check every output, and say when you used AI.

Related: Start here: AI for beginners · Should I pay for AI? · Best $20 AI plan · Get the most out of AI · All AI plans and prices