Using a chatbot safely at work

Why this matters for you

You handle a lot of information every day. You see files, forms, registers, CNIC copies, phone numbers and complaints. Much of this belongs to citizens or to the government. It is not yours to share.

When you type something into a chatbot, it leaves your office. It goes to the company that runs the tool. It may be stored. It may be read by staff at that company. It may even be used to train the tool. Once it has gone, you cannot get it back.

This is the most important module in the pathway. One careless message can cause real harm to a citizen and serious trouble for you.

Your office's rules come first

Every office is different. Some offices allow certain AI tools. Some allow none. Some have written instructions. Some have nothing yet.

So the first rule is simple:

• Find out what your office allows. Ask your officer or your section head.
• If your office says no, the answer is no. Do not use a personal phone or account to get around it.
• If there are no rules yet, ask before you start. Do not assume it is fine.

Using AI tools at work without permission is sometimes called shadow AI. It is risky because nobody knows what information has left the office.

Never type these into a chatbot

Do not type, paste or upload any of the following, even into a tool your office allows, unless your office has clearly said that tool is approved for it:

• Citizens' personal details. Names, CNIC numbers, addresses, phone numbers, dates of birth, photos, signatures or bank details. This is personal data.
• Anything about a person's case. A complaint, an application, a medical note, a family matter or a police matter.
• Classified or restricted material. Anything marked secret, confidential or restricted or anything your officer has told you to keep private.
• Internal files and notes. File notes, internal letters, draft decisions, meeting records or staff matters.
• Passwords and login details. Never, in any tool.
• Scans of official documents. Photos of forms, registers, IDs or letters with names on them.

If you are not sure whether something is sensitive, treat it as sensitive.

What is usually safe to type

These are usually safe, as long as your office allows the tool:

• public information, such as text from an official website or a published notice
• general questions, such as "How do I write a polite reminder letter?"
• your own words with all names and numbers taken out
• made-up examples, such as "a citizen called Mr A who applied for a certificate"

Take the details out first

Often you can still get help without sharing anything private. Before you type, remove or replace every detail that could point to a real person.

For example, instead of typing a real name and CNIC number, write "[NAME]" and "[CNIC]". Instead of a real address, write "[ADDRESS]". After the chatbot gives you a draft, put the real details back in yourself, on your office computer, not in the chatbot.

This habit is called data minimisation: share only what is truly needed. There is a ready-made prompt to remove personal data from a passage, but remember that you should do this on text that is already safe to share. The guide on using AI safely has more tips.

If something goes wrong

Everyone makes mistakes. If you realise you have typed something private into a chatbot:

• stop and do not type any more
• tell your officer straight away and explain what was shared
• do not try to hide it or fix it alone

Telling quickly is the right thing to do. It gives your office the best chance to limit any harm.

Try it

Find a short public notice on an official website, such as office timings or a list of documents needed for a service. Imagine a citizen's application about it with a name, CNIC number and phone number. Write a short note on paper about that imaginary case. Then rewrite the note with every personal detail replaced by a label such as [NAME] or [PHONE]. Check that nobody could tell who the person is.

Check yourself

1. Name three kinds of information you must never type into a chatbot.
2. What should you do if your office has no rules about AI yet?
3. What should you do if you have typed something private by mistake?

Answers: (1) Any three of: citizens' personal details, case details, classified material, internal files, passwords, scans of official documents. (2) Ask your officer before you start. (3) Stop, then tell your officer straight away.