Skip to content
rh.Raghav R Handa
AI/

Using AI at work

Using ChatGPT or Claude for work? Here’s what the law expects.

Where your data goes, what it means for your profession, the 30-second check before you paste, and the documents every business needs.

Using AI at work? Start here

You pressed Enter.
Here’s where your data went.

Every AI prompt passes through four stages. Each one carries a legal question most businesses never ask. Tap a stage to see what really happens, what can go wrong, and the 60-second fix.

Stage 01 · You paste it in

What are you sharing?

What actually happens

Whatever you type or upload leaves your device: client names, contracts, health notes, financials, code, photos of people.

What can go wrong

If it’s confidential or personal, sharing it with an outside tool can break an NDA, your professional duty of confidence or privacy law, even if nothing is ever leaked.

Laws in play

  • GDPR / UK GDPR
  • India DPDP Act
  • US state privacy laws
  • Professional conduct rules
  • Your NDAs

Your 60-second fix

Strip names and identifiers first. Never paste anything under NDA into a personal AI account.

Real case · United StatesOnline therapy firm BetterHelp pays $7.8m for sharing health data with advertisers$7.8 million for consumer refunds and a ban on sharing health data for advertising
1 / 4

30-second self-check

How covered is your business?

Tick what’s already true today. Nothing is sent anywhere.

0/5

You’re more exposed than you think.

Most of the cases on this site started with exactly these gaps. Let’s fix the basics.

Close the gaps

The short answer

Using ChatGPT or Claude for work?
Here’s what the law expects from you.

Find your situation
01

Using AI is legal. Careless use isn’t.

You don’t need a licence to use ChatGPT, Claude or Gemini at work. No law bans it.

02

What you put in matters.

Client files, customer details and personal data are protected by confidentiality and privacy laws. Pasting them into an AI tool can break those rules.

03

What comes out is on you.

If the AI gets it wrong, copies someone, or misleads a client, you are responsible, not the AI company.

Your situation

Pick what you do.
See what applies to you.

Real questions people bring me. For each: what you’ve actually done, the laws it falls under, what you need, and what getting it wrong can cost.

Architects & designers ask me

“I made a 3D view of a client’s project using ChatGPT. Do I need to be compliant?”

Medium risk

1 What you’ve actually done

You uploaded a client’s drawings or site photos to ChatGPT. Those files now sit on a third party’s servers, and on a free or personal plan they may be used to train the AI. You then handed the client an image you may not legally own.

2 The laws it falls under

  • EverywhereYour client contract & NDASharing client designs with an AI provider without consent can breach confidentiality.
  • EU & UKGDPR / UK GDPRApplies if files show people, names, addresses or homes linked to a person.
  • IndiaDPDP Act 2023Same for personal data of clients, owners and occupants.
  • US, UK, EU, IndiaCopyright lawPurely AI-made images may not be protected, and renders can copy existing designs.
  • UK, US, IndiaAdvertising & consumer lawAn AI render shown as a real or final design can mislead buyers.

3 What you need

  • A business AI account with training switched off
  • A client consent clause on AI use
  • Clear ‘AI concept’ labels on renders
  • An ownership clause for AI-assisted work

4 Why you need to be compliant

Clients trust you with designs that are often unreleased and valuable. If they leak, or show up in someone else’s output, the liability is yours, and so is the lost client.

5 What non-compliance can cost

  • €20m or 4%of global turnover, GDPR (EU)
  • ₹250 crorefor failing to protect personal data, DPDP Act (India)
  • $150,000per work for wilful copyright infringement (US)
  • 10%of global turnover for misleading consumers, DMCC Act (UK)

Maximum penalties set by each law, or real decided cases. Actual outcomes depend on your facts and where you work.

Most of this is fixable in a few weeks. I’ll tell you exactly which of these apply to you, and put the right documents in place.

Get compliant

Don’t see your work here? Ask me. Most first calls start with a question like these.

Ask your question

Your website and business

The documents you need.
And why each one matters.

If you have a website, an app or customers, some of these are already required by law where you sell. Tap any document to see why.

Privacy policyRequiredTerms & conditionsRecommendedAI use policyRecommended
Required by law in many markets

Privacy policy

Tells people what personal data you collect, why, who you share it with and how long you keep it.

Why it matters
You need it when
The moment you collect any personal data: a contact form, newsletter sign-up, login, analytics or a booking tool.
If it’s missing
Privacy laws in the EU, UK, California and India require this information. Apple’s App Store and Google Play reject apps without one.
Strongly recommended

Terms and conditions

The rules for using your website, app or service: payments, refunds, who owns what, and the limits of your liability.

Why it matters
You need it when
Whenever you sell anything, run accounts or let people use a product or platform.
If it’s missing
Without them, local consumer law fills the gaps, usually in the customer’s favour, and you have no agreed limit on your liability.
Required by law in many markets

Cookie banner and cookie policy

Asks permission before analytics, ad pixels and trackers run, and explains what they do.

Why it matters
You need it when
If you use Google Analytics, a Meta pixel or similar tools and have visitors from the EU or UK. California requires an opt-out for data ‘sharing’.
If it’s missing
Trackers firing without consent are one of the most common reasons for privacy complaints and fines.
Strongly recommended

Disclaimer

Makes clear what your content is and isn’t: general information, not professional, medical, financial or legal advice.

Why it matters
You need it when
If you publish advice, reviews, health or money content, or earn from affiliate links.
If it’s missing
Readers who rely on your content may claim you advised them. Paid endorsements must be disclosed under advertising rules such as the US FTC guides.
Required if you sell online

Refund, return and delivery policy

Explains how customers cancel, return, get refunds and receive what they bought.

Why it matters
You need it when
If you sell products or services online.
If it’s missing
India’s e-commerce rules require this information to be displayed, and EU consumers generally have a 14-day right to cancel online purchases.
Strongly recommended

AI use policy (for your team)

One page that tells staff which AI tools they may use, what data must never go into them, and who checks the output.

Why it matters
You need it when
As soon as anyone in your business uses ChatGPT, Claude, Copilot or Gemini for work.
If it’s missing
One pasted client file can breach a confidentiality agreement or privacy law. Clients increasingly ask to see this policy.
Required by law in many markets

AI disclosure and AI terms (for customers)

Tells customers when they are dealing with AI, how AI-generated content is labelled, and who is responsible for AI outputs.

Why it matters
You need it when
If your product has a chatbot, generates content with AI, or uses AI to make decisions about people.
If it’s missing
The EU AI Act requires chatbots and AI-generated media to be disclosed. India’s IT Rules require AI content to be labelled on platforms.
Required by law in many markets

Data processing agreement (DPA)

A contract with any vendor that handles personal data for you, and with business customers whose data you handle.

Why it matters
You need it when
If you use cloud tools, CRMs, email platforms or AI APIs with customer data, or sell software to businesses.
If it’s missing
The GDPR requires these contracts. Large customers will not sign without one.
Required by law in many markets

Data security and breach plan

How you protect data, who does what if there is a leak, and who must be told and by when.

Why it matters
You need it when
Every business that stores customer, patient, client or employee data.
If it’s missing
Deadlines are short: 72 hours to regulators under the GDPR, 6 hours to CERT-In in India for reportable incidents.
Strongly recommended

Ethics or responsible-AI policy

Your public commitments on fairness, transparency and human oversight when you use AI.

Why it matters
You need it when
If you sell AI products, work with large companies or bid for public contracts.
If it’s missing
Not usually a legal requirement, but buyers and investors increasingly ask for it before they sign.

Not sure which ones you have, or whether they actually fit your business?

Get a document check

Built an app with AI or no-code?

You shipped it in a weekend.
Here’s what the law sees.

Lovable, Bolt, Cursor, Bubble or a developer friend: however it was built, the moment real people use it, these rules start to apply.

AI assistant1234567
  1. 01

    Your app collects emails, phone numbers or logins

    What the law seesYou are now responsible for personal data. You need a privacy policy, a lawful reason to use the data, and reasonable security.

  2. 02

    You added Google Analytics, a Meta pixel or a chat widget

    What the law seesIn the EU and UK these usually need consent before they run. In California, sharing data for ads needs an opt-out.

  3. 03

    Your app sends user data to ChatGPT, Claude or another AI API

    What the law seesYou are sharing personal data with a vendor. Check their data terms, tell users, and label AI output where the law requires it.

  4. 04

    You take payments or sell subscriptions

    What the law seesConsumer law applies: clear prices, cancellation and refund terms, and proper terms and conditions.

  5. 05

    You published on the App Store or Google Play

    What the law seesBoth stores require a privacy policy and accurate disclosures about the data your app collects.

  6. 06

    AI wrote most of your code

    What the law seesYou are still responsible if it leaks data. AI code can contain security holes or open-source code with licence conditions.

  7. 07

    Users can upload or post content

    What the law seesYou need a way to handle complaints and take down illegal content. Platform rules in the EU and India set timelines.

None of this means don’t launch. It means launch with the basics in place.

Check my app

Before you paste

The 30-second check.
Run it before anything goes into AI.

Save it, share it with your team, stick it next to your screen. It prevents most of the problems I see.

  1. 1

    Is it confidential?

    Client files, contracts, financials, unreleased designs or anything under an NDA.

  2. 2

    Does it identify a real person?

    Names, photos, contact details, health or money information, even if partly hidden.

  3. 3

    Would my client be surprised?

    If they would object to seeing it in an AI tool, you probably need their agreement.

  4. 4

    Is my AI account set to not train on it?

    Free and personal plans often learn from your inputs. Business plans usually don’t.

  5. 5

    Will I check the answer before using it?

    Facts, figures, quotes and citations. AI sounds sure even when it is wrong.

Yes to 1, 2 or 3? No to 4 or 5? Stop. Remove the details, switch tools, or ask first.

AI use policies

Do you need an AI policy?
Find your row.

  1. You use AI alone, for your own drafts and ideas, with no client data.

    Not required

    No law asks for a policy here. A few personal rules are still smart.

  2. Your team uses AI, sometimes with client or customer information.

    Recommended

    One staff member pasting the wrong file can breach a client contract or privacy law.

  3. Clients ask how you use AI, or your contracts mention confidentiality.

    Needed

    You need a written answer, and your practice has to match it.

  4. AI helps decide things about people: hiring, credit, health, pricing.

    Needed

    This is the most regulated use of AI. Policies, notices and human review are expected.

  5. You sell an AI product, or sell to EU customers or large companies.

    Needed

    Buyers and regulators will ask for your AI policy before they sign.

Need one? I can write it for your team in days, not months.

Get an AI policy

Ready when you are

Tell me how you use AI. I’ll tell you what applies.

Tell me what you’re building. I’ll tell you what you need. No obligation.

Book an intro call