Customer & staff information
Contact lists, payroll, CVs, health records and identity documents need careful handling. Removing names may not be enough to make information anonymous.
RESPONSIBLE AI USE • WALSALL & WEST MIDLANDS
AI policies & data protection.
Help your team use AI productively, with clear rules about your business information.
RBR Tech helps small businesses assess AI use, choose approved tools and put suitable Microsoft 365 controls in place to reduce accidental data sharing.
KNOW YOUR INFORMATION
What is your team sharing with AI?
AI can help draft content, simplify tasks and develop ideas. But a prompt, spreadsheet, screenshot or meeting recording can contain information that should stay confidential. Approved tools still need clear boundaries.
Commercial information
Quotes, margins, contracts, tender documents and forecasts may reveal how your business operates or breach a customer's confidentiality requirements.
Designs & intellectual property
Drawings, source code, technical methods and unfinished client work may belong to your business or a customer. Check permission before sharing.
Security information
Live passwords, API keys and recovery codes should never go into general AI chat. Security reports and configurations also need controlled access.
POLICY AND PRACTICAL PROTECTION
Clear rules. Suitable controls.
AI acceptable-use policies
Define approved tools and accounts, permitted tasks, prohibited information and when staff must seek permission. Include human checks and a clear reporting route.
Manage AI access
Restrict identified unapproved AI websites, applications and browser extensions on managed devices. Review connected tools before they access company email, files or meetings.
Label sensitive information
Introduce understandable classifications for supported files and emails, with encryption and permissions where appropriate. A label name alone does not block sharing.
Reduce sensitive data sharing
With suitable licensing, configure data loss prevention rules to warn or block supported sensitive uploads and pasting to restricted AI websites.
A SIMPLE STARTING POINT
Four labels. Clearer decisions.
We tailor classifications and rules to your business. This example shows how staff guidance and technical controls can work together.
Public
Published website copy and approved marketing material.
Use approved AI tools and check the output.Internal
Routine procedures and non-sensitive working information.
Approved work AI only, for authorised tasks.Confidential
Customer records, pricing, contracts and unpublished work.
Specific approval before use in business AI.Restricted
Payroll, health information, credentials and critical secrets.
No AI use by default. Never enter live secrets.MICROSOFT 365 OPTIONS
Protection matched to your environment.
Business Standard
A starting point for policies, staff guidance, approved work-account AI and a review of sharing and app permissions. Central device management and endpoint data loss prevention require additional products or licences.
Business Premium
Adds managed-device, identity and web controls, plus core sensitivity labelling and DLP for Exchange, SharePoint and OneDrive. It does not include Endpoint DLP for external AI uploads and pasting.
Premium plus Purview Suite
Microsoft Purview Suite for Business Premium adds advanced data protection, including Endpoint DLP and Defender for Cloud Apps. We scope supported browsers, activities and policies before deployment.
Broader managed security
The combined Defender and Purview Suites for Business Premium add wider threat and identity protection alongside data security. We confirm the right licences and any additional usage charges before rollout.
Some newer Edge browser protections for unmanaged AI apps use pay-as-you-go billing. Coverage varies by device, browser, app and configuration. No solution can guarantee that data will never be shared.
HOW WE HELP
A practical plan for safer AI use.
- Assess
Understand your data, devices, Microsoft 365 licences and current AI use.
- Agree
Choose approved services, labels, handling rules and an exception process with your business.
- Pilot
Test the controls, review false positives and confirm what is covered before enforcing blocks.
- Support
Provide staff guidance and agree ongoing reviews of alerts, exceptions and new services.
COMMON QUESTIONS
AI use in your business.
Can we block all AI tools?
We can restrict identified services on managed company equipment. New tools, AI embedded in existing software and personal devices create gaps, so blocking must be supported by policies and regular review.
Does Business Premium stop staff pasting data into AI?
Not by itself. Its core Microsoft 365 DLP covers Exchange, SharePoint and OneDrive. Supported endpoint upload and paste controls need suitable additional licensing and configuration.
Does a Confidential label automatically block AI?
No. The label's encryption, permissions and associated DLP rules determine what happens. We test the actual file types, tools and user workflows.
Do we need to stop using AI altogether?
Many businesses can use approved AI for appropriate tasks. The decision depends on the information, contractual commitments and business risks. Sensitive use cases need a specific assessment.
LET'S REVIEW YOUR AI USE