Is your business handing over confidential client data, contracts, or financial forecasts to an AI tool without realising it? If your staff are using Claude, ChatGPT, or Copilot to speed up their day, the answer might be yes – and the consequences could land squarely on your desk.
AI tools like Claude have become part of daily working life for many UK SMEs, often without IT ever signing off on them. That’s not necessarily a problem in itself, but it becomes one when nobody in the business understands the difference between a personal account and a properly governed business account. This applies just as much to a Melton manufacturer or a Leicestershire accountancy practice as it does to a City law firm – AI adoption has moved faster than most East Midlands businesses’ policies have kept up with.
Consumer vs Business: What’s the Difference?
Claude comes in two very different flavours. On the consumer side, you’ve got Free, Pro and Max – the plans anyone can sign up for with a personal or work email in hand. On the business side sit Team, Enterprise and the API, which run under separate commercial terms.
| Consumer (Free / Pro / Max) | Business (Team / Enterprise / API) | |
|---|---|---|
| Used for AI training? | Yes, by default, unless you opt out | No |
| Data retention | 30 days as standard, up to 5 years if training is switched on | Set by your commercial agreement |
| Data Processing Agreement | Not included | Included as standard |
| Admin oversight of who’s using it | None | Full user and role management |
| Single sign-on | No | Yes, via Microsoft Entra ID, Google Workspace, or Okta |
Why does this matter so much? Since August 2025, Anthropic’s default setting for consumer accounts has made conversations eligible to be used for training its AI models, unless the user actively opts out. Opt in – or simply do nothing and accept the prompt – and your data can sit in Anthropic’s systems for up to five years rather than the standard 30 days.
There’s a second issue that’s easy to miss: consumer plans don’t come with a Data Processing Agreement. For a UK business handling personal data under GDPR, that’s a real gap – a DPA is what gives you a contractual basis for confirming how a third-party processor handles data on your behalf. Without one, you’ve no formal assurance over how client or staff information is being treated once it’s typed into the chat box. Business plans operate under commercial terms instead, which means no training on your conversations and proper contractual protections.
What Is “Shadow AI”?
Here’s where it gets tricky for business owners. Even if you’ve never personally signed up to Claude, there’s a good chance someone in your team has – to draft an email faster, summarise a contract, or get a second opinion on a proposal. This is “shadow AI”: tools being used for work, without the business’s knowledge or oversight.
A common misconception makes this worse. Plenty of employees assume that signing up with their work email address automatically makes it a business account. It doesn’t. Unless that account was specifically created and provisioned under your organisation’s Team or Enterprise plan, it’s still a personal, consumer-tier account – complete with the training defaults and missing DPA outlined above. The work email is just a login detail; it changes nothing about how the data is governed.
Signs shadow AI might already be in your business:
- Staff mention “asking Claude” or “asking ChatGPT” about a client query, but IT has never set up or approved an account.
- Nobody can tell you how many people in the business use AI tools day to day, or for what.
- There’s no line item for AI tools in your software spend, yet productivity conversations keep referencing them.
- Job adverts or CVs from your own team list “AI-assisted” workflows that were never formally introduced.
If any of that sounds familiar, it’s worth treating as a starting point for a conversation, not a disciplinary matter – most staff using these tools are trying to do a better job faster, not cut corners.
Why Does This Matter for GDPR and Data Protection?
For UK businesses, this isn’t just an internal IT tidiness issue – it has real data protection implications. If client personal data, financial details, or health information ends up pasted into a personal AI account with no DPA in place, you may not be able to demonstrate the “appropriate technical and organisational measures” UK GDPR requires when a third party processes personal data on your behalf.
Fines for serious breaches can reach up to £17.5 million or 4% of global annual turnover, whichever is higher – though for most SMEs, the more immediate risk is smaller and more mundane: a breach of a client contract’s confidentiality clause, a difficult conversation with a customer whose data was mishandled, or an insurer asking questions you can’t answer during a cyber insurance renewal. None of this requires anything dramatic to happen – it just requires being unable to show that you knew where your data was going.
Why Does Your Business Need an AI Usage Policy?
This is exactly the gap an AI Usage Policy is designed to close. A good policy should set out which AI tools are approved for business use, what types of information staff can and can’t share with them, how new tools get vetted before anyone uses them, and what happens if someone breaches it.
Crucially, this isn’t a Claude-specific issue. The same risks apply to ChatGPT, Microsoft Copilot, Gemini, and every other AI assistant your team might reach for. A policy that only mentions one tool by name will miss the other three someone’s already using. Treat it as a tool-agnostic policy covering AI use generally, not a single-product rulebook.
A solid AI Usage Policy typically covers:
- Which AI tools are approved, and who has the authority to approve new ones.
- What categories of data are off-limits (client personal data, financial figures, credentials, anything under an NDA).
- Whether AI-generated content needs to be reviewed or disclosed before it goes to a client.
- How new starters are told about the policy, not just where it’s filed.
- What happens if someone breaches it, handled proportionately rather than punitively.
- A named owner responsible for keeping the policy current as tools change.
Even a one-page version of this, actually read and understood by the team, does more good than a lengthy document nobody opens.
What Should Staff Avoid Sharing With AI Tools?
Even on a properly governed business account, good habits matter. As a rule of thumb, staff shouldn’t paste in client personal data, financial figures, passwords or credentials, unreleased commercial plans, or anything covered by a non-disclosure agreement. If you wouldn’t put it in an email to an unknown third party, it probably shouldn’t go into an AI chat either – governance reduces risk, but it doesn’t remove the need for common sense.
A useful habit for staff: before pasting something in, ask “would I be comfortable if this appeared in a screenshot shared outside the business?” If the answer’s no, it needs redacting or summarising first, or shouldn’t go in at all.
How to Set Up Claude Team Properly
If you’re moving to Claude Team, a handful of setup steps make a real difference. Configure single sign-on through Microsoft 365, so logins run through your existing Entra ID setup rather than separate passwords – this also means that any Conditional Access or MFA policies you already enforce through Microsoft can be scoped to cover Claude as well. Assign user roles deliberately rather than handing everyone admin-level access. And be selective about which integrations and connectors you switch on; only enable access to systems like SharePoint or Outlook where there’s a genuine business need, rather than connecting everything by default.
It’s also worth deciding early who your Primary Owner is – typically someone in IT, since they’ll need domain and identity provider access to complete the setup – and keeping a short record of which connectors are enabled and why, so future audits or renewals don’t start from scratch.
How Can Provident IT Help?
AI tools aren’t going anywhere, and used well, they’re a genuine productivity boost. The risk isn’t Claude itself – it’s businesses unknowingly running on consumer-tier accounts with no policy, no oversight, and no idea what’s been shared.
If you’d like help auditing how AI tools are currently being used across your business, drafting a practical AI Usage Policy, or getting things properly set up on a governed plan, our IT Consultancy team can review your current setup and put a sensible roadmap in place. As your local Melton-based IT provider working with businesses across Leicestershire and the East Midlands, get in touch with Provident IT and we’ll talk you through it, jargon-free.
