Is AI Safe for Your Business Data? Simple Rules to Follow

Free, public AI tools are useful for general tasks. But depending on the service and its settings, what you type may be stored, reviewed by the provider or used to improve the service. As a simple rule, do not paste:

• customer names with phone numbers, addresses or ID numbers
• bank details, payment data or invoices with personal information
• staff records, salaries or medical information
• contracts, passwords or access codes
• confidential plans, supplier terms or pricing strategies

If you need help with a document, remove names and identifying details first, or use a tool your business has approved.

Many AI providers offer business plans next to their free or personal plans. Business plans often come with stronger promises: your data is not used to train the service, managers can control who has access, and there are clearer rules about how long data is kept.

"Often" is the key word. Read the terms, or ask someone you trust to read them for you. Look for clear answers to three questions:

1. Is my data used to train or improve the service?
2. Who at the provider can see it, and when?
3. How long is it kept, and can I delete it?

Also make sure staff use the company account for work, not their personal one.

When an AI assistant is connected to your systems, such as your email, customer list or accounting tool, it can only see what you give it access to. Give it the minimum it needs. A booking assistant needs your calendar, not your bank account.

The same goes for people. Not every employee needs every AI tool or every connected file. Use separate logins, remove access when someone leaves, and turn on two-step verification (a code sent to your phone when you log in) wherever you can.

AI tools write fluently, which makes their mistakes easy to miss. They can invent a number, misread a contract, mix up two customers or quote a policy that does not exist, all in a calm, convincing tone. Common examples:

• a summary that leaves out the one important condition
• a translation that changes the meaning of a sentence
• a calculation that looks right but is not
• a reply that promises something your business does not offer

That is why a person should always check anything important before it goes out: quotes, contracts, financial figures, legal or medical information, and messages to key customers. AI prepares; a human approves.

You do not need a thick manual. One page, written in simple words and shared with everyone, covers most risks. It could include:

• Approved tools: which AI tools staff may use for work.
• Never share: the types of data that must never go into AI tools.
• Always check: which outputs need a person's review before sending.
• Be open: customers are told when they are talking to an AI assistant.
• Ask first: who to ask when unsure.
• Report mistakes: what to do if someone shares something by accident.

Review the page every few months. Tools change quickly, and your policy should keep up.

In many Moroccan businesses, the riskiest data is not in a database. It sits in WhatsApp chats, voice notes and photos on staff phones. That changes what "do not paste private data" means in practice.

Watch for these everyday habits:

• Forwarding WhatsApp conversations with customers into an AI tool to summarise them. Those chats often contain names, phone numbers, addresses and order details.
• Photographing documents such as a CIN card, a RIB, a cheque or a signed contract, then uploading the photo to ask the AI to "read it".
• Transcribing Darija voice notes from customers or suppliers. The voice itself, and what is said, can be personal information.
• Asking AI to translate between Arabic, French and Darija. Translation is a good use of AI, but check the meaning carefully, especially in contracts and messages to customers. Darija in particular is handled unevenly by AI tools.

Law 09-08 also has rules about sending personal data outside Morocco, and many AI services process data on servers abroad. This is one more reason to remove names, CIN numbers and bank details before using a public tool, and to ask any provider where your data is stored.

A few practical steps that suit how local teams work:

1. Write your one-page AI policy in the languages your staff actually read, often French and Arabic, and explain it out loud in Darija at a team meeting.
2. Agree that customer WhatsApp chats are company information, not personal material to experiment with.
3. Show staff how to blank out a name or number before uploading a photo.
4. Put one person in charge of approving new AI tools, so the decision is not left to whoever finds a new app first.

For family-run businesses, where roles are often informal, writing down these simple rules matters even more. Everyone then knows what is allowed, including relatives who help out.

Morocco has a personal data protection law, Law 09-08, overseen by the CNDP, the national data protection authority. If your AI tools handle personal information about customers or staff, you may have obligations, for example around consent and how that data is processed.

This article is general advice, not legal advice. Check your own situation with a qualified adviser or with the CNDP directly. Businesses in other African countries should check their national rules too.

Africodex helps businesses review how they use AI, choose suitable tools, and set up assistants with sensible access controls and human checks built in. If you would like a second opinion on your setup, we are happy to help.