Click Compliance

Imagine a childcare centre uploading its lockdown procedure to an AI tool with a simple request: “Can you make this clearer?”

The document includes the location where educators would take children to hide if an intruder entered the centre. That location is part of what makes the procedure protective. If someone intending harm could access it, they would know where to look for the children. Sharing the plan without understanding who can access it could put the very people it is meant to protect at risk.

That is a very different decision from asking AI to improve a sentence.

AI can be genuinely useful. It can help organise ideas, suggest plain language and spot questions you may have forgotten to ask. But before you give it a workplace document, you need to know what information is in that document, which tool you’re using and who may have access to what you upload.

What shouldn’t go into a public AI tool?

Think beyond passwords and PINs. Workplace files can contain sensitive information in less obvious places.

A draft emergency plan might include staff names and phone numbers. An incident report might identify a customer or describe someone’s health. A childcare procedure might contain information about children, families or the site. Other documents may include access details, client information or confidential business arrangements.

Even a request that seems harmless — “summarise this,” “tidy the wording” or “turn this into a checklist” — may involve uploading the entire source file.

That doesn’t mean every AI tool makes your document public. Tools, accounts, settings and organisational controls differ. It does mean you should know what your workplace has approved before putting real information into one.

You can still use AI without giving it the whole file

If you want help with structure, ask for structure:

“What topics should a workplace consider when reviewing an emergency procedure?”

If you want clearer wording, use a generic example with names, site details and identifying facts removed. Then put the real information into your controlled document and have the right people review it.

Be careful with “anonymised” examples too. Removing a name may not be enough if the remaining details make a person or workplace easy to identify.

AI can help you get past a blank page. It cannot verify your site, approve your procedure or take responsibility for whether your team understands it.

A polished plan can still be the wrong plan

Ask AI to draft an emergency procedure with very little information and it may produce something that looks impressive. It will have headings, numbered steps and reassuringly professional language.

What it won’t know is whether the details fit your workplace.

It hasn’t walked the building. It doesn’t know which staff are on shift, what has changed since the last review or whether the procedure makes sense to the people who would have to follow it. If you give it those details, you also need to consider whether they should be entered into that tool at all.

Those are two separate checks: Is the output accurate? And was the input appropriate?

Make the human checks count

Before a procedure is issued, ask the people who know the workplace to check it:

• Does it reflect the site and the people who use it?

• Are the roles and contact details current?

• Are any instructions unclear or impractical?

• Have staff been trained, and have they had a chance to practise?

• Is the document stored somewhere the right people can access it?

The same care applies when choosing an AI tool. Staff need clear guidance on which tools are approved, what they may enter and when a person must review the result. “Use AI responsibly” is much less useful than showing someone what that means for the documents they handle every day.

At Click Compliance, we’re all for tools that make compliance easier. AI can help with wording and structure. The people who know your workplace still need to check the plan, and you need to know whether the details you upload are appropriate for the tool you’re using.

Before you paste in an emergency plan, ask: what information am I sharing, and who can access it?