03 · What You Need to Know
The Safest Default Is a Decision Rule, Not a Ban on AI
Start with the information, not with the AI tool
Researchers often begin in the wrong place: "Is ChatGPT safe?" "Is this AI private?" "Does this provider train on my prompts?"
Those are useful questions, but they come after a more basic one: What am I about to disclose?
A public article, synthetic dataset, generic methodological question, identifiable participant transcript, unpublished invention, and confidential peer-review manuscript require very different treatment. No single privacy setting can make those differences disappear.
The broader question of whether research information is safe to enter into AI therefore begins with classification of the information itself.
Use a conservative default for information you have a duty to protect
A conservative default is appropriate when the consequences of an unnecessary disclosure may be difficult to reverse.
Once information has been submitted, the service has processed it. Depending on the product and configuration, storage, retention, logging, human review, model improvement, connected services, or other forms of processing may also occur. Deleting the visible conversation afterward does not make the original transmission cease to have happened.
The practical asymmetry matters: you can always decide later to submit information after establishing that the use is permitted. You cannot retroactively prevent a disclosure that has already occurred.
Watch Out
When the information is confidential and permission is uncertain, "upload first and investigate later" is the wrong order. Establish the basis for disclosure before the prompt is sent.
"Unpublished" alone does not automatically mean "do not use AI"
The default should remain proportionate. Unpublished information ranges from a generic paragraph you wrote this morning to a patentable invention, identifiable participant dataset, embargoed result, or collaborator's confidential manuscript.
A draft explanation of a standard statistical method may present little confidentiality risk. A preliminary clinical finding may present considerably more. The fact that neither has been published does not make them equivalent.
For this reason, unpublished research should be classified before it is entered into a public AI tool rather than automatically treated as either prohibited or harmless.
Confidentiality is a stronger warning signal
When material is explicitly confidential, restricted, proprietary, entrusted to you for a limited purpose, or governed by an agreement, the default becomes more straightforward: do not disclose it to an AI service until you have established that the service is an authorized environment.
This principle applies whether the material is your own or someone else's.
A confidential proposal may be governed by funder and institutional requirements. A peer-review manuscript is entrusted to a reviewer for a limited editorial purpose. A collaborator's unpublished work may involve rights and expectations beyond your own. Participant information can be governed by ethics approval, consent, privacy requirements, and data-management commitments.
The word "confidential" should therefore trigger a permission check, not merely a search for the AI provider's training toggle.
Use four gates before protected research enters AI
A practical default can be organized around four questions. If you cannot get through a relevant gate, do not submit the protected information yet.
| Gate |
Question |
If the answer is unclear or no |
| 1. Information |
What exactly am I disclosing, and how sensitive or identifiable is it? |
Classify it before proceeding |
| 2. Authority |
Am I permitted to provide this information to this AI service? |
Do not submit it until authority is established |
| 3. Environment |
Does this exact AI product, account, configuration, and contract provide appropriate safeguards? |
Use an approved alternative or keep the information out |
| 4. Necessity |
Does the AI actually need this information to perform the task? |
Remove it, minimize it, or use a synthetic substitute |
This framework avoids two unhelpful extremes: "never use AI with research" and "AI is fine as long as you turn off training."
Gate 1: classify the information before disclosure
Ask whether the proposed input contains personal information, sensitive personal information, direct or indirect identifiers, confidential research, unpublished intellectual property, restricted data, proprietary information, participant quotations, confidential peer-review material, collaborator contributions, grant information, or other protected content.
Do not assume that deleting names resolves the classification. Removing names does not necessarily make research information anonymous, particularly when contextual details or combinations of variables remain.
If the information appears anonymous, consider whether it can nevertheless be linked, recognized, or remain sensitive at a group, institutional, cultural, commercial, or security level.
Gate 2: establish authority to disclose
The fact that information is on your computer does not establish that you can send it to an external service.
Authority may depend on participant consent, ethics approval, institutional policy, a data-management plan, data-use agreement, confidentiality agreement, collaboration arrangement, funder requirement, journal policy, sponsor contract, intellectual-property rules, or applicable law.
This becomes particularly important when the material belongs partly or entirely to someone else. You may legitimately possess a collaborator's unpublished work without having authority to submit it to AI.
If the information was entrusted to you for a limited purpose, such as confidential peer review or grant review, assume that purpose limitation matters unless the governing policy says otherwise.
Gate 3: evaluate the exact AI environment
"AI" is not one data environment. Consumer chatbots, enterprise workspaces, education products, APIs, institutionally hosted models, local models, temporary modes, and tools integrated into research platforms can have different safeguards and data-handling arrangements.
For example, OpenAI currently states that inputs and outputs from ChatGPT Business, Enterprise, Edu, Healthcare, Teachers, and its API Platform are not used to train its models by default. OpenAI also provides organizational controls over access and, for specified products, retention. These commitments differ from eligible personal workspaces, where model-improvement settings can be controlled separately.
Google's current Gemini Apps privacy guidance, meanwhile, explicitly tells users not to enter confidential information they would not want a reviewer to see or Google to use to improve its services when the relevant activity setting is enabled. It also documents different handling depending on activity settings and product context.
These examples illustrate why the relevant question is not "Is Company X safe?" It is "What are the current terms and controls of the exact environment I intend to use?"
An institutional or enterprise account can improve the position without answering every question
An institutionally approved AI service may provide contractual protections, encryption, access controls, configurable retention, audit capabilities, no-training commitments, data-processing agreements, and other governance mechanisms unavailable in an ordinary personal account.
That can materially change the risk. It does not automatically make the environment appropriate for every category of research information.
A university might approve an AI service for ordinary institutional documents while excluding protected health information, identifiable research data, controlled data, confidential peer-review manuscripts, export-controlled material, or highly sensitive intellectual property.
"Approved AI" should therefore mean approved for the information and use case concerned, not merely licensed by the institution.
A no-training commitment is useful but not sufficient
Whether research prompts can be used to improve AI models matters. It is not the whole safety decision.
A service can exclude content from model training while still processing and retaining information for legitimate operational purposes. Organizational administrators may have controls over workspace data. Connected applications may introduce additional data flows. Contracts, ethics approvals, or journal rules may independently restrict disclosure.
This is why whether research prompts are used for model training should be treated as one component of the environment assessment rather than as a universal safety test.
Gate 4: disclose only what the task genuinely requires
Even when the first three gates permit AI use, the safest input is usually not the largest input.
If you need help rewriting one paragraph, the AI may not need the complete manuscript. If you need advice about a statistical assumption, it may not need the dataset. If you need to test code, a minimal reproducible example may be enough. If you need to explore an analysis workflow, synthetic data may sometimes reproduce the structure of the problem.
Data minimization is not merely a privacy slogan. It changes the consequences of an error.
If the wrong account is used, a prompt is accidentally shared, a provider setting is misunderstood, or an integration sends information elsewhere, exposing 200 non-sensitive words is a very different incident from exposing an entire confidential research archive.
De-identification can reduce risk but should not become a ritual
Replacing names with participant numbers can be useful. It should not become a box-ticking procedure after which every dataset is declared safe.
Indirect identifiers, free text, rare cases, locations, dates, quotations, images, voices, and linkage with outside information can preserve identifiability. Even genuinely anonymous information can remain sensitive for other reasons.
Use the de-identification standard appropriate to the project and jurisdiction. Then ask whether the resulting information is actually necessary for the AI task.
Public information is usually the easiest category
If the information is already lawfully public, contains no confidential additions, and is not subject to another relevant restriction, confidentiality concerns are generally lower.
That does not eliminate every consideration. Copyright, licensing, terms of use, research integrity, accuracy, and institutional AI policy may still matter. But asking an AI system to explain a public statistical standard is not equivalent to uploading an identifiable interview transcript.
A useful AI policy should preserve that distinction rather than treating all research information as equally hazardous.
Synthetic and abstracted information can preserve utility while reducing disclosure
When the real information is too sensitive for the available AI environment, consider whether the research problem can be represented without it.
A synthetic dataset can mimic variable structure without reproducing participant records. A fictional case can illustrate a coding problem. A generic description can support methodological discussion. A short sanitized excerpt may be sufficient for writing assistance.
These substitutes must still be designed carefully. A supposedly synthetic example that closely reproduces a unique participant's story may not meaningfully reduce disclosure. The point is to remove the protected information, not merely relabel it.
Local or controlled AI environments may be appropriate in some settings
Some institutions may operate models locally or within controlled infrastructure so that protected information remains inside an approved technical and governance boundary. Other organizations may contract for enterprise services with specific security, retention, access, and data-processing arrangements.
Such approaches can support legitimate AI-assisted research involving information that would be inappropriate for a public consumer service. They still require governance. Security architecture, model access, logging, administrators, backups, integrations, data retention, legal obligations, and research approvals all matter.
"Runs locally" is therefore a technical characteristic, not a complete ethics or compliance determination.
Some material should stay out regardless of how useful the AI would be
When a journal prohibits reviewers from uploading confidential manuscripts, the convenience of AI does not override the rule. When a funder prohibits confidential application material from being entered into unapproved generative AI, a no-training setting does not create an exception. When a data-use agreement restricts processing to named systems, an external AI tool does not become authorized because its output is useful.
The same principle applies to other protected research information: the value of the AI task does not itself supply authority to disclose.
Uncertainty should change the action
Researchers sometimes treat uncertainty as permission: "I couldn't find anything saying I wasn't allowed."
For low-risk public information, that may be relatively inconsequential. For confidential or restricted research, silence is a weak basis for disclosure.
If you cannot determine whether a system is authorized, whether collaborators consent, whether the research protocol permits it, or what the provider does with the information, keep the protected content out while you clarify the issue.
That is the essence of the safest default: uncertainty about protected information should delay disclosure, not justify it.
If you make a mistake, treat it as an incident rather than hiding it
No workflow eliminates human error. Researchers will occasionally paste the wrong text, choose the wrong account, attach the wrong file, or misunderstand a setting.
If confidential information is accidentally disclosed, stop further disclosure, document the essential facts, use appropriate containment controls, and follow the applicable institutional process. The response is covered in detail in what to do after accidentally entering confidential research information into AI.
A culture in which researchers conceal mistakes because they fear embarrassment is not a privacy control. It is merely an incident-response problem waiting for tenure.
