The three-tier data rule
Sort your business data into three tiers before any of it touches an AI tool. The tier decides which tool is allowed to see it. That one sorting exercise settles most of the questions I get from accountants, lawyers, medical practices, and anyone else who holds other people's information for a living.
The reason this matters more for AI than it did for the software you already use is simple. Software stores your data. AI reads it. Everything you paste into a chat window gets processed, and under some account types, it can be kept and used to train the next model. So the question is not whether to use AI. It is which data goes where.
The three tiers
Green is public. Website copy, marketing, your menu, your hours, press you have already published. Anything a stranger could find by looking. Green data can go into any AI tool on any account, including the free one.
Yellow is confidential. Pricing, internal processes, client emails, contracts, vendor terms, anything you would not post on your website but that is not regulated by law. Yellow data goes only into business-tier accounts where the vendor agrees in writing not to train on it, or into a model running on hardware you own.
Red is regulated. Social Security numbers, health records, payroll, bank and card numbers, tax returns, anything a specific law tells you how to protect. Red data runs on a computer you control, or it does not touch AI. For practices that handle a lot of red data, a dedicated machine in the office that runs the model locally is the cleanest answer; I write about that path at maaimachines.com.
Most of what a small business does every day is green or yellow. The tiers are not a reason to hold back. They are a reason to experiment freely with the right account and keep the one category that can hurt you off the cloud.
The part most people do not know
The twenty-dollar personal plan and the business plan from the same company treat your data differently. This is the single most common gap I find when I sit down with a firm.
Anthropic changed its consumer terms in August 2025 so that chats on the Free, Pro, and Max plans may be used to train future models unless you turn the setting off, with retention extended to five years for those who leave it on. Claude for Work, Team, Enterprise, and API use are excluded from that policy under the commercial terms (Anthropic, Updates to Consumer Terms and Privacy Policy).
OpenAI states that it does not use data from ChatGPT Business, Enterprise, Edu, or its API platform to train or improve its models by default, and that qualifying organizations can set retention down to zero on the API. Consumer ChatGPT accounts fall under different terms, and training is on unless you turn it off in settings (OpenAI, Business data privacy, security, and compliance).
Google follows the same shape. Conversations with the consumer Gemini app on a personal Google account can be used to improve Google's models and reviewed by humans while activity is on. Gemini inside a paid Google Workspace plan is governed by the enterprise agreement and is not used for training (Axios, November 2024, reporting Google's stated policy).
The pattern is the same at every major vendor. Consumer plan: training on by default, turn it off yourself. Business plan: training off by contract. The $20 plan is fine for green data. Yellow data needs the business plan or your own hardware. Verify the current policy pages before you rely on them; they change, and the versions above are as of October 2026.
The two moves this week
First, put everyone who uses AI for work on a business-tier account. The price difference is small compared with the exposure. If someone keeps using a personal account, find the training toggle in its privacy settings and turn it off. That stops future chats from being used; it does not pull back anything already used.
Second, hand your team the three-tier card and have each person tag the data they touch. Green, yellow, red. Fifteen minutes, and it ends the guessing. The card is in the newsletter welcome kit if you want the printed version.
If you hold regulated data
Two rules come up most often in Savannah, so I will name them.
Tax and accounting practices. The FTC Safeguards Rule under the Gramm-Leach-Bliley Act treats tax preparers as financial institutions and requires a written information security plan. The IRS reinforces this in Publication 4557 and has published a template in Publication 5708 (IRS Office of Professional Responsibility, 2023). If you have a WISP, AI tools belong in it. If you do not, you have a bigger problem than AI, and the plan is the place to start.
Medical and dental practices. A business associate agreement is required before protected health information goes into any cloud AI tool. The major vendors offer BAAs on specific tiers; OpenAI, for example, offers one for its healthcare and API products (OpenAI). No BAA, no patient data. Treat it as red and keep it local.
For attorneys, check your state's professional conduct rules on confidentiality and supervision; several state bars have issued AI-specific guidance since 2024. I am not a lawyer, and this is not legal advice. The tier system is a starting point for that conversation, not a substitute for it.
The second data rule: structure in, structure out
The first rule is about which AI may touch your data. The second is about whether the data is worth touching.
The most valuable data most small businesses own is conversational: email, texts, meeting notes, call transcripts. That is where the know-how lives. It is also almost never organized. An AI handed a messy pile produces a messy answer. An AI handed sorted, labeled, consistent inputs produces something you can use.
The output should be structured too. A table. A filled template. A report in the same format every time, so the next step can pick it up without a person reformatting it. When a business tells me the AI "just doesn't get our stuff," nine times out of ten the stuff was never in a shape anything could get.
People skip this because it is not exciting. It is where the results come from. Gartner, in February 2025, predicted that through 2026 organizations will abandon 60% of AI projects that are not supported by AI-ready data, and reported that 63% of data leaders surveyed either lacked the right data practices for AI or were unsure whether they had them (Gartner, February 26, 2025). That is a prediction about large enterprises, but the mechanism is identical at ten employees. The model was never the problem. The pile was.
Where to start
Pick one category of conversational data your business produces every week. Customer emails, job notes, intake forms. Decide what one clean record should contain: who, what, when, what was decided, what happens next. Get the last twenty into that shape by hand. Then hand the twenty to an AI tool on the right tier and ask it the question you actually want answered.
That exercise takes an afternoon. It tells you more about what AI can do for your business than a month of chatting.
If you want help sorting your data and picking the right accounts, book a free fit call. Bring one process and the data it touches; you leave with a tier map for it. The newsletter sends the three-tier card and the rest of the welcome kit to new subscribers.
Sources: Anthropic, Updates to Consumer Terms and Privacy Policy (August 2025); OpenAI, Business data privacy, security, and compliance; Axios on Google's Gemini data policy (Nov 2024); IRS Office of Professional Responsibility on the FTC Safeguards Rule and WISP requirement (2023); Gartner press release, February 26, 2025. Vendor policies checked October 7, 2026.