I use AI tools every working day, and I'd rather you heard that from me than wondered. This page sets out what I use them for, how, what happens to your data, and where the lines are. It's only as good as the hands operating it, like any tool.
By default an AI tool sees structure: column names, sample rows, redacted snippets. It does not see your records. If a job genuinely needs real data, we agree first: which tool, what data, and under whose contract.
Read my data protection policyWhere we agree to use AI tooling against your systems, it runs with strict, scoped permission tokens and clear guidelines, so it cannot make the mistake in the first place because it does not have the access. I never rely on good prompting to keep something safe.
Nothing is hidden. This page exists so you know how I work before you have to ask, and I'll say plainly where AI contributed to something you receive.
AI is a tool, like a compiler. What ships is mine: reviewed, tested against real cases, and mine to stand behind and maintain.
Saying "I use AI" tells you nothing. What matters is where it sits in the work, and what I always do before something reaches you.
The default engagement never needs an AI tool to see your real data. I work from structure (column names, a handful of sample or made-up rows, redacted snippets) and your records stay where they are.
Sometimes a job genuinely does need more than that. When it does, we have the conversation before anything happens, and we agree it in writing: which tool, exactly what data, and whose contract it sits under. Often the right answer is yours: if your organisation already runs Claude Enterprise or Microsoft Copilot in its own tenant and you give me access, I will use that, because your data then stays covered by the terms you have already agreed with that provider. If that's not an option, the alternative is a tool and a scope you have explicitly approved. Either way, there is no quiet default.
There is usually a middle path, too. Where a job needs realistic data but not your data, I can build a sanitiser specific to your dataset: it produces a dummy set with the same shape, quirks and edge cases, without exposing a single real record. Whether that is needed depends entirely on the job.
I have worked under UK GDPR and the Data Protection Act 2018, EU GDPR, and HIPAA, so the regime you operate in will not be new to me. I have worked with clients across the world, and I will work to the requirements your organisation sets.
My standing data protection policy (what I hold, where, and for how long) is a separate document and applies whether or not AI is involved.
The honest limits are the reason you're hiring a person.
Requirements, edge cases and 'that column is always blank on a Friday' still come from talking to the people who do the work.
Licensing, delegation limits, connector quirks. Verified every time.
Running the thing against real cases is the job, and the tool cannot do that part.
Their foibles, their psychology, the trouble they'll have with a new workflow, the reality of operational deployment. It doesn't know how to deliver change. That comes from years as an operational manager, and it's the part of the work that matters most.
Ask. If your organisation has its own AI policy, send it over and I'll work to it.
Get in touch