Using Generative AI Safely: Cheat Sheet for Employees

• Enter only what the task needs: personal data must be limited to what is necessary (Art. 5(1)(c) GDPR); the BSI advises handling sensitive data sparingly (M18).
• Use placeholders such as [Customer A] instead of names. If the link can be restored with additional information, the data remains personal data (Recital 26 GDPR).
• Uploads count as input (BSI R2); the model also reads metadata, annotations, and comments (BSI, baseline protection), text in screenshots, and text under redaction bars in PDFs (OWASP LLM02:2026).

The BSI recommends defining in binding terms which AI applications may be used for what, what may be entered, and how results may be reused, and blocking or enabling services selectively (M16). This is because operators of internet services can access inputs and outputs and, depending on the terms of use, use them for training (BSI R2).

• Work account only: private accounts and consumer versions are off-limits for company data unless your company rules otherwise.
• Extensions, plug-ins, and agents only after approval: if third parties offer add-on functions such as managing email, data may leak to them (BSI R2).
• Image generators: some publish images together with the prompt and user name by default (BSI R2).
• Microsoft Copilot (formerly Microsoft 365 Copilot, with a work account) only shows data for which you have at least view permission (Microsoft Learn). If you see something that is not meant for you, report it.

Generative AI produces statistically likely outputs that can be worded confidently and still be wrong; NIST calls this confabulation, colloquially known as hallucination (NIST AI 600-1, 2.2). Because the texts seem coherent, they are easily adopted without checking (automation bias, BSI R8; NIST 2.7).

• Ask better questions: allow “I don't know,” have the model use only the documents provided, and require a quote and source for each statement; differing answers to the same question can indicate hallucinations (Anthropic).
• Even this does not eliminate hallucinations completely: always check critical information (Anthropic), and check outputs before passing them on to others (Microsoft).

In an indirect prompt injection, instructions to the AI are hidden in content that the model processes, such as a web page, a document, an email, or an image; you neither wrote nor saw them (OWASP LLM01:2026, NIST 2.9). Typical hiding places are white text on a white background, invisible Unicode characters, metadata, and comments. According to the BSI, there is no reliable countermeasure that eliminates the problem completely (BSI, baseline protection 2026).

• Few permissions: limit the access and execution rights of AI applications to the minimum (BSI M17). If you have email summarized, the assistant does not need permission to send (OWASP LLM03:2026).
• Confirm yourself: privileged, irreversible, or externally visible actions only after human confirmation; check the action itself, not just its summary (OWASP LLM01:2026, measure 7; BSI M17).
• Dangerous combination of three: access to private data, reading third-party content, and external communication or changes. In that case, OWASP recommends having a human approve every single action (LLM01:2026, measure 8).

• Disclose deepfakes (Art. 50(4), first subparagraph): deployers who use AI to generate or manipulate image, audio, or video content that resembles real persons, places, or events and would falsely appear authentic (Art. 3(60)) must disclose this; for evidently artistic or satirical works, in a limited form. Applies since August 2, 2026 (Art. 113).
• Disclose AI texts (Art. 50(4), second subparagraph): published AI texts that inform the public on matters of public interest must be disclosed, unless they have undergone human review or editorial control and someone holds editorial responsibility.
• Provider obligations (Art. 50(1) and (2)): AI notice for chatbots, machine-readable marking of synthetic content; for systems placed on the market before August 2, 2026, Art. 50(2) must be met by December 2, 2026 (Art. 111(4)).
• Promote AI literacy (Art. 4): providers and deployers, which includes your employer if it uses AI under its own authority (Art. 3(4)), take measures to support the development of their staff's AI literacy; a specific level does not have to be guaranteed. Amended since July 27, 2026; previously, the text required ensuring “to their best extent” a “sufficient level” (Regulation (EU) 2026/1744).

What this means for you (TOMORIS recommendation): always label deepfakes, route publications through the approval process, and attend training. According to the European Commission, a certificate is not required; companies can document training internally (AI Literacy Q&A).

Before sending a prompt, an upload, or a connection to your mailbox and files:

• Am I using an approved tool with my work account?
• Which traffic light level does the data have, is the tool approved for it, and are placeholders enough?
• Does it contain credentials, comments, metadata, or redacted passages that must not leave the company?
• Does the content come from an unknown source? Then watch out for hidden instructions.
• Does the assistant really need access to my mailbox, files, or browser for this?

Before using a result, confirming an action, or publishing:

• Have I checked facts, figures, and sources: does every source exist, and does it really say that?
• Is anything important missing from the summary, such as exceptions, time references, or risks?
• Has the code been reviewed and tested, and do the suggested packages really exist?
• Do requests, links, and actions fit the task, and have I read the recipient, content, and destination?
• Does the result need to be labeled or approved before publication?

For managers: define tools, data classes, and the reporting channel (AI usage policy template), document training, and clean up permissions, for example in SharePoint (Microsoft Learn).