Use a Redaction Pass Before Sharing Information with AI

AI tools can help organize notes, improve a draft or summarize a long document. The risk begins when someone copies the source material without noticing the personal or confidential details inside it.

A useful prompt rarely needs every name, address, account number or internal reference from the original file. Leaders can reduce unnecessary exposure by building a redaction pass into the routine before any information is shared.

The NIST Generative AI Profile identifies privacy impacts related to the leakage, unauthorized use, disclosure or de-anonymization of personal and sensitive information. A practical response is to provide only the information needed for the task.

Use the Purpose–Remove–Replace check

Purpose: Write one sentence describing what you want the tool to do. If a detail does not help complete that purpose, leave it out.

Remove: Delete personal identifiers and confidential details that are not necessary. These may include names, phone numbers, email addresses, exact home addresses, employee or client IDs, account information, private financial figures and unreleased contract terms. Passwords, security codes and access credentials should never be included.

Replace: When context is still needed, use neutral placeholders such as “Client A,” “Employee 1” or “Project North.” Replace an exact date, location or amount with a general description when precision is not required.

Check: Confirm that the tool is approved for the type of work and consistent with your organization’s policies. If the information remains sensitive or the rules are unclear, stop and ask the person responsible for privacy, security or compliance.

After the tool responds, review the output before saving, sharing or publishing it. Make sure removed details have not been added back from another source or inferred in a way that identifies a person.

A hypothetical workplace example

Imagine a manager wants help grouping themes from employee feedback notes. The original notes include names, work locations and descriptions of specific incidents. The manager removes the names and locations, replaces unique project names with neutral labels and keeps only the comments needed to identify recurring workplace themes.

The manager uses an approved tool, reviews the summary for accuracy and privacy, and shares only the final themes with the leadership team.

Try this today

Choose one document you might use with an AI tool. State the purpose, remove unnecessary details and replace essential identifiers with neutral labels. If you cannot explain why a sensitive detail is needed, do not include it.

For support with responsible technology use and organizational practices, explore SLNSE’s strategic consulting services.