• Drafting emails and replies
• Preparing quotes and job descriptions
• Summarising documents
• Creating content and back-of-house materials (policies, procedures, checklists)

Many AI tools store the information you input and may use it to “learn” — meaning your data could be processed outside your secure business systems and, in some cases, exposed to the wider public. Once uploaded, information can be very difficult (or impossible) to remove.

1. Does this contain personal or confidential information?
2. Can I remove or redact identifying details?
3. Do I understand how this tool uses my data?
4. What are the privacy and security settings?
5. Has the AI’s response been checked for accuracy?

• Client or employee personal details
• Banking and payment information
• Passwords and access codes
• Contracts, plans and other confidential documents

• Redact and anonymise: Remove names, addresses and financial details; use dummy data where possible
• Keep it generic: You can usually achieve the same outcome (e.g. a payment dispute email) without including sensitive specifics
• Avoid free versions: Paid tiers typically offer stronger privacy controls and settings
• Check the fine print: Review the privacy policy/terms of use for whichever tool you use
• Apply critical thinking: Don’t take AI outputs as fact — always verify against reputable sources before relying on them commercially
• Rule of thumb: If in doubt, leave it out

A privacy slip-up with AI can escalate into a full cyber incident, potentially resulting in:

• Client complaints over unauthorised disclosure of personal information
• Financial and reputational damage
• Mandatory notification obligations (and associated costs/penalties)
• Data recovery and system restoration costs
• Third-party compensation claims
• Business interruption if systems are compromised

1. Set clear policies — define how you and your staff are permitted to use AI tools in the business
2. Review your insurance — check existing cover for gaps relevant to cyber/privacy risk
3. Compare cyber insurance options — understand the conditions and requirements of any policy
4. Know your emergency contact — have a plan for who to call if a cyber incident happens out of hours

• Access to cybersecurity and forensic specialists for initial response
• Guidance on legal and privacy obligations (e.g. reporting to the Privacy Commissioner)
• Support notifying affected clients
• Claims process guidance and connection to insurers’ response teams and legal partners

• Personal/confidential info removed or redacted?
• Tool’s data usage and privacy settings understood?
• Response accuracy verified against reliable sources?
• Cyber insurance cover confirmed (existing or new)?
• Emergency contact/process known in case of a breach?

Hello and welcome to episode four of our mini series. I’m Daniel from Weber Insurance Services, the tradie wives insurance partner. Today, we’re going to be talking about artificial intelligence, privacy and how it impacts your business. Before we get started, always worth noting that this is, general information only.

If you would like personal information, we can do so. It needs to be in a one on one context. Make sure you seek appropriate advice before taking any action. So I thought we’d start with something very topical and how tradies and just general people are using artificial intelligence.

A lot of people now using tools like ChatGPT, Microsoft Copilot or Claude to help draft emails, send replies, you know, maybe doing quoting for jobs, job descriptions, summarizing documents, creating content or preparing some of your back of house, your policies, procedures, checklists and those sorts of things. It is very good for doing a lot of this heavy lifting of text rich documentation.

Just be mindful about what you are putting up in those systems and that’s what we’re gonna be focusing on today. The main issue that you’re faced with is from a privacy point of view.

Keeping in mind that a lot of the information, if not all of it, depending what program you’re using and which version of the software, they store a lot of information and the programs actually use it to learn and spit out to other people.

So you need to make sure that the way that you’re uploading is in line with what your client’s expectations are of your privacy and making sure you’re adhering to use, policy procedures of the actual software you’re using.

The information here, you know, can be processed outside your usual systems, your business systems. So if you keep things securely stored and you start uploading things on, you know, ChatGPT, then that may be outside your ecosystem from a security point of view and you might be exposing your client’s information.

Once you put it up there, it can be very hard to take down or not possible at all. Once it’s out there, it’s generally out there. So from a business point of view, make sure you treat it differently to the way that you work within your own business ecosystem from a security point of view. Just keep in mind that if you’re particularly if you’re using free versions of the software, a lot of that information is then gonna be out to the to the wider public.

So I’ve just got a scenario here. Something common that a lot of people are using it for now is writing emails. So you might, draft an email about a payment dispute. So you go ahead and upload your client’s name, contact information, the address of the property.

You might attach a copy of the quote which has the scope of works. You might have included payment and banking information on there, that was ordinarily on your quote or your invoice, and you might provide some context about the disagreement. So the problem with this specifically is that you’ve probably put in too much information than what you actually need to achieve the same outcome. You could probably get the same outcome by, redacting some of the names, information, bank accounts, personal information and and just keep it generic.

So before you upload things and particularly if you’re going to be attaching documents, just think about what you’re putting, on these systems before you actually do it. So think before you upload. So you should avoid sharing client or employee information, banking payment information, passwords, access codes, contracts, plans and other documents that are confident. To use it more safely, like I said, remove names and identifying details, use dummy information instead of real, check the privacy settings of the tools you’re using, whether it’s ChatGPT or Microsoft Copilot, Claude or whatever program, and from an accuracy point of view, don’t just take what it says as gospel.

Make sure that you review the response and use your own, critical thinking before using it. If you’re not sure if you should include information in there, best to probably leave it out. Less is more in in these situations. Privacy mistakes can easily lead to a cyber incident which can have implications for your business and also from an insurance point of view.

If you are inadvertently disclosing confidential information, if you’re exposing your clients or your employees’ details, if now there’s there’s commercial implications because information’s been, accessed by the wrong person, you might have a complaint from your client that you’ve disclosed their personal information without their consent, which can lead to financial and reputational damage. So, these sorts of things can lead to a cyber incident which may be covered under a cyber liability insurance.

So how cyber insurance might help in these situations?

They, generally provide cybersecurity and forensic specialists a point of call, at least an initial response, an incident response, which can help you triage and maintain expectations and liaise with clients and other stakeholders. They’ll provide usually advice around your legal and privacy obligations, whether it needs to be reported to the privacy commissioner.

If it does so, there is obviously costs associated with that and there may be fines and penalties that come along with it. You may be required to notify your client base more broadly if you have breached and you are required to disclose that information.

There may be costs associated with recovering data and restoring systems, crisis management, you may get claims for compensation from third parties alleging that you’ve cost their business money. And also, all this may impact your own business if you’re not able to use your system. So as always, consult your insurance adviser for detailed advice. So how can we help in these situations?

So before an incident, understand how your business uses technology. The best thing to do would be have, you know, a policy and procedures with how you and your staff actually adhere to these and what you are and are comfortable with from a business point of view. I would also, where possible, try to avoid the free versions of these softwares. Typically, privacy settings are a lot looser.

The paid versions, you often have a lot more control over what happens with your data, so you should most certainly look into that. Obviously review your current insurances and identify if there are gaps. That’s something we can help you with. Compare and consider options that your insurance provider puts forward and understand what the conditions are of that insurance policy to make sure that you’re complying with all the requirements.

So if you do have a cyber event and you are unfortunate in that situation, then what we’ll do is help notify the insurer, we’ll guide you through that claims process, we’ll connect you with the relevant insurers’ response teams and legal partners and provide support throughout the course of that claim. So the final takeaways before using AI, ask yourself, does this contain personal or confidential information? Can I remove or redact identifying details? If you can, you should do it. Do I actually understand how these tools are using the data that you’re uploading? What are the security settings? What are the privacy agreements that you’re signing up to?

Has somebody checked the final response? So more so from a quality assurance point of view, is the information that has been spat out accurate and am I going to rely on that in a business sense? Have you verified from reputable sources that the information is accurate?

Do you know if you have cyber insurance? Is it covered by existing policies? Do you need new cover? That is something that you should consider. And do you actually know who to contact or who to call if you have a cyber event at ten o’clock on a Sunday night? So all these sorts of things are critical to understand and make sure that you’re using these artificial intelligence tools more safely within your business. If you have any questions, as always, the team twweberinsurance dot com.

The phone number is presented on screen as well. If you have any questions, we really look forward to hear from you. Thanks again. We look forward to our next session.