Safe document review
How to check internal documents for AI safely
Before uploading anything, confirm that the document is allowed to leave the organization's approved systems. Share only the text needed for the review, remove personal and confidential data where possible, and treat the detector output only as a warning signal.
Direct answer: four checks before upload
- Check permission and policy. Establish who owns the document, whether an external detector is approved, and which retention, processor and access rules apply.
- Create a minimum-data copy. Export only the relevant pages or passage. Remove names, customer numbers, health data, signatures, passwords, API keys and irrelevant attachments.
- Check the extraction. Before interpreting a result, confirm that headings, text boxes, tables and paragraphs were read in the right order. A scanned PDF may need approved OCR first.
- Use human review. Let the signal identify one passage for closer inspection. Compare source material, versions and the content owner’s explanation; never turn the score automatically into an allegation or decision.
The ICO guidance on AI and data minimisation tells organizations to determine which personal data is actually necessary and to document data movements. The NIST AI Risk Management Framework calls for documented system limits, human oversight and context for how outputs may be used.
Do not upload without separate approval
- unredacted HR, medical, legal or disciplinary records;
- contracts under confidentiality duties or privileged documents;
- passwords, private keys, access tokens or security details;
- customer or personal data that is unnecessary for the text review.
Work from a minimum-data copy
Keep the original in the approved records system. Create a temporary review copy containing only relevant continuous prose, record what was removed, and delete the copy under the organization's retention policy. Pseudonymisation reduces risk but does not automatically make personal data anonymous.
Run the check
Use the document detector for an approved PDF or DOCX and the text detector for one cleaned passage. Review the human-review policy and privacy information before the result has any consequence.
Frequently asked questions
Can I upload a confidential document?
Only when organizational policy and the applicable agreements permit it. Otherwise use an approved internal route or do not upload.
Which data should I remove?
Remove anything unnecessary for the review question, especially identifiers, secrets, security data and irrelevant attachments.
Does the score prove an employee used AI?
No. It is a model-bound warning signal, not proof of authorship, intent or misconduct.