Using AI safely at work: HR, legal and healthcare

If your job involves other people's personal data, AI can save you real time, but only if you use it without exposing that data. HR, legal and healthcare teams handle exactly the kind of information that should never be pasted into a public chatbot. Here is a practical way to use AI safely at work.

The risk by role

• HR. CVs, contracts, sick-leave notes and performance reviews are full of names, addresses, BSNs and sometimes health information.
• Legal. Contracts, case files and correspondence contain client identities, financial details and privileged material.
• Healthcare. Patient records are special-category data under the GDPR, with the strictest protection of all.

In each case the useful part for AI (the structure, the wording, the reasoning) is separate from the identifying details. That separation is what makes safe use possible.

A simple policy that works

1. Never paste raw personal data into an external AI tool.
2. Anonymise first on the device, replacing names, IDs and contact details with placeholders.
3. Review before sending, so a person confirms what is masked.
4. Restore locally when the answer comes back, if you need the real values.
5. Prefer local tools for the detection step, so nothing sensitive is uploaded just to be cleaned.

This is easy to follow because it does not ask people to stop using AI, it just adds one step before the paste.

Why local matters here

For regulated teams, an anonymiser that sends text to its own cloud is barely better than pasting into the chatbot directly. A local tool keeps the personal data on the machine, which is far easier to justify to a data protection officer, a client or a regulator. It also works offline, which suits environments where uploading documents is simply not allowed.

Redacto was built for this: on-device detection of names, emails, addresses, IBANs and the BSN, with a review step and one-click restore. For the underlying method, see anonymising personal data before you use AI.

Bottom line

Teams that handle personal data do not need to avoid AI, they need a habit: anonymise on the device, review, then prompt. Add that one step and HR, legal and healthcare can use modern AI without putting anyone's data at risk.