Yes, you can get in trouble for using AI at work even when your employer has no written AI policy, because the rules that trip people up are usually older ones — confidentiality clauses, acceptable-use policies, and intellectual-property terms in your contract — that never mention AI by name.
A missing AI policy is not permission; it just means nobody has written down the rules yet, so the default rules in your employment contract and your company's existing IT and conduct policies still apply.
The practical risk falls into three buckets: leaking confidential or client data into a tool, producing work that violates someone else's rights or your company's disclosure rules, and creating a record that looks like you hid something.
Start with the documents you already signed. Open your employment contract and employee handbook and search for four clause types. Confidentiality or non-disclosure clauses cover information you learned at work, and pasting a client's internal figures into a chatbot is a disclosure whether or not the word "AI" appears anywhere.
Acceptable-use or IT-security clauses often ban sending company data to third-party services without approval — a chatbot is a third-party service. Intellectual-property or moonlighting clauses matter if you use AI to build something on the side, because some contracts claim ownership of work related to your employer's business.
Finally, check any client contracts your team has signed: many contain data-processing terms that restrict where client data can be processed, and a consumer AI tool is usually not a covered location. If you want a plain-language walkthrough of the workplace side, our guide on whether you can get in trouble for using AI at work or in a job interview covers the interview angle too.
Here is a worked example. Suppose you're a marketing coordinator at a small agency. A client sends a spreadsheet of last quarter's sales by region and asks for a blog post.
You paste the spreadsheet into a chatbot and ask it to draft the post. Three things just happened. You moved client data to a service your agency has no agreement with, which likely breaches the client's contract.
You created an unlogged copy of data your company was trusted to hold. And if the client later audits vendors, the agency has to explain it. The safer move costs you two minutes: strip the numbers, describe the shape of the data instead ("sales rose in the north and fell in the south"), and ask for the draft from that description.
You get the same draft without moving anything sensitive. For a tool like Midjourney, which our AI tool database lists at $10/mo on the Basic plan and $30/mo on Standard, the same logic applies to uploaded reference images — an unreleased product photo is confidential material.
When there's no policy and no clear answer, use this if/then checklist. If the tool offers a training opt-out and your employer has no policy, then treat the opt-out as the minimum and still avoid client-identifiable data. If the content is client-identifiable, then never paste it, regardless of opt-outs.
If you're unsure whether something counts as confidential, then ask before you paste, not after. If you're using AI for a side project, then re-read your IP and moonlighting clauses first. If you're asked in an interview whether you use AI, then answer honestly about how you use it and what you don't put into it — claiming you never use it is a worse answer than describing your boundaries.
A short written question to your manager works better than guessing: "I'd like to use an AI writing tool for first drafts of internal summaries. It would not include client names, figures, or anything from the client contracts. Is that okay, or should I route it through IT?"
That message does two things — it gets you a real answer, and it puts your caution on the record.
The limits are worth naming. This advice cannot tell you what your specific contract says, and employment law varies by country and state, so a clause that's unenforceable in one place may be standard in another. Company policies also change fast, and an approval that was fine last year may be reversed.
Nothing here is legal advice, and if the stakes are high — a regulated industry, a client with strict data terms, or a dispute already underway — a lawyer or your HR team is the right call. The honest summary: no policy is not a green light. The rules you already agreed to are still the rules.