Practical guide
Recognize the value being protected
Research data, methods, source code, lab notes, unpublished manuscripts, invention details, sponsor information and commercialization plans are not ordinary workplace content. Their disclosure can affect agreements, ethics obligations, patent rights and institutional value.
Classify the workload
Separate public information from internal, confidential, regulated and commercialization-stage information. Consider who owns the data, who may access it, where it may be processed and how long it may be retained.
Match tools to the workload
Approved public services may be appropriate for some low-sensitivity tasks. Other work may require enterprise controls, private environments, local models, restricted knowledge sources or no AI use until conditions are clarified.
Review agreements and timing
Research sponsors, ethics approvals, data-use agreements, confidentiality obligations and patent timing can change what is permissible. Institutional legal, research, privacy and commercialization teams should remain involved.
Enable researchers and staff
Provide concrete examples, workload decision trees, approved-tool guidance and escalation routes. A rule that people cannot apply in daily work will not protect the institution.
Create the institutional roadmap
Connect governance and education to infrastructure, access control, approved knowledge, pilots and continuing review. The aim is a practical system for enabling discovery under appropriate control.