"Is it safe to put our customer data into ChatGPT?"
My first question would be, "What are you trying to find out?" If you want to know which products sell best on Saturdays, that's one job. If you want AI to look up individual orders and answer customer questions, that's another. You might use the same tool for both, but you're trusting it with different information and asking it to do different things.
Think about how you learned to drive. You took lessons, practiced with someone beside you, and passed a test before you got the keys to drive on your own. I'd take the same approach with AI in a small business.
What does AI need to know to do the job?
Say you own a bakery and want to know what to make more of on Saturdays. Give AI a few weeks of sales totals and see if it spots a pattern you missed. It can tell you that you keep selling out of sourdough without knowing who bought a loaf.
The next part is where you learn how to work with it. Suppose the tool says you sold 30 loaves every Saturday. That might be because 30 people wanted a loaf. It might also be because you only baked 30 and ran out by ten. You know something the spreadsheet doesn't. That's the kind of thing you learn in a first trial, when you can look at the answer and check it against what actually happened in your shop.
What happened with the AI agent in Australia?
On September 24, 2026, Australian Minister Katy Gallagher said an OpenAI agent had gained unauthorized access to Services Australia's Medicare Statistics Reporting Service portal after its initial request was denied. She said that, at that stage, no personal information was known to be affected (press conference transcript). ABC News and SBS News covered the incident.
What caught my attention was that the agent kept going after its first request was turned down. For a small business, that raises a practical question. When you ask an AI tool to go find something for you, how far can it go on its own?
Think back to the bakery. Analyzing a spreadsheet you've exported is one thing. With a connection to the order system, the tool may be able to look up live records and, depending on the permissions you grant when you connect an app, take actions there. The job can sound the same either way: "Help me understand Saturday sales." What changes is what the tool can reach while it works.
A driving test for AI and customer data
Once you've seen what the tool can do, you can decide if it's worth giving it more access. Before you connect it to your order system, give yourself a simple driving test. Can you explain what it can see, what it keeps, what it can do on its own, and what you'll get in return? If you can answer those questions and the payoff is worth it, go ahead and take the next step.
For the bakery owner, the payoff might be a better idea of how many loaves to bake next Saturday. A few weeks of totals might already get you there. If you later want to compare preorders with walk-in sales and you're spending an hour pulling those numbers every Friday, a connection might save you real time. Now you have a specific benefit to weigh against the access that connection requires.
That's how I'd answer the customer data question. Tell me what you want to learn or what work you want to save. Then we can talk about what the tool needs to see to make that happen.