You need to draft an application, translate a certificate or write a family letter. You open an artificial intelligence (AI) chat and attach a document. The service receives everything inside it: a name, an address, health information and other people's messages.

So ask yourself two questions before sending. Is this information needed for the answer? Do I have permission to share it?

Quick takeaways

  • Send only what the task requires.
  • Protect other people's information as carefully as your own.
  • Check who will be able to read and use your data.
  • If the terms are unclear, ask a general question without personal details.

Why this is a matter of amanah

Amanah (أَمَانَةٌ) means something entrusted to you to safeguard. It can include another person's information. For example, a relative sends you a certificate. They have entrusted it to you, but have not necessarily agreed to share it with an AI service.

The Quran instructs us to return trusts to their rightful owners. Another verse forbids spying on others and backbiting. This is a brief paraphrase of the verses' meaning. Quran, 4:58, 49:12.

Hadith 32 in al-Nawawi's Forty Hadith teaches us neither to cause harm nor to respond with harm. Hadith text.

These general principles also help when using AI: safeguard what is entrusted to you and consider the consequences. The following provisions of the Islamic Code of AI Use address them:

  • 2.2.26 — protecting honour and private life;
  • 2.3.8 — protecting entrusted data;
  • 2.2.4 and 2.2.18 — removing and preventing harm.

What to find out about the service

Different services have different rules. Before uploading a document, check four things:

  1. Who will be able to access it?
  2. Can it be used to train AI?
  3. How long will it be stored?
  4. What exactly is deleted when you delete a chat?

Turning off training does not mean the data is not stored anywhere. These are separate questions.

NCSC (the UK's National Cyber Security Centre) recommends not entering sensitive information into publicly available AI chats. Examples include health information or details of personal relationships. The centre's guidance.

OAIC (the Office of the Australian Information Commissioner) warns that, once data is sent, controlling its use and deletion can be difficult. Some AI features pass information to other services, such as a search engine. The office's guidance.

Allowed / Use caution / Not allowed

You can ask for an application template. Let it contain fields such as “name”, “address” and “date” instead of personal details. Fill them in yourself after receiving the answer. Use fictional entries to practise working with spreadsheets.

Use caution with certificates, family photographs, correspondence and children's documents. First consider whether they are needed at all. To explain an unfamiliar word in a certificate, the word alone is usually enough.

Do not use AI to invade private life, disclose entrusted secrets or harm people. Sections 2.2.26 and 2.3.8 of the Code address these boundaries. Do not put passwords or verification codes into chatbot prompts either.

How to prepare a prompt

  1. Describe the task in your own words. For example: “Help me politely reschedule a meeting.” There is no need to forward family correspondence for that.
  2. If the information belongs to someone else, check their permission to share it. Explain what you want to send and to which service. Even with consent, send only what is necessary.
  3. Prepare a separate copy of the relevant excerpt. Remove names, phone numbers, addresses and document numbers from it. Keep the original yourself.
  4. Check the remaining details. Even without a name, a person may be recognised from a combination of workplace, an unusual job title and the date of an event.

ICO (the UK's Information Commissioner's Office) explains that removing a name is not enough to guarantee that someone's identity is concealed. Other information also needs to be considered. The office's explanation.

Common mistakes

“I changed the name, so it is safe now.” Check whether the person can be recognised from the other details.

“It is for a good cause.” A template for a charitable aid report does not need the beneficiaries' real names, addresses or diagnoses.

“I will delete the chat afterwards.” First find out what the service deletes and when. Do not treat the delete button as a guarantee that every copy disappears.

When to seek help

Are you working with information about employees, students or beneficiaries? First consult the person responsible for data protection in your organisation.

Accidentally sent a personal document? Do not send further information. Contact the service's support team and a security specialist. They can help determine the next steps.

If you are unsure whether disclosing an entrusted secret is permissible, ask a knowledgeable scholar.

Brief reminders

Pause for a minute before sending. Remove unnecessary details. Check permission and the service's terms. This turns care for amanah into a concrete action.

This guidance is for information and is not a fatwa. In doubtful cases, consult a knowledgeable scholar. This article is not a legal opinion.