AI hygiene for individuals

Every AI tool you use is third-party. Even Claude Code running on your laptop calls Anthropic's API. Even Copilot "in your tenant" has Microsoft on the other end. The only fully first-party AI is what you train and host yourself, which for an individual essentially does not exist. So for a person, personal AI hygiene is third-party risk management. They are the same thing.

Why hygiene, not security

Security implies a perimeter, firewalls, vendor audits, an IT team. That is not what an individual does. Hygiene is habits at different cadences: wash your hands every time, brush twice a day, see the dentist quarterly. Each habit is small; together they lower the base rate. You will not eliminate the risk. You will lower it enough that when something goes wrong, the damage is bounded and your response is rehearsed. That is the right ambition.

Six things to keep clean

• Data, what goes in. Before you paste or attach, ask what class the data is and whether this tool's tier allows it. If you cannot answer both quickly, do not send it yet.
• Identity, who's logged in. Treat AI accounts and API keys like your bank login: multi-factor on everything, keys named by purpose and rotated, grants kept tight.
• Capability, what the AI can do. An AI tool is the AI plus the connectors and grants you gave it. "Full access so I stop approving" is how a convenience becomes a capability you forgot about.
• Memory, what persists. Prune what the tool remembers about you. If you cannot recall what is in your memory file, you do not have memory, you have an unaudited system writing your future behaviour.
• Output, what you trust coming back. The tool is fluent, so output reads right whether or not it is. Verify citations, numbers and code before you forward anything. The fluency is the failure mode.
• Vendor, the underlying relationship. Terms change, sub-processors get added, features auto-enable. A quarterly thirty-minute check-in keeps you from signing a new contract you never read.

The red flag that catches the rest

You can carry one line: would I be embarrassed if a colleague saw exactly what I pasted into the prompt? If the answer is yes, that embarrassment is the signal, not the punchline. It is the leading indicator that your hygiene has slipped, and it catches most of the others before they become a problem.

It is the floor, not the ceiling

Be honest about the limit. Individual hygiene is necessary, not sufficient. It does not cover regulatory compliance, contractual obligations to clients, tenant misconfiguration, or a catastrophic vendor breach. Those live with your firm's governance, legal, and IT. If your work touches them, hygiene is the floor you stand on, not the whole building.

Work with me

I run this as a drop-in session in my training, and it pairs with what to watch for in the AI tools themselves. See the courses and workshops, read more on AI risk management, or get in touch.