AI security in business: what should you watch out for? before somebody pastes a contract into a chat

01

Is your team already using AI without your knowledge?

Assume yes, and start from that assumption. The model sits in the browser, on the phone, and inside the tools your team keeps open for eight hours a day: Google Workspace, Microsoft 365, Slack, Notion. Signing up takes a minute and needs no approval from IT.

So the question is not „whether”, it is „on what terms”. Until there is an answer, everyone sets their own, and the company finds out during an audit or from a customer. Start by asking who uses it and what for, not by looking for someone to blame.

• A salesperson pastes an email thread to get a summary before a meeting
• Marketing drops in an individual price list, because the quote is built from it
• Somebody in finance checks a clause from a contract they do not understand
• A developer pastes a chunk of production code together with the config
• A recruiter pastes a candidate's CV and asks for an assessment

02

Which data must not leave the company?

Banning everything is easy to write and impossible to enforce. The opposite works: a short list of categories that go nowhere, plus an explicit sentence saying the rest is fine.

The list below is the starting point we write down during training and then fit to the industry. An accounting firm adds client documents, a software house adds code covered by a customer contract, an e-commerce business adds order data from BaseLinker or Shopify.

Five to seven categories is enough. A longer list stops being a list, and a rule nobody can recall while typing will not be there at the moment it was meant to help.

03

Personal or company account with the model vendor?

The difference does not sit in the quality of the model. It sits in the contract and in the settings. The same question, asked from a personal account and from a company account, is handled differently on the vendor's side.

In the consumer tiers the content of conversations is sometimes used by default to improve models, the history stays on the employee's account after they leave, and the company has no processing agreement under Art. 28 GDPR. In the business tiers the content of prompts is excluded from training, an administrator opens and closes accounts, and login runs through SSO.

Check this in the vendor's terms, not in a line on a marketing page. Anthropic, OpenAI and Google all run separate terms for business customers and for consumer accounts, and the no-training commitment arrives with the contract, not on its own.

• Is the content of prompts excluded from training, and does that sit in the contract rather than in an FAQ
• How long the vendor retains prompts, and in which region
• Is there a processing agreement under Art. 28 GDPR available to sign
• Who opens and closes accounts, and does offboarding actually switch them off
• Does SSO login work, and is two-factor authentication available

04

Why does banning AI not work?

Because you enforce the ban as far as your network reaches, and the work moved to a phone. Blocking a domain on the firewall does not remove the behaviour, it relocates it to a place with no log, no company account and nobody to discuss it with.

The side effect is worse than the workaround itself. A ban turns an ordinary question („can I paste this fragment?”) into a risk for the person asking, so the questions stop coming. You end up with neither control nor knowledge.

• A block on the company network: walked around with a phone in two minutes, leaving no trace
• A ban with no alternative: the task still gets done, just more quietly
• Punishment for reporting: you hear about the next incident from a customer, not from the team
• Silence on the company side: you do not know which processes already lean on a model

05

What belongs in a one-page AI usage policy?

A twenty-page document exists so that somebody can say the company has a policy. A rule meant to fire in the second before a paste fits on one page and can be pinned next to a desk.

Six points is enough. The board or the data owner signs them off, not IT in an email, because the board is the one accepting the risk. The version for a system already running, meaning access scope per role and a log of every call, is covered separately in the guide on how to implement an AI agent: there the boundaries are set in the configuration, not in a policy.

• A list of 5 to 7 data categories that never leave the company, each with an example
• A sentence on what is allowed with no approval, so the list does not read as a ban on everything
• The company account and the tools you have standardised on
• A duty to verify the answer whenever it carries a number, a date, the name of a regulation or a quote
• A rule on labelling customer-facing content produced with a model
• One name and one address to report a doubt or a mistake to

06

How do you put the rules in place in two weeks?

Order matters. First you find out what is happening, then you write the rules, and only at the end do you block what genuinely has to be blocked. The reverse order ends in a document nobody applies.

The training step is not a good practice, it is an obligation. Art. 4 of Regulation 2024/1689, the AI Act, requires a sufficient level of AI literacy among the people operating AI systems on the company's behalf, and it applies from 2 February 2025. The format is described on the AI training for business page, and the wider list of things to settle before a first rollout is in the guide on how to prepare your company for AI.

1. 01

   Ask the team before you block anything

   One question, anonymous, running for a week: what do you use AI models for at work, and on which account. You get a list of real uses and real risks, usually different from the ones in the deck.

2. 02

   Write the do-not-paste list

   Five to seven categories, each with an example from your own work. The data owner on the board signs it off, so the rule stands on a decision rather than on a request.

3. 03

   Set up company accounts

   Accounts with one vendor, with the content of prompts excluded from training, SSO login and account closure built into offboarding. Without this step the previous one stays a wish.

4. 04

   Train the team on your own tasks

   4 to 8 hours, groups of up to 15 people, exercises on real work from the calendar rather than demo examples. You are left with a syllabus, an attendance list and a date, which is what you show during an audit.

5. 05

   Revisit the rules after 30 days

   You check two things: which tools the team actually uses, and which points of the policy turned out to be unworkable. A rule everybody walks around is a fault in the rule, not in the people.

07

What do you do when data has already gone into a chat?

Establish the facts first, not the culprit: which account, which tool, what content, when. Without that every following decision is guesswork, and the person who reported it stops talking.

Deleting the conversation limits the damage, it does not undo the transfer. So the second part of the job happens in the vendor's terms and in your incident register, and the third part in the rule that allowed it.

• Establish the scope: company or personal account, which tool, which data, when
• Delete the conversation and switch off history and training consent in the account settings
• Check the vendor's terms for the retention period and the route for a deletion request
• Assess whether this is a personal data breach; Art. 33 GDPR gives you 72 hours to notify the authority
• Log the incident and change the rule or the tool that made it possible
• Do not punish the person who reported it; after a punishment the next report simply will not come