Most companies already use AI: someone writes copy with it, someone translates emails, someone uploads a spreadsheet of client data to produce a quick summary. It happens without rules, because nobody set any.<\/p>\n
While the tools were used in isolation this went unnoticed. That is changing from two directions: regulation in the European Union is progressively taking effect, and the volume of data employees pass into external services grows faster than anyone notices.<\/p>\n
A caveat up front: your specific obligations depend on country, company size and what exactly you do with AI. Check your position with a lawyer. What follows is the organisational part, useful regardless of jurisdiction.<\/p>\n
Not for the sake of regulatory compliance. For three specific risks:<\/p>\n
All three are closed not by technology but by agreements written on a single page.<\/p>\n
| Point<\/th>\n | What it fixes<\/th>\n<\/tr>\n<\/thead>\n | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Approved tools<\/td>\n | A list of services allowed for work tasks<\/td>\n<\/tr>\n | ||||||||||||
| Prohibited data<\/td>\n | What must never be pasted: client personal data, contracts, passwords, financial documents<\/td>\n<\/tr>\n | ||||||||||||
| Mandatory review<\/td>\n | Which outputs never proceed without a human: anything a client sees<\/td>\n<\/tr>\n | ||||||||||||
| Disclosure<\/td>\n | When we tell a client that text or a reply was generated<\/td>\n<\/tr>\n | ||||||||||||
| Owner<\/td>\n | Who decides on new tools and answers questions<\/td>\n<\/tr>\n | ||||||||||||
| Usage log<\/td>\n | Where we record which tool is used for which task<\/td>\n<\/tr>\n | ||||||||||||
| Review cycle<\/td>\n | Quarterly reconciliation of the list against actual practice<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n This is not a twelve-page document. It is one page people will read and remember. A policy nobody opens is worse than none: it creates the impression the question is settled.<\/p>\n Data is the main risk<\/h2>\nLeaks usually happen not through a breach but through convenience: pasting the whole spreadsheet is faster than stripping out what does not belong.<\/p>\n A practical rule that works better than prohibitions: if you could not email this data to an outside company, you cannot paste it into an external service<\/strong>. The wording is clear without explanation and requires no knowledge of terminology.<\/p>\n What to check in the services themselves:<\/p>\n This is the same vendor<\/a> check you would run for any other service receiving data. There is no difference, yet it gets done less often.<\/p>\n Rather than a blanket ban, it is more useful to split tasks by the consequence of an error. The same principle applies as with AI agents<\/a>: the question is not whether the model will be wrong, but who will notice.<\/p>\n A sequence that takes an hour and closes most of the risk:<\/p>\n A question with no universal answer: should you tell clients that text was generated.<\/p>\n A practical guide: disclose where knowing it might change the person’s decision. An automated chat reply, yes, say so plainly. A draft proposal that a salesperson rewrote and checked, no, that is an ordinary tool like a word processor.<\/p>\n The line is drawn not by whether a model was involved, but by whether there is a person behind the output who answers for it personally.<\/p>\n AI usage rules look excessive for a ten-person company right now. Within a year they will be as routine a document as a password policy. It is cheaper to write them while they still fit on one page than to work out later which data went where over two untracked years.<\/p>\n","protected":false},"excerpt":{"rendered":" Three risks closed by agreements rather than technology, a seven-point minimum policy, a one-sentence rule about prohibited data, task classification by risk, and what to write down within an hour.<\/p>\n","protected":false},"author":5,"featured_media":8158,"template":"","insight_category":[156],"insight_tag":[174,168,186],"class_list":["post-8162","insight","type-insight","status-publish","has-post-thumbnail","hentry","insight_category-trends","insight_tag-ai-search","insight_tag-business-process","insight_tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight\/8162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight"}],"about":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/types\/insight"}],"author":[{"embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/users\/5"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/media\/8158"}],"wp:attachment":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/media?parent=8162"}],"wp:term":[{"taxonomy":"insight_category","embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight_category?post=8162"},{"taxonomy":"insight_tag","embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight_tag?post=8162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |