AI tools have quickly become part of daily work: writing emails, summarising documents, analysing spreadsheets. But uncontrolled use can mean customer data, contracts, price lists or source code being sent to services outside the company. That creates both trade secret and data protection risks.
Main risks
- Personal data transfer: Entering customer or employee data into third-party services without notice or legal basis, including cross-border transfer rules.
- Trade secret leaks: Uploading contracts, proposals and strategic documents to tools used with personal accounts.
- Use in model training: Some free services may use entered data to improve the service.
- Incorrect content: Wrong or invented information used without checking.
- Shadow IT: Tools used without the company's knowledge.
Enterprise or personal tools?
Enterprise AI services offer safeguards such as not using data to train models, data processing agreements, access management, logging and data location options. When working with company data, choose enterprise services with these guarantees over free personal accounts.
What an AI usage policy should include
- Approved tools: Which tools may be used, with which accounts?
- Data classes: Which public, internal and confidential data may go into which tools? Personal data and confidential documents only in approved enterprise tools.
- Human review: AI output is checked by a person before it reaches a customer, official correspondence or a decision.
- Transparency: If customers interact with AI, say so clearly.
- Training: Explain safe use and good examples to employees.
- Owner and review: Name an owner and update the policy regularly.
Keep up with regulation
Data protection rules apply to AI use as well. Companies doing business in the EU must also follow their obligations under the EU AI Act. For legal assessments, we recommend working with a specialist adviser.
ujans supports the secure setup of enterprise AI tools, access and data protection settings, and employee training.