Company AI policy: the risks of using AI without rules

In 2023, Samsung discovered that engineers had pasted confidential source code and meeting notes into ChatGPT. A few weeks later, Apple restricted staff use of ChatGPT over fears of leaks. In your company, who sets the rules on what your teams share with AI?

In Belgium, the answer is often: nobody. According to an Acerta survey of more than 2,000 employees, seven in ten working people say their organisation does not yet have clear rules on using AI. The question is no longer "are they using it?" but "what are they putting into it?".

The real risks without an AI charter

Client data leaks. A sales rep copies a prospect list into ChatGPT to draft personalised emails. That data is now beyond your control. With consumer versions of ChatGPT, conversations may be used to train models unless the user switches this off. Business offerings (Business, Enterprise, API) do not use them by default.

GDPR non-compliance. When an employee enters personal data into an unapproved tool, you risk processing without a legal basis or an uncontrolled transfer. GDPR provides for fines of up to €20 million or 4% of worldwide turnover. The Belgian Data Protection Authority issues few fines each year, but a leak still means a breach notification, possible complaints and real costs.

AI Act. Since 27 July 2026, Article 4 of the AI Act asks companies using AI to take measures to support the AI literacy of their staff. A charter combined with a short training session is a simple, documented way to do that.

Unclear liability. If AI produces an error in a contract or client advice, who is responsible? The employee who used the tool? The manager who set no guidelines? Without a written framework, that gets settled after the incident, under the worst conditions.

Reputational damage. Your clients discover that their information was shared with a chatbot. Trust, once lost, is slow to rebuild.

Our AI Governance consultancy includes drafting a custom AI charter tailored to your industry and tools.

What a good AI charter covers

An effective charter fits on two pages and answers five questions:

• Which tools are authorised? The list of approved solutions and their permitted uses. Everything else is prohibited by default.

• Which data is off-limits? Client data, financial data, HR data, source code. A clear red line, with concrete examples.

• What is the approval process? Who approves a new tool? Who monitors usage? Appoint an AI point of contact.

• What training? Every user should understand the risks before using AI. A single awareness session lays the groundwork and counts as a documented measure under Article 4 of the AI Act.

• Who is responsible? Who answers when something goes wrong: the manager, the user, the IT department? Settle it before an incident forces the question.

You don't need to start from scratch. To train your teams, our Practical AI training is available as a lunch & learn, half-day or conference.

Take action

AI is a powerful lever. Without a framework, it becomes an avoidable legal and reputational risk.

• Frame your AI usage with our AI Governance consultancy, custom AI charter included
• Train your teams with our EU AI Act training to understand your obligations
• Let's talk: contact us to review your current AI practices