Your employees are sharing sensitive data with AI without realising it

A sales rep copies their client database into ChatGPT to draft emails. Someone in HR pastes in CVs to screen them. An accountant uploads financial statements to analyse them. Every day, sensitive data leaves companies without anyone noticing.

This isn't anecdotal. According to the 2024 Work Trend Index by Microsoft and LinkedIn, 75% of knowledge workers use AI at work, and 78% of those users bring their own tools rather than company-provided ones. At small and medium-sized companies, the figure rises to 80%.

What your teams are sharing (without thinking)

The scenarios look the same whatever the industry:

Client data. Names, emails, phone numbers copied to "improve a text" or "segment a list". With consumer versions of some tools, that content may be used to train models unless the setting is switched off. Your clients never consented to that.

Contracts and internal documents. A lawyer pastes in a contract to summarise it. A manager uploads a strategy report to rephrase it. Confidential clauses are now on external servers, beyond your control.

Source code. Developers ask AI to fix or optimise proprietary code. Samsung learned this in 2023: three cases of confidential code and meeting notes shared with ChatGPT were discovered within a few weeks, after which the company banned generative AI tools on its devices.

HR and financial data. Salaries, performance reviews, accounts. If leaked, they expose the company to GDPR complaints and an internal crisis of trust.

Most of the time, employees don't realise they are taking a risk. They just want to be more efficient. The intention is good; the consequences can be serious.

To assess your exposure, run our free AI diagnostic. Results in a few minutes, no strings attached.

3 immediate measures

No need for a six-month project. Start this week:

1. Inventory your AI usage. Send an anonymous survey to your teams. Which tools do they use? For which tasks? With what data? Given the figures above, expect to find uses that management didn't know about.

2. A clear, communicated AI charter. Define the authorised tools, the prohibited data and the responsibilities. Prefer business versions, whose data is not used for training by default. A charter left in a drawer protects no one: communicate it.

3. Train your teams. A practical awareness session shows concretely what not to paste into an AI tool, and why. It is also a way to meet Article 4 of the AI Act, which since July 2026 asks organisations to take measures to support their staff's AI literacy.

Our AI Governance consultancy helps you put all three measures in place, from inventory to training, as a lunch & learn, half-day or conference.

Take action

Your data may already be leaving. Better to find out now than during an incident.

• Assess your risk with our free AI diagnostic
• Secure your practices with our AI Governance consultancy
• Let's talk: contact us for tailored support