AI and your business data: privacy and safety basics

General information, not legal advice. If you handle regulated data, talk to your adviser.

The real risks, in plain words

AI doesn’t create brand-new kinds of data risk so much as new ways for old risks to happen.

1. Information going into tools you don’t control. When someone pastes a customer list, a contract or a patient note into a free AI tool, that information now sits with another company under that company’s terms. Depending on the tool and its settings, it may be stored, reviewed or used to improve the product. The SBA’s advice to small businesses: “Try not to feed any sensitive data or proprietary information” into AI tools, to help keep it out of the data the system draws on. ^[1]

2. Personal accounts. If staff use their own logins, the business has no control over settings, no record of what was shared, and no way to remove access when someone leaves.

3. Wrong answers reaching customers. AI can produce confident, incorrect answers. If an AI-drafted message goes out unchecked, you own the mistake.

4. Too much access. An AI assistant connected to “everything” can surface information to people who shouldn’t see it. Access should follow the job.

5. AI-powered scams aimed at you. Criminals use AI too. The FBI has warned that generative AI makes fraud more believable and lets criminals reach more people, faster. ^[2] We cover this in our cybersecurity guide.

Start with the basics that already work

The Federal Trade Commission’s guide for businesses boils data security down to five principles ^[3]:

1. Take stock. Know what personal information you have in your files and on your computers.
2. Scale down. Keep only what you need for your business.
3. Lock it. Protect the information that you keep.
4. Pitch it. Properly dispose of what you no longer need.
5. Plan ahead. Create a plan to respond to security incidents.

Applied to AI, that means:

• Take stock: know which AI tools are in use in your business, including the free ones people signed up for on their own, and what information each one can reach.
• Scale down: connect AI only to the documents and systems a task actually needs. Don’t hand an assistant your whole drive because it’s easier.
• Lock it: business accounts, strong unique passwords and multi-factor authentication on every AI tool. CISA, the federal cybersecurity agency, says using MFA makes you “99% less likely to be hacked.” ^[4]
• Pitch it: check whether you can delete conversations and uploaded files, and do it for anything sensitive.
• Plan ahead: know what you’d do if someone pasted the wrong thing into the wrong tool, including who to tell and what to change.

Questions to ask any AI vendor

Before you connect a tool to business information, get clear answers to these:

1. Is our data used to train or improve your models? Can we turn that off, and is it off by default on business plans?
2. Where is our data stored, and for how long?
3. Who at your company can see it, and why?
4. Can we delete it, including uploads and conversation history?
5. What happens if you have a security incident? Will you tell us, and how fast?
6. Can we control who in our business has access, and remove people when they leave?
7. Will you put this in writing? The FTC advises businesses to write security expectations into contracts with service providers and to verify them, not just take their word for it. ^[5]

If a vendor can’t answer these clearly, that’s your answer.

Simple house rules for your team

Most problems are accidents, not attacks. A one-page set of rules prevents most of them:

• Use business accounts only for AI tools. No personal logins for work.
• Never paste these into a public AI tool: Social Security numbers, card or bank details, passwords, health information, or anything a customer gave you in confidence.
• A person checks anything AI drafts before it goes to a customer, supplier or regulator.
• Ask before connecting a new AI tool to email, files or business systems.
• Report mistakes quickly. If something sensitive went into the wrong tool, say so, so it can be dealt with. Nobody gets in trouble for reporting.

The SBA also suggests considering a short public statement on how your business uses AI, and calls disclosure “an expected best practice.” ^[1] Check whether any state rules apply where you operate.

Access and accounts: the boring part that matters most

• Least privilege. Each person, and each AI tool, gets access only to what the job needs. The FTC calls this the “principle of least privilege.” ^[3]
• Separate admin rights. Only a couple of trusted people can change settings or connect new tools.
• Offboarding. When someone leaves, their access to AI tools goes with their email and files the same day.
• Review quarterly. Check who has access to what, and remove what’s no longer needed.

Regulated information needs more care

Some information comes with legal rules attached. If you handle health information, HIPAA applies, and any vendor handling patient information for you is likely a “business associate” that needs a written agreement with you. HHS even lists a third-party AI chatbot on a patient portal as an example. ^[6] See our guide for healthcare and medical practices. Payment card data and financial records also have their own rules. When in doubt, ask your adviser before connecting AI to that data.

How we handle it

When we set up or build AI for a business, we tell you which AI tools touch your data and how it’s handled, before anything is switched on. We run our own servers, so what we build stays in our hands. We sign HIPAA business associate agreements with medical clients once the right safeguards and partner agreements are in place for your project.