Short answer: the biggest AI risk in a small company isn't the tool itself; it's shadow AI. That's when an employee pastes a customer email, a contract clause or a salary table into their own free account because they need a quick summary. Management doesn't know, there are no rules, and nobody knows where the data ends up. The fix isn't a ban. It's a company tool, a short never-paste list and tidy permissions.
How big is the issue?
According to Microsoft's 2024 Work Trend Index, 75% of knowledge workers use generative AI at work, and 78% of them bring their own tools. In small and mid-sized businesses the figure is 80%. In other words: if your company has no official AI tool, that doesn't mean nobody uses AI. It means they use it without oversight.
IBM's 2025 data breach research found that 13% of organisations had already experienced a breach involving AI models or applications, and 97% of those lacked proper AI access controls. One in five organisations reported a breach linked to shadow AI, and where shadow AI was widespread, a breach cost on average about $670,000 more. 63% of the organisations studied had no AI governance policy, or were still developing one.
The average cost of a data breach reached $4.99 million in IBM's 2026 report. For an SME the number is smaller, but often more painful in proportion, because there's no legal department or crisis communications team behind it.
Eurostat reports that nearly half (48.83%) of EU companies that considered AI were held back by data protection concerns. That concern is legitimate, but a ban is the wrong answer to it.
What's the problem with free, personal accounts?
Not that they're bad. It's that the contract isn't with you.
- Training: with free consumer services, depending on the provider's terms, what you type in may be used to improve models. Business plans typically exclude this contractually.
- Retention and review: how long conversations are kept and whether humans may review them also depends on the terms.
- No data processing agreement: if you paste in personal data, that's processing under the GDPR, and an outside provider takes part as a processor. That requires a contract, which an employee's personal account doesn't have.
- No visibility: when the employee leaves, their conversations leave with their account.
A cautionary tale: Samsung
In spring 2023, Samsung employees pasted internal sensitive data into ChatGPT. The company then restricted generative AI on company devices and asked staff not to enter company or personal data, noting that data on external servers is hard to delete. The lesson isn't that you should ban it; it's that the rule has to come before the first incident.
What the law says
GDPR. If you enter personal data into an AI tool (a customer's name, email address, health data, salary), you are processing it. You need a legal basis, a data processing agreement with the provider, and you must inform the people concerned. The European Data Protection Board's December 2024 opinion says an AI model's anonymity must be assessed case by case, legitimate interest can only be a legal basis if the processing is genuinely necessary, and a model developed on unlawfully processed data may affect its later use.
Data protection authorities. National authorities have started publishing plain-language guidance. The Hungarian authority (NAIH), for example, together with its South Korean and French counterparts, published a short poster on generative AI and data protection. It advises comparing services, choosing the one with the lowest risk of your prompts being reused for other purposes, and reading the privacy notice before use. Check what your own national authority has published.
EU AI Act. Under the AI Act, employers must take measures to support their staff's AI literacy. A data handling rule and a short training session meet that obligation and reduce data protection risk at the same time.
What business plans commit to
The big providers' business plans answer exactly these questions.
Microsoft Copilot (Microsoft 365). According to Microsoft, prompts, responses and company data accessed through Microsoft Graph aren't used to train foundation models. Copilot only surfaces data the user has at least view permission for. For EU customers it is part of the EU Data Boundary, with one exception: Anthropic models available within Copilot are currently excluded.
Google Workspace (Gemini). According to Google, customer data isn't used to train models without prior permission or instruction, and Gemini conversations aren't reviewed by humans. Google makes no separate EU data residency commitment specifically for Gemini.
Anthropic Claude (Team, Enterprise). According to Anthropic, inputs and outputs from its commercial products (Claude for Work, the API) aren't used to train models by default. The exceptions are when a user explicitly sends feedback or a bug report, or chooses to allow use of their data. Anthropic's own apps and API don't offer EU data residency according to its regional compliance page; if you need it contractually, Claude is available in European regions through AWS Bedrock and Google Vertex. We use Claude primarily ourselves.
That's the point: a company account isn't an expensive convenience; it's contractual protection.
The never-paste list
A short list beats a long policy nobody reads. Don't paste these even into a company tool:
- passwords, API keys, access credentials;
- special categories of personal data: health, criminal, religious or trade union data;
- payslips, personnel files, performance reviews with names;
- another company's confidential material covered by a non-disclosure agreement, unless it allows this;
- source code, if your rules forbid it, or if it belongs to a client.
Into the company tool, with a company account, you can put:
- your own non-confidential text (draft proposals, internal summaries, marketing copy);
- public information;
- customer data, if there's a legal basis, a data processing agreement with the provider, and the task genuinely needs it. Without names and identifiers where possible.
The simplest rule: if you wouldn't email it to an outside partner, don't paste it into a free account either.
Permissions: the quiet risk
Company AI tools have a less obvious danger. Copilot and similar tools find everything the user has rights to. If permissions are messy (salaries in an old folder shared with everyone, a departed manager's files visible to all), the AI doesn't create the problem, but it surfaces it in seconds.
So before you roll out a company AI tool, review your sharing settings. It's not an AI project, just housekeeping that would be justified without AI anyway. The usual suspects: folders shared with "everyone", forgotten links from old projects, and material from people who left that was never locked down.
Technical steps that help a lot
Next to the rule you need a few simple technical steps, or the rule stays on paper:
- company sign-in: the AI tool should work with company accounts and single sign-on (SSO), and a leaver's access should end with their company account;
- multi-factor authentication: a compromised AI account sees the conversations and company documents just like a compromised email account;
- admin settings: in business plans, check that training is switched off, how long conversations are kept and who can see them;
- logging: most business plans log usage, which is invaluable during an incident.
What to do if it has already happened
If you find out that someone pasted personal data or confidential material into a personal AI account, don't panic, but don't brush it off either.
- Assess what went out: which data, whose, how much, to which provider.
- Have the conversation deleted, and check the provider's data settings.
- Decide whether it's a personal data breach. Under the GDPR, a breach affecting personal data must be reported to the authority within 72 hours if it poses a risk to the people concerned. Decide this with a data protection professional.
- Don't primarily punish the employee; fix the missing rule and tool. Otherwise you won't hear about the next case.
A one-page AI policy
An SME doesn't need a thirty-page document. One page will do if it covers:
- Which tool we use, with company accounts. No other tool may be used with company data.
- What it's for: drafts, summaries, translation, brainstorming, internal questions.
- The never-paste list (see above).
- Who checks the output: a person reviews everything that goes outside.
- Who to contact with questions or incidents.
- When the rule is updated (yearly, or when a new tool arrives).
Nobody needs to sign it, but walk through it in a short training session and document that you did.
What we see
In companies where we talk about AI, it almost always turns out that more tools are in use than management knows about. The cause is rarely bad intent; it's helpfulness: people want to get their work done faster, and nobody told them what's allowed. Answer that question with a company tool and a simple rule, and usage becomes visible, and from then on manageable.
What to do now
- Ask the team which AI tools they use, without blame. The goal is an inventory, not a disciplinary process.
- Choose one company tool, with company accounts: one that fits your environment (Copilot for Microsoft 365, Gemini for Google Workspace) or a standalone assistant's business plan (Claude Team, ChatGPT Business).
- Check the contract: training excluded, data processing agreement, data location.
- Review sharing and permissions before you switch it on.
- Write the one-page rule with the never-paste list.
- Run a short training session, and document it.
- Review the inventory and the rule once a year.
If you'd like someone to take you through a company AI rollout, from reviewing permissions to the policy, have a look at our AI solutions and our infrastructure and operations service.
FAQ
Can we enter customer data into ChatGPT?
Not into a free personal account. Into a business plan, if there's a legal basis, a data processing agreement with the provider, and the task genuinely needs it. Without names and identifiers where possible.
Do Claude, Copilot or Gemini train their models on our company data?
According to the providers, not in business plans: Anthropic says inputs and outputs from its commercial products aren't used for training by default, Microsoft says Copilot prompts and company data aren't used to train foundation models, and Google says Workspace customer data isn't used for training without permission.
What is shadow AI?
Employees using AI tools for company work without the company's knowledge or rules, typically with free personal accounts. IBM found that one in five organisations had already had a breach linked to it.
Isn't it enough to ban AI?
No. Bans rarely work: people carry on on their own phones, just without oversight. An approved company tool and a short rule reduce the risk far more.
Do we need to tell customers?
If you process their personal data with an AI tool, your privacy notice should name the processor and the purpose. Have it reviewed by a data protection professional.
Sources
- EDPB – Opinion 28/2024 on AI models: GDPR principles support responsible AI
- EDPB Support Pool of Experts – AI Privacy Risks & Mitigations: Large Language Models
- IBM – 13% of organizations reported breaches of AI models or applications
- IBM – Cost of a Data Breach Report 2026
- Microsoft Work Trend Index 2024 – AI at Work Is Here. Now Comes the Hard Part
- Microsoft Learn – Data, Privacy, and Security for Microsoft Copilot
- Google – Generative AI in Google Workspace Privacy Hub
- Eurostat – Use of artificial intelligence in enterprises
- TechCrunch – Samsung bans use of generative AI tools like ChatGPT after April internal data leak
- Anthropic Privacy Center – Is my data used for model training?
- Anthropic – Regional compliance
