Your team is already using AI. That's not a prediction, it's almost certainly happening right now, whether you've approved it or not. Surveys in the past year found that more than half of employees admitted using AI tools their employer hadn't sanctioned, while only about a third of organizations had any policy to manage or even detect it. So the real question isn't whether to allow AI. It's whether the AI already in your business is handling your clients' data safely.

Here's the honest answer up front: there is no single "safe" AI tool. The same product can be perfectly appropriate for one task and a serious liability for another, depending on which version you're using, how it's configured, and what you feed it. Safety isn't a logo. It's a combination of the plan tier, the contract behind it, the controls you turn on, and the rules your people actually follow. Let's break down what to evaluate before you let any AI tool near a client-facing workflow.

General guidance follows, not legal advice. Where regulated data is involved, confirm specifics with counsel and your compliance advisor.

The most important distinction: consumer tier vs. enterprise tier

This is the line that matters most, and it's the one most people miss.

Free and consumer versions of the major tools generally treat your inputs as fair game. By default, the major consumer chat tools may use what you type to help train their models, and while you can often opt out, that setting tends to be buried and turned off by default. Worse, once your data has been absorbed into a model's training, deleting your chat history doesn't pull it back out. It's effectively baked in. A consumer AI tool should be treated like a public space: fine for general questions, wrong for anything confidential.

Enterprise and business tiers are a different animal. Across the major platforms, paid business and enterprise plans default to not training on your data and keep your information inside your own environment. Microsoft 365 Copilot, for example, doesn't train on your tenant data, keeps interactions within your Microsoft 365 boundary, and inherits the identity, encryption, and compliance controls you already run. ChatGPT's business and enterprise plans exclude your data from training by default, and Gemini's Workspace data stays siloed and out of model training. The catch: consumer-version privacy habits don't automatically carry over, so the enterprise protections only apply if the right plan is actually active and configured.

The practical takeaway: the cheapest way to leak client data is to let people use free AI accounts for real work. Moving them to a properly licensed business tier closes most of that gap immediately.

The eight questions to ask of any AI tool

Before any tool touches client data, run it through this checklist:

• What plan tier is this, really? Consumer, business, or enterprise, and is the protective tier actually the one in use?
• Does it train on our inputs? Look for an explicit, default no-training-on-customer-data commitment, not a setting you have to hunt for.
• Where does our data go, and who else touches it? Data residency, retention periods, and sub-processors all matter. Is your data isolated to your organization, or pooled?
• What's in the contract? For regulated work, the signed agreement matters more than the marketing page. Ask for a Data Processing Agreement, a BAA if you handle health data, and proof of independent attestations like SOC 2 or ISO certification.
• Can we govern access? Single sign-on and automated provisioning (SCIM), so the right people get access and the wrong ones lose it cleanly when they leave.
• Does it leave an audit trail? Logging, retention controls, and the ability to show what was asked and answered. (This is the same evidentiary principle that determines whether your cyber insurance pays out. If you can't prove what happened, you're exposed.)
• Does it fit our existing security stack? A tool that inherits the controls you already run is far easier to secure than one bolted on the side. This is often a bigger factor than which model is smartest.
• What about the outputs? AI can be confidently wrong, and it can surface information to people who shouldn't see it. Decide where human review is required before an AI-generated output reaches a client.

Notice that only one of these questions is about the AI model itself. The rest are about how you deploy and govern it, which is exactly where most of the risk actually lives.

The real risk isn't the tool. It's the usage you can't see.

"Shadow AI," employees quietly using personal AI accounts for work, is the single largest AI risk surface most businesses are carrying right now. One study found more than 30% of employees regularly paste company data into public AI tools. Each of those is a small, invisible export of your data outside your control, and most traditional data-loss tools weren't built to catch it. Industry analysts now expect a large share of organizations to suffer a security or compliance incident tied to unsanctioned AI use in the coming years.

The instinct is to ban it. That rarely works. People use the tools they like, and a blanket no just pushes the behavior further into the shadows. The approach that actually works is enablement plus governance: give your team a sanctioned, secured tool that's genuinely good, train them to use it well, and set clear rules about what data can go where. People abandon their personal accounts when the approved option is better and easier.

Governing AI like the business risk it is

If "where is AI used, by whom, on what data, and under what controls" isn't a question you can answer today, you're already in shadow-AI territory, and that's precisely the gap a security partner should help you close. This is a risk-management and virtual-CISO function, not an IT afterthought.

You don't need a massive program to start. The recognized governance frameworks make this manageable, and they map cleanly onto the way good security is already measured. The NIST AI Risk Management Framework (voluntary, U.S.-developed, built around four plain-language functions of Govern, Map, Measure, and Manage) gives you a structure, and it dovetails with frameworks like CIS and NIST that may already underpin your security posture. ISO/IEC 42001, the first international standard for an AI management system, offers a certifiable structure if a client or contract ever demands one. For most mid-sized firms, you don't need certification to benefit; you use the framework as a checklist.

The minimum, practical starting point is three steps: build a simple inventory of what AI is actually being used, publish a short acceptable-use policy that says plainly what data may and may not go into which tools, and apply a basic risk screen to any new AI workflow that touches client information.

A quick self-check

• Are people using free, personal AI accounts for client work?
• For every AI tool we rely on, can we confirm it's on a tier that doesn't train on our data?
• Do we have the contracts (DPA, and a BAA where required) and attestations on file?
• Have we written down, in one page, what data is allowed in which tools?
• Could we produce a record of how AI has been used if a client or regulator asked?

A no on any of these is a gap worth closing now, not after a client's confidential information has already left the building.

The bottom line

AI is one of the biggest competitive advantages available to a business right now, and one of the easiest ways to quietly breach a client's trust. The two facts aren't in tension; they're the whole point. Used on the right tier, under the right contract, with sensible rules and real visibility, AI lets you move faster while protecting the people who trust you with their data. Used on a free account with no governance, it's an invisible leak waiting to surface at the worst possible time.

The right first move is the same one we recommend for security generally: an honest assessment of where you stand. You can't prescribe the right treatment plan without the proper diagnostic, and with AI, the diagnostic usually starts with a single question most businesses can't yet answer: what's already being used, and on whose data?