AI tools can save your team hours every week. They can also move client files, financial records and passwords to places you don’t control, usually without anyone noticing. A NordVPN survey found that 94% of Americans don’t understand the privacy risks of using AI at work.
For a small or mid-sized business, the risk usually isn’t the technology itself. It’s that AI shows up quietly: a free chatbot one employee likes, a meeting note-taker someone connected to their calendar, a new “AI” button inside software you already pay for. Nobody decided to adopt it, so nobody decided how to protect it.
Here’s what actually happens to the data you put into an AI tool, the risks that matter most for a business your size, and the steps we take with our own clients to close the gaps.
What happens to the data you give an AI tool
The answer depends less on which AI tool your team uses and more on what kind of account they’re signed in with.
- Free and personal accounts often keep your prompts and uploaded files, may use them to improve the vendor’s models, and may let the vendor’s staff review conversations for quality and safety. Your business has no control over any of it, and no way to see it.
- Business and enterprise plans generally commit in their terms not to train on your data, let you set how long conversations are kept, and give an administrator control over who has access.
The same chatbot can behave very differently depending on whether an employee signed in with a personal email address or a company account. Either way, the conversation history sticks around. It becomes a searchable record of everything your team has typed, tied to an account that someone could break into.
Free: the AI Data-Safety Checklist
This article’s seven steps on three printable pages. Check off what you’ve handled; anything left unchecked is a gap worth closing.
Five AI risks that matter most for a small business
1. Tools nobody approved
“Shadow AI” is any AI tool your team uses without anyone deciding it’s allowed. It’s one of the most common gaps in small businesses, and you can’t protect data in a tool you don’t know exists. Browser extensions and meeting note-takers are the easiest to miss, because they connect to email and calendars in a couple of clicks.
2. Oversharing through file permissions
An AI assistant connected to Microsoft 365 or Google Workspace can find anything the person using it already has access to. That sounds safe until you remember how many folders are shared with “anyone with the link,” how many old employees still have accounts, and how many company-wide groups give everyone access to everything. The assistant doesn’t create those problems. It just makes them searchable. Payroll spreadsheets and HR folders are the classic surprises.
3. Regulated data in the wrong place
If you handle patient information, Social Security numbers, tax records or privileged legal files, the rules follow that data into any AI tool. A medical practice pasting patient details into a free chatbot has a HIPAA problem. A CPA firm has obligations under the FTC Safeguards Rule. A law firm has its duty of confidentiality. See how we help regulated businesses meet those requirements.
4. Accounts without protection
If someone gets into an employee’s AI account, they get the whole conversation history: every contract summarized, every spreadsheet analyzed, every email drafted. AI accounts need the same protection as email, starting with multi-factor authentication.
5. AI-powered scams
Criminals use the same tools. Phishing emails no longer have the typos that used to give them away, and a short clip of someone’s voice is enough to fake a phone call from them. The most expensive version is a convincing email, or call, asking you to change payment or wire instructions. It’s why we recommend every business, and especially escrow offices and accounting firms, verify payment changes by phone.
Seven steps to use AI safely at work
- Find out what’s already in use. Ask your team which AI tools they use for work, including free ones. Then check which apps have been granted access to company email, calendars and file storage, and remove anything you don’t recognize.
- Use business accounts the company owns. Move work onto business or enterprise plans, confirm in the vendor’s terms that your data isn’t used for training, and set conversation retention to the shortest period that works for you.
- Decide what data can go in. A simple rule your team can remember beats a long policy nobody reads. Sort information into public, internal, confidential and regulated, and set a rule for each. When in doubt, swap real names and numbers for placeholders like “Client A” before hitting enter.
- Clean up permissions before AI touches your files. Remove “anyone with the link” sharing from sensitive folders, close accounts for former employees, and limit HR, payroll and owner financials to the people who need them.
- Protect the accounts. Turn on multi-factor authentication, have staff sign in with their company login wherever the tool supports it, and add AI tools to your employee offboarding checklist.
- Verify every payment change. Call a number you already have on file, never one from the email, before changing where money goes.
- Put it in writing and review it. A one-page AI use policy covers approved tools, off-limits data, who to ask, and a reminder to check AI output for accuracy. Revisit it at least twice a year. AI features change fast.
Get the checklist
We turned these steps into a free, three-page AI Data-Safety Checklist. Check off what you’ve handled; anything left unchecked is a gap worth closing.
For our managed IT clients, AI advisory is included in the flat monthly fee. We find out what your team is already using, clean up permissions before AI touches your data, set up business-grade tools the right way and help you put a clear policy in place. Not a client yet? Book a free IT & Security Assessment and we’ll give you a written scorecard of where you stand, yours to keep either way.
About the author: Matthew Sipes is the founder and CEO of Enterprise Data Solutions, which has been the IT department for small and mid-sized businesses across the greater Orange County area since 2001.
