The Risks of Using ChatGPT and Other AI Tools at Work

An employee, with good intentions and trying to work faster, pastes the full content of a confidential contract into ChatGPT and asks it to summarize it. Another uploads a spreadsheet with sensitive financial information to an AI tool for help generating an analysis. Neither thinks they're doing anything dangerous — they're using a tool that's become as common as email. But each of these actions can represent a real leak of confidential information, depending on how the specific tool handles that data.

Generative AI tool adoption in the workplace happened at a speed most IT and compliance departments couldn't keep up with. Unlike traditional enterprise software adoption, which generally goes through formal evaluation and approval processes, many employees simply started using these tools individually, before any clear policy existed about what information was appropriate to share with them.

Using the information to train future models, depending on each tool's specific privacy configuration — sensitive information shared today could, in theory, influence responses generated for other users in the future, if privacy settings aren't adequately restricted.

Storing conversations on third-party servers, outside the company's direct control, subject to the tool provider's security and retention policies, not the organization's internal policies.

Lack of traceability over what specific information has been shared, since unlike a document shared internally with clear access control, there's no easy-to-audit centralized record of which employees shared what information with which external tools.

Regulatory compliance risk, particularly relevant if the shared information includes personal data protected under Colombia's Habeas Data Law — sharing that data with an external service without proper authorizations and controls can constitute a violation of data protection obligations.

Many businesses' instinctive response is to ban generative AI use entirely. In practice, this ban rarely gets effectively enforced — employees find ways to keep using these tools from personal devices or unmonitored connections, precisely the phenomenon we explore in our guide on Shadow AI. A ban that isn't enforced in practice doesn't reduce the real risk — it just removes the visibility the company had into that use.

Establish clear categories of information that should never be shared with external AI tools — customer or employee personal data, confidential financial information, critical intellectual property, and any information subject to specific confidentiality agreements.

Formally evaluate and approve specific tools meeting adequate security and privacy standards, instead of leaving the decision entirely to each employee's individual judgment.

Actively train on what is and isn't appropriate to share, with concrete, realistic examples, instead of a generic policy employees can't translate into practical day-to-day decisions.

Consider enterprise AI solutions with contractual privacy guarantees, where the provider explicitly commits to not using shared information to train models nor retaining it beyond what's necessary, offering a level of control free consumer versions generally don't guarantee.

Generative AI tools offer real productivity benefits no business should completely ignore. An effective policy's goal isn't eliminating that benefit, but channeling it so productivity doesn't come at the cost of information exposure the business can't afford.

Start with the policy: create it in two minutes with the AI acceptable use policy generator and measure which tools your team already uses with the shadow AI checklist. For the full picture, see the 10 AI risks for businesses.