Overview
Adopting AI responsibly means understanding not only how information is shared with AI tools, but also how the information they produce is managed, verified, and protected. A thoughtful approach helps organizations benefit from AI while maintaining accountability and safeguarding sensitive business information.
Understanding Information Risk in Everyday AI Use
Generative AI tools have quickly become a part of routine work for many businesses. It is now fairly common for an employee to paste a customer email into one AI tool to draft a response, while another colleague runs a pricing spreadsheet through an AI add-in before a client meeting.
Each of these tasks seems reasonable enough on its own, but taken together, they place customer correspondence, contract terms and commercial pricing with several external providers, often without a clear record of which providers received what.
For many organizations, the use of these AI tools has moved faster than their understanding of how information is handled once it’s been submitted.
Confirming Information Handling Before AI Use
Before sensitive information is entered into an AI service, the organization should be able to confirm these four things:
- Whether the employee is using a company-approved account or a personal account, and which contract and terms govern that usage.
- Which providers and subcontractors receive this information. and where is it being processed, stored, or accessed.
- What the terms permit regarding retention, human review, model training and deletion.
- Whether the organization’s customer contracts and confidentiality agreements allow that processing.
These answers depend on the service, its configuration and the obligations that apply to the business. Whether or not these questions have been answered, the potential consequences include unauthorized disclosure, privacy or contractual issues and a loss of control over commercially valuable information.
The Government of Canada has guidance on generative AI and it reflects the same principle. Organizations should understand supplier terms and information handling practices before submitting sensitive material.
Protecting the Information AI Produces
The information that an AI tool produces requires the same consideration as the information it receives. A summary of client contracts or an analysis of pricing data can be as sensitive as its source material. Each output should have a defined audience and a person or team responsible for maintaining it. Any conclusions that will shape a business decision should first be checked against the original sources.
Building a Responsible Approach to Adoption
Organizations can begin with a single, defined use case. Identify the information it depends on and the person accountable for that information, then review how the tool will access, retain and share it before authorizing use.
Testing the tool on a small scale first gives a clearer picture of its value. That assessment should account for the time needed to review and correct its outputs, as well as their accuracy.
Effective decisions about AI use draw on input from across the organization. Those accountable for business activity can speak to the value of the information, while technology and privacy specialists can assess how it is handled and what the organization is obligated to protect.
Our team can help you evaluate AI use against the information and obligations your business relies on. Reach out to start the conversation.
Key Takeaway
Responsible AI adoption starts with responsible information management. By understanding what information AI tools access, verifying what they produce, and establishing clear accountability, organizations can make more informed decisions about where and how AI adds value.
Written by Robert Strachan, CISSP, Senior Governance, Risk & Compliance Analyst at VCURA.