Your Thursday briefing · AI series
Last week we put the whole roadmap on one page: inventory, owners, frameworks, agents, measurement. This Thursday we go back to where we started, from the other end. The first episode asked which AI tools are in use. This one asks the next question: what leaves through them?
Our position fits in one sentence: banning public AI assistants doesn't protect your data, it moves it. What protects you is an approved tool, three classes of data and a few settings almost nobody checks.
Five ways data walks out
When people talk about AI leaks, they picture a document pasted into a chat window. It is the most visible path, not the only one.
- Pasting. A contract to summarize, a customer list to clean up, a tricky email to rephrase, a code snippet to fix. The text leaves the company the moment it is sent, with everything in it.
- The personal account. The same tool does not offer the same guarantees under a business account and under a personal address. Business offerings usually come with contractual commitments on retention and on whether data is used to train models; a free account opened with a personal email falls under consumer terms that the company has neither read nor signed.
- The browser extension. An "AI assistant" extension that summarizes pages or drafts replies often needs to read the content of every page visited, including your ERP, your HR portal and your webmail.
- The connector. "Connect your inbox", "access your files": one consent click lets a third-party app continuously read whatever the employee can see. Pasting is a one-off; a connector is permanent.
- Default settings. History kept, conversations used to improve the service, public share links to a conversation: these are settings, and a default is rarely the most cautious choice for a business.
What it changes: the risk does not depend on the tool, it depends on the combination of tool, account, setting and data. The same assistant can be acceptable with a business account and public text, and unacceptable with a personal account and a customer list.
What the authorities say
In Canada, the Office of the Privacy Commissioner and all its provincial and territorial counterparts published principles for responsible, trustworthy and privacy-protective generative AI technologies on December 7, 2023. They create no new obligations: they interpret existing law. For organizations using these tools, the principle on limiting collection, use and disclosure is clear: use anonymized or de-identified information in prompts where possible, enter sensitive or confidential information only when authorized, and do not retain or reuse prompts for other purposes. Status: guidance issued by the regulators, not binding in itself.
In Quebec, Law 25 adds a very concrete consequence. It treats any communication of personal information not authorized by law as a confidentiality incident. An employee who pastes customer details into a tool the company has neither approved nor covered by contract can therefore create an incident that must be recorded in the register and assessed: if it presents a risk of serious injury, the Commission d'accès à l'information and the affected individuals must be notified. We covered this in our article on Law 25 compliance.
On the security side, OWASP ranks sensitive information disclosure second in its 2025 Top 10 for large language model applications (LLM02). It reminds users to understand the risk of unintentionally providing sensitive data that may later come back out, and advises applications to keep user data out of training and to maintain clear retention and deletion policies.
Why a ban moves the problem
The reflex is understandable: block the public assistants and move on. In most organizations it does the opposite of what was intended. Use continues, on a personal phone, on the laptop at home, under a personal account, and it becomes invisible. You lose what little visibility you had, without reducing the need that drove people to the tool in the first place: saving time on writing.
What it changes: the right question is not "should we allow AI?" but "which tool do we offer, on what terms, and for which data?". A reasonable approved tool reduces risk more than a ban nobody follows.
Rules that fit on one page
1. One approved tool, on a business account. Pick an assistant offered under a business agreement, tied to your single sign-on, with a written commitment on data retention and on not using your data for training. Check those commitments in the contract, not on the marketing page.
2. Three classes of data, not thirty. One page, three columns: what can go in freely (public text, drafts with no personal information), what must be anonymized first (customer cases, internal figures), and what never goes into any assistant, even an approved one, without explicit authorization (customer or employee personal information, trade secrets, bids, sensitive source code, credentials).
3. No personal accounts for work. Easy to explain: no company data on a personal account, whatever its class.
4. AI extensions on an allowlist. Most managed browsers can allow only approved extensions. An extension that reads every page does not get installed without review.
5. Connectors approved by an admin. Common productivity suites can stop users from granting a third-party app access to their mail or files on their own. Turn on admin approval, then review the consents already granted.
6. Fifteen minutes of training, with examples. Not a twelve-page code of conduct: three examples of what is allowed, three of what is not, and the person to ask.
Put it in the register
The AI use register from the first episode lists the tools. Add four columns: account type (business or personal), retention and training as the contract sets them, the connectors allowed, and the most sensitive data class permitted. A line that cannot fill those columns is not approved yet.
In the risk register, the scenario is written like any other, with its four parts. A fictional example: "An employee pastes the price list and the contact details of 300 customers into a public assistant under a personal account; the data is retained outside any contract; a confidentiality incident must be assessed under Law 25 and the price list may reach a competitor." It has its source, its event, what is hit and its business consequence. Like every scenario, it also needs an owner.
This week's test
Take thirty minutes and two people: someone from IT and someone from a team that writes a lot (sales, HR, finance).
- Ask five employees from different teams, without judgment, three questions: which AI assistant did you use this week, with which account, and what did you put in it?
- In your managed browser console, list the installed extensions whose description mentions AI.
- In your email admin console, list the third-party apps employees have granted access to mail or files.
Three results should worry you. At least one "personal account" answer with company data: your policy is unknown, or unworkable. An AI extension nobody approved: it may already be reading your internal systems. A connector granted to an unknown AI app: that is permanent access, not one-off use.
What you should have in a month
One approved tool under a business agreement, a one-page rule with three data classes, admin approval for connectors, an extension allowlist, and four more columns in your AI use register. Not a ban: a path that is easier than the workaround.
Where FortaRisks fits
To see where you stand today, the Law 25 readiness assessment is free and needs no signup. To turn this into a tracked program, Forta Compliance assesses ISO 42001 and the NIST AI RMF among 40+ frameworks mapped to the same control baseline: the account rule, the connector review and the training become dated controls with evidence, instead of a policy reread once a year.
Next Thursday: what your customers will ask about your use of AI. The questions already showing up in security questionnaires, and how to answer them with evidence rather than promises.
Sources: Office of the Privacy Commissioner of Canada, Principles for responsible, trustworthy and privacy-protective generative AI technologies (December 7, 2023) · OWASP, LLM02:2025 Sensitive Information Disclosure · LégisQuébec, Act respecting the protection of personal information in the private sector