While our webinar on implementing AI guidelines covered "shadow IT" at length, our experts' conversations with clients reveal three specific problems that go beyond the usual, simplified "allow/block" approach.
Here are three strategic and technical insights from a conversation between our experts, Vija Kalniņa and Jānis Judrups, that will change how you think about security.
1. The "free cheese" trap: model training
The problem isn't that employees use AI – it's which version of it they use.
In the webinar, we highlighted a key distinction:
- Free tools (Public AI): If your lawyer pastes a contract into the free version of ChatGPT or DeepL, that text is most likely stored and used to train the next version of the model. In theory, there is a risk that your organization's confidential information could one day surface as an answer to another user.
- Enterprise / Team plans: In paid versions (API or Team plans), the settings typically ensure that your data isn't used to train the underlying models.
The takeaway: It's not enough for your guidelines to say "use tool X for drafting English-language documents." There needs to be a clear line: public versions of tools may only be used for general information, while sensitive data requires a sandboxed environment that doesn't pass data on further.
2. The "traffic-light principle" for data classification
"How do we control all of it?" is one of leaders' biggest fears. The answer: an organization doesn't need to control the use of the tools themselves – it needs to control which data goes where.
We recommend introducing a simple "traffic-light principle" for employees:
This approach takes the pressure off employees – they don't need to be IT experts, they just need to understand what kind of data they're working with.
3. Human in the loop
Vija Kalniņa highlighted a critical ethics and safety point that often gets forgotten amid the excitement of automation.
No AI decision that affects people (such as candidate selection, benefit approval, or legal analysis) should be fully automated. Guidelines must include the principle that AI is an assistant, not the decision-maker.
Final responsibility always rests with the employee. That means "copy-pasting" a chatbot's output without reading it back and checking the facts counts as a breach of work discipline.
Do you have a clear plan for putting these three principles into your documentation?
We've seen that organizations struggle most with the first step – auditing the current situation and classifying risk. That's why we've built a service that takes you, within two months, from "I don't know what they're doing" to "we have a safe, certified environment."