Your Employees Use AI. But Where Does Your Company Data Go?

Topic: Product

AI is becoming part of everyday business operations. Employees use it to draft proposals, analyse reports, summarise meetings, review contracts, and write code. The productivity gains can be impressive.

But here's a question every CEO, CIO, and CTO should be asking: What happens to your organisation's data after an employee clicks Submit?

The answer may be more complicated than you think.

The AI Black Box Nobody Talks About

We often describe AI as a black box because we cannot fully explain how complex models produce their outputs. But there's another black box organisations should understand.

How AI applications handle their data.

Imagine an employee uploading a confidential business document into an AI tool. Where does that document go? Is it retained? Used for model training? Accessible to third parties? Processed in another country? And when the employee deletes the conversation, is the information actually deleted?

Not all AI platforms operate identically. Some provide strong enterprise protections, contractual safeguards, and restrictions on model training. Others have different policies depending on the product, subscription, and configuration.

The real danger isn't that every AI tool is unsafe. It's assuming they're all safe without verifying how they operate.

One AI Request. Multiple Organisations.

Consider a typical AI application:

Employee → AI Application → Model Provider → Supporting Infrastructure

Depending on its architecture, additional providers may handle storage, monitoring, logging, or analytics.

Knowing which AI model an application uses doesn't necessarily tell you how the application itself handles information. A vendor might use a highly secure enterprise AI model while maintaining its own document storage, access controls, and retention policies.

The security of the underlying model doesn't automatically guarantee the security of the application built around it.

When the Stakes Are Higher

Consider three situations.

Healthcare: A hospital uses AI to summarise patient records. The summary is accurate, but was the application authorised to process identifiable patient information?

Financial services: A team analyses confidential customer records using AI. The insights are valuable, but where is that information processed and retained?

Technology: A developer uploads proprietary source code into an AI assistant. The tool identifies a defect, but what protections apply to the intellectual property?

In each case, AI may perform exceptionally well. But technical performance alone doesn't establish responsible data handling.

The conditions under which AI delivers value matter as much as the capability itself.

Why Blocking AI Isn't the Answer

When organisations discover employees using unapproved AI tools, their instinct may be to block access. Sometimes, immediate restrictions are necessary. But blocking tools without addressing the underlying business need can encourage employees to seek alternatives outside approved channels.

Unrestricted adoption is equally problematic. The leadership challenge is finding the balance.

How do we enable innovation while protecting the information, relationships, and trust on which our businesses depend?

That requires collaboration between business leaders, technology, security, legal, compliance, and employees.

Seven Questions Every Leadership Team Should Ask

Before approving an AI application, I would want answers to these questions:

1. What information enters the system? Is it public, confidential, proprietary, or regulated?
2. Who processes the information? Which application providers, model providers, and subprocessors are involved?
3. How long is it retained? What happens to stored documents, logs, and deleted conversations?
4. Can it be used for model training? What do the applicable contractual terms and settings permit?
5. Where is it processed and stored? Are data residency and regulatory obligations addressed?
6. What security controls exist? Can access, encryption, auditability, and incident response be verified?
7. Who is accountable? Who approves the application, monitors its use, and responds when something goes wrong?

These questions shouldn't be answered only once. As AI applications evolve, their architectures, integrations, and risks may change.

AI governance must evolve alongside AI adoption.

Governance Should Enable Innovation

Governance and innovation aren't opposing forces. Effective governance establishes boundaries within which organisations can confidently adopt AI.

Employees know which tools are approved. Technology teams understand the architecture. Security teams understand the risks. And leadership can make investment decisions with greater confidence.

The objective isn't to eliminate every possible risk. It's to make informed decisions with appropriate safeguards.

Governance should enable responsible innovation, not become an excuse to avoid it.

Businesses must adapt as technology and customer expectations change. But reinvention isn't simply about adopting new capabilities. It's about creating sustainable value.

My Liquid Ocean Compass® framework examines this through four interconnected pillars:

Story: What are we promising customers and employees about our use of AI?

Value: Which applications create meaningful business benefits?

Execution: Can we implement and operate them responsibly?

Reputation: Are we protecting the trust our stakeholders place in us?

An AI application might improve productivity today. But if it compromises sensitive information or customer confidence, the long-term cost may outweigh those gains.

Trust isn't separate from business value. It's one of the conditions that sustains it.

From AI Adoption to AI Value

Identifying an AI use case is only the beginning. The real challenge is turning that opportunity into measurable business value while protecting the organisation's obligations and reputation.

A Leadership Dilemma: What Would You Do?

Imagine discovering tomorrow that employees have been uploading confidential business information into unapproved AI tools. Some are improving productivity. Others may be exposing sensitive information. You don't yet know the extent of the risk.

Your leadership team proposes four responses:

• A. Block access until the risks are assessed.
• B. Introduce approved enterprise AI tools with appropriate safeguards.
• C. Train employees on what information can and cannot be shared.
• D. Review the data flows, risks, and business needs before deciding on controls.

All four may be necessary. But which would you prioritise first, and why?

Would your answer change if you were leading a hospital, bank, technology company, or professional services firm?

I'd welcome your perspective in the comments. Because every wave of AI brings new possibilities.

But making AI pay off demands leaders who know where to act, understand the risks, and have the confidence to lead responsibly.