Is our data safe with AI?

"Is our data safe with AI?" — it's usually the second question, right after "how much does it cost?"

And it's the right question. Connecting an AI tool to your emails, contracts, plans, or client data without a framework is an unnecessary risk. Articles on security culture lay the foundation; here I address the concrete concern: AI and your business data.

At a glance

The main risk isn't AI itself — it's where your data goes and who can access it
Consumer tools (free ChatGPT, unapproved apps) ≠ enterprise solutions with controls
A simple framework is enough for a pilot: classification, scope, human validation, traceability
Quebec's Law 25 strengthens transparency obligations — AI doesn't change that; it raises the stakes
A well-run AI pilot can be more secure than today's process (unencrypted email, USB keys, scattered notes)

Where risk actually comes from

Situation	Risk level	Why
Employee pastes a client contract into a consumer tool	High	Data may be used for training or stored outside your control
Pilot on non-sensitive internal docs, enterprise tool	Moderate	Limited scope, clear contracts
Flow with classified data, Canadian hosting, MFA, logging	Low (if configured well)	Controls aligned with existing policies

The most common problem I see isn't a dramatic breach. It's well-intentioned workaround: someone wants to save time and sends sensitive data to the wrong tool.

Five questions before any pilot

What data enters the flow? (Internal only? Personal information? Trade secrets?)
Where is it processed and stored? (Region, vendor, subprocessors)
Is it used to train a model? (Answer should be no for business use)
Who has access and how do we authenticate? (Individual accounts, MFA, no shared passwords)
What happens if something goes wrong? (Notification, deletion, audit logs)

If a vendor or integrator can't answer these clearly, it's not the right time for a pilot with real data.

What a minimal SMB framework looks like

You don't need an 80-page manual to start:

Classify — green (internal, pilot OK), yellow (personal data — strict rules), red (forbidden without legal review)
Approve — list of authorized tools; no "bring your own AI" without governance
Validate — human in the loop before any external send (meeting notes, reports, client emails)
Document — who does what, which data flows where, where it's archived
Train — 30 minutes of awareness beats a policy nobody reads (cybersecurity is everyone's job)

AI can improve security (when structured)

Ironically, a well-scoped AI flow sometimes replaces riskier habits:

Meeting notes in unencrypted email → transcription in a controlled workspace
Paper copies or USB keys → central archive with permissions
"I remember what we said" → validated written record

Security isn't the enemy of AI. It's the prerequisite for team trust.

Law 25 and AI: what Quebec leaders should know

Law 25 requires transparency, minimization, and protection of personal information. AI doesn't create an exemption — it increases the volume of data processed. For a pilot:

Limit personal information to what's strictly necessary
Document the purpose of processing
Review vendor agreements (subprocessors, transfers outside Quebec if applicable)

I'm not a lawyer; for sensitive cases, involve legal counsel early — not after rollout.

Red flags

"We don't know where the data goes, but it's handy"
One shared account for the whole team
No human review before client-facing output
Tool not covered by organizational contracts or policies
Pressure to "move fast" without a framework

Related on this site

Data safety with AI isn't all-or-nothing. It's clear scope, approved tools, and accountable humans. If data concerns are blocking your pilot, let's talk — you can often start on a low-risk internal case without compromising clients.