18/06/2026
Every time someone types a message into ChatGPT, Claude, Gemini, or Copilot, data leaves your business.
Free versions often use your inputs to train future models by default. Business tier versions typically exclude this, according to vendor documentation. The distinction is not a feature. It is what happens to your information after submission.
Cumulative GDPR fines have reached 7.1 billion euros. The EU AI Act reaches full enforcement in August 2026.
If you are using a third-party AI tool, you remain responsible for its privacy practices. You cannot outsource that liability to the vendor.
Shadow AI is the gap nobody has mapped. Employees using personal AI accounts for company work. Extremely common. Usually well-intentioned.
Almost entirely invisible to leadership.
Data entered into a personal consumer account is governed by consumer terms, not your enterprise agreements. No visibility. No contractual protection. No ability to audit or delete.
The audit that closes this takes days, not months.
List every AI tool in use. Tool, vendor, data categories processed, who has access, link to the privacy policy.
For business tier tools, disable training on your data where the option exists.
Review access quarterly. Remove it immediately for anyone who has left.
This is not a reason to stop using AI.
It is a reason to know what you have already agreed to.