Key points in 30 seconds
- Classify data into three levels: public, internal, confidential.
- Use business accounts whose terms exclude training on your data.
- Never enter personal or confidential data in a consumer tool.
- A one-page policy everyone knows beats an ignored ban.
The three main risks
- Data leaks: a contract, customer list or password entered in a consumer tool.
- Errors: an invented answer reused unchecked in a customer document.
- Non-compliance: processing personal data without a legal basis, contrary to applicable law (in Tunisia, the 2004 organic law on personal data protection; the GDPR for data of EU residents).
Classify the data
| Level | Examples | AI use |
|---|---|---|
| Public | Website, brochures, published articles | Allowed |
| Internal | Procedures, templates, anonymised minutes | Approved business tools |
| Confidential | Personal data, contracts, prices, financial data | Forbidden outside an approved, governed tool |
Choose the right tools
The business plans of the main vendors (ChatGPT Enterprise or Team, Microsoft 365 Copilot, Gemini for Google Workspace) include contractual commitments on confidentiality and on not training models with your data. Check each plan's terms, data location and admin options before rolling them out.
The ten-line usage policy
- Approved tools and accounts to use.
- Data that must not be entered.
- Mandatory review of any content intended for a customer.
- Disclosure of AI use where relevant.
- Who to contact in case of doubt or incident.
Pair it with a short training session: most leaks come from lack of information, not bad intent.
Technical risks to know about
- Prompt injection: a document or web page containing hidden instructions can hijack an AI assistant connected to your tools.
- Extensions and connectors: each connection to email, the CRM or files widens the tool's access; enable only what is needed.
- Personal accounts: an employee using a free account for work escapes all control.
- Access rights: an assistant that searches company files can reveal documents the user should not see if permissions are poorly configured.
Setting up governance
Appoint someone responsible for AI use, often the IT manager or a member of management. They keep the list of approved tools, validate new uses, track incidents and update the charter. Plan a quarterly review of actual usage: what teams really do with AI is often different from what was planned.
Training teams
A two-hour session covers the essentials: what AI does well and badly, the three data levels, approved tools, checking answers and good habits. Add concrete examples from your business: drafting a client reply without pasting the contract, summarising a meeting without personal data, preparing an analysis from anonymised figures.
Checking an AI provider
| Question | What you need |
|---|---|
| Is your data used to train the models? | A written contractual commitment that it is not |
| Where is the data hosted? | The hosting region and subprocessors |
| How long is it kept? | A precise retention period and the option to delete |
| Who can access it? | The provider's and your administrators' access rules |
| Which certifications? | For example ISO 27001 or SOC 2 |
What to do after an incident
- Identify the data exposed and the tool involved.
- Delete the conversation or file if the tool allows it, and revoke any access.
- Inform the designated person and, if personal data is affected, assess whether you must notify the competent authority.
- Inform the people concerned if necessary.
- Fix the cause: training, settings, change of tool.
Record each incident in a log: it is the best basis for improving the rules.
Balancing security and productivity
Banning AI does not protect the company: employees then use consumer tools with no control. The right approach is to provide professional tools suited to real uses, with simple rules. Time savings are significant in writing, summarising and analysis, as long as the framework is clear. See our guide on Microsoft Copilot for SMEs for an example of an integrated tool.
Getting support
An AI usage audit lists the tools in use, the data involved and the risks, then proposes a charter and a roadmap. It is often the first step of a wider automation project. Our AI and digital transformation support covers both.
The legal framework
Data protection rules apply to AI too. In Tunisia, the 2004 organic law governs the processing of personal data and requires declarations to the competent national authority. For data on European residents, the GDPR requires a legal basis, information for the people concerned and safeguards for transfers outside the EU. In the Gulf, several countries have adopted their own personal data laws. Before entrusting data to an AI tool, check with your legal adviser the rules that apply in your clients' countries.
Frequently asked questions
Can ChatGPT be used with company data?
Yes, with a business plan whose terms exclude training on your data, and under a policy that forbids entering personal or confidential data outside an approved framework.
Should employees be banned from using generative AI?
Bans are rarely respected. It is more effective to provide approved business tools, a clear policy and short training.
Which law applies to personal data used with AI?
The data protection law of the country concerned, for example the 2004 organic law in Tunisia, and the GDPR for data of EU residents.
Can you use free ChatGPT at work?
For public content, yes. For internal or confidential data, use a business plan whose terms exclude training on your data and allow account administration.
Should clients be told about AI use?
It is recommended when AI is involved in a deliverable or a client relationship, such as a conversational agent. Transparency builds trust.