Company data leaks through ChatGPT and other public AI tools – how to protect your business

Public AI tools like ChatGPT have entered everyday work faster than almost any other technology in recent years. Employees paste contract excerpts, source code, customer data, or notes from board meetings into them - simply because it speeds up their work. The problem is that in many companies this happens without the knowledge or approval of the security team, and the line between "quickly using AI" and "taking confidential data outside the company" is much thinner than it seems.

In this article, we explain how data leaks through public AI tools actually happen, what the real business and legal consequences are, and how to effectively protect your company - without having to ban the use of AI altogether.

‍

How data leaks through public AI tools actually happen

A leak through public AI rarely looks like a dramatic hacking incident. Far more often, it's the result of everyday, seemingly harmless employee actions:

‍

Pasting data directly into the chat. An employee wants to quickly summarize a contract, analyze financial data, or fix a piece of code, and pastes the content straight into a public tool. Depending on the account settings and the provider's terms of service, that data may be stored on the provider's servers and, under some plans, potentially used to further train the models.

‍

Browser extensions and AI integrations of unclear origin. Browser plugins or email and calendar integrations installed without IT review often have broad access to the content they process - including confidential correspondence.

‍

Using personal accounts for work purposes. When employees use free, personal AI accounts instead of company-provisioned, properly configured tools, the company loses any control over what happens to the data being entered.

‍

Lack of a data classification policy. Very often the problem isn't employee bad faith, but the absence of clear rules - nobody told them that customer data, production code, or documents covered by an NDA must never be pasted into public tools.

‍

The real consequences of a data leak through AI

The fallout from a leak like this goes well beyond the technical incident itself:

‍

GDPR violations. If personal data - of customers, employees, or job candidates - ends up in a public tool, the company may be in breach of data protection regulations, carrying real risk of financial penalties and a mandatory incident report.

‍

Loss of intellectual property. Source code, product documentation, or business strategy pasted into a public chat may - depending on the provider's terms of service - be used in ways the company has limited control over, and that can be difficult to reverse.

‍

Breach of NDAs and confidentiality clauses. In B2B relationships, especially with clients in finance, automotive, or defense, a leak of confidential information can mean a contract breach and real loss of the partner's trust.

‍

Loss of competitive advantage. Training data, unique processes, or know-how that ends up in an external system stops being the company's exclusive property in any meaningful sense, since it's no longer fully under the company's control.

‍

Problems with audits and certifications. Companies pursuing certifications such as ISO 27001 or TISAX need to demonstrate control over the flow of confidential data. Uncontrolled use of public AI within a team can be a real obstacle to obtaining or maintaining that certification.

‍

How to effectively protect your company from data leaks through public AI

Banning AI use outright rarely works in practice - employees will find a way to use it anyway, just outside the company's control. A more effective approach combines policy, education, and technology.

‍

1. Put a clear AI usage policy in place

The company should clearly define which categories of data must never be entered into public AI tools (personal data, customer data, production code, NDA-covered documents) and which tools are approved for business use. A policy without a real alternative usually isn't enough on its own, though.

‍

2. Train your team

Most leaks don't come from bad intent - they come from a lack of awareness. A short, concrete training session - with real examples of what's allowed and what isn't -meaningfully reduces the risk, especially when paired with a clear explanation of why these rules matter.

‍

3. Block or monitor access to unverified tools

IT teams can restrict access to public AI tools at the network level or deploy Data Loss Prevention (DLP) solutions that detect attempts to send confidential data to external services.

‍

4. Deploy a private company AI assistant as an alternative

This is the most effective way to reduce reliance on public tools without cutting employees off from AI altogether. A private AI assistant - running on-premise, in an isolated cloud, or in a TEE (Trusted Execution Environment) - gives your team the same capabilities as public ChatGPT, but the data never leaves the company's controlled infrastructure. Domain-specific LLMs, hosted on the company's own infrastructure and fine-tuned to its specifics, offer a similar solution. Once employees have a convenient, fast, and approved alternative, the pull toward public tools naturally fades.

‍

5. Regularly audit how AI is used in your company

An AI audit lets you check which tools are actually being used by your teams, what data flows through them, and where the biggest gaps in your security policy are - before someone outside the company finds them first.

‍

Summary

Data leaks through public AI tools are rarely the result of malicious intent - far more often, they stem from a lack of clear policy, employee training, and a convenient, secure alternative. Banning AI in the company doesn't solve the problem, since employees will keep using it anyway, just beyond the reach of the security team. A more effective approach combines clear rules, training, and deploying a private AI assistant that gives the team a real, secure alternative - without having to give up the benefits that artificial intelligence brings.

‍

Want to check how securely AI is being used in your company? Book a free consultation and let's talk about which solution would best protect your team's data.