Which Company Data Can Go Into Which AI Tool?
The owner's AI strategy | Monday morning: 15 minutes to handle how sensitive your data is
A rule about AI that only says what is forbidden settles nothing: it leaves each person to decide alone at the moment they are in a hurry, and they reach for the tool they already know.
Your teams probably already use AI. The useful question is not whether to allow it, but which data can enter which type of tool, and which families you have not planned for at all.
I start from the data rather than the tools, because tools change quickly while your document families stay the same: public content, internal documents, customer data, finance and HR, contracts under NDA. Four types of tool are enough to decide: a free or personal account on a general-purpose assistant, a paid professional plan from a cloud provider, a service hosted in Europe, a model running on your own hardware. What separates them is what happens to the data: who processes it, where, under which contract, and whether the provider can use it to train its models. I run local models on my own hardware, for control above all. With them, the question “where does the data go?” is not answered by reading terms of service. Not every case justifies that choice, and cost matters, but it is one of the four boxes.
Between them, everything turns on the contract, and I offer these as checks to make, not as legal certainty. Is a data processing agreement in place with the provider? Does it forbid training its models on your data without your consent? For a customer contract under NDA, one more check: does the text allow a third party to process the document? As soon as you are handling personal data about customers or employees, GDPR applies whatever the tool. This is general information, not legal advice, and for the sensitive families the rule deserves a lawyer’s review.
Monday’s exercise fits in fifteen minutes:
- Ask three people which AI tool they opened last week, and for what kind of document. Ask out of curiosity, not as an audit, or you will only get guarded answers.
- Sort the documents they mention into the families above.
- For each family, write which of the four tool types it can go into.
- Find the empty boxes: the families for which no tool is approved.
The empty boxes are what matter. A data family with no approved tool still gets used, just with the free tool the person knows, outside your view. I do not believe a company can do without AI without losing speed and access to skills it does not have in-house, so my starting point is not prohibition: it is giving every family somewhere to go. Undeclared use also shows which tool your most capable users prefer, and I would ask them before writing the rule.
I built a free tool that draws this map from your answers and turns it into a draft rule to adapt for your team.
Which data family has no approved tool in your company today?