AI saves you time, but what are you giving it in return?

I regularly see users at our clients copying entire email threads or internal documents into a ChatGPT window to get a summary or draft a reply.

They are trying to save time. But are they aware that they are also handing this information over to an outside provider?

It is the ease with which we entrust our companies’ data to artificial intelligence tools that worries me. I see in it a risk of data leakage on a global scale, fuelled by our own habits.

What I am talking about here is a loss of control: information leaves the company, sometimes without approval, without a suitable contractual framework, and without management knowing exactly what has been sent.

Shadow AI is becoming a habit

Shadow AI is the use of artificial intelligence tools without the company’s approval or oversight.

An employee opens a personal account, pastes a document and gets an answer in a few seconds. The tool works, so they do it again.

In the conversations I observe, the question of what happens to the data often comes second to efficiency.

Yet an email can contain personal contact details, commercial information or confidential details about a client. The person sending it is not necessarily authorised to share all of its content with another provider.

The CNIL, France’s data protection authority, recommends submitting to consumer AI services only information you are authorised to share, excluding confidential data.

Free or paid, I want to understand what happens to my data

The saying “if it’s free, you’re the product” often comes to mind.

But I don’t want to reduce the subject to the price of the subscription. The terms depend on the service used, the plan subscribed to and the account settings.

OpenAI states, for example, that content from ChatGPT Free, Plus and Pro users may be used to train its models, with an option to opt out. For ChatGPT Business, Enterprise and the API, inputs and outputs are not used for this purpose by default.

A paid personal subscription is therefore not, on its own, a suitable framework for company data.

And turning off training does not answer all my questions: where is the data processed? How long is it kept? Which subprocessors are involved? What contractual guarantees do we have?

Even without reuse for training, the information has still been entrusted to a third party.

The provider’s nationality is not enough

I pay particular attention to the jurisdiction the provider falls under and to the countries where the data may be processed.

The GDPR can apply to companies established outside the European Union. A transfer outside the EU is not automatically prohibited, but it must be governed in accordance with the applicable rules.

Conversely, choosing a French company does not exempt you from checking its terms.

Mistral AI is one of the providers I want to turn to. Even so, I also have to look at the chosen plan: its documentation provides, depending on the service, for possible use of interactions for training and for mechanisms to opt out.

My interest in a French player must not replace this check.

Even with Copilot, you need to look at the exact configuration

The name “Copilot” covers several experiences, with different commitments.

Microsoft states in particular that Copilot Chat, used with a work or school account, benefits from enterprise data protection and that prompts and responses are not used to train the foundation models. Microsoft also states that there is no training on the content used by Copilot in consumer Microsoft 365 apps. It would therefore be inaccurate to sum up the situation as “Copilot Pro reuses everything, the enterprise version protects everything”.

Where processing takes place deserves a separate check.

Microsoft documents a setting called “flex routing”, which can allow requests to be processed outside the EU Data Boundary during peak load, notably in the United States, Canada or Australia. This setting is enabled by default for certain eligible tenants created after 25 March 2026. Administrators can turn it off.

So I prefer to check the actual commitments and settings rather than rely on the commercial name of a subscription.

Cost often comes up in my conversations with business leaders

When I ask whether the company has planned a suitable business plan, I regularly hear that equipping every user would cost too much.

I understand this constraint. I run a company too.

But I find it hard to weigh the savings made without looking at the information that goes into these tools. The data concerned also belongs to our clients and our employees.

I want us to give teams understandable rules and suitable tools. Otherwise, usage grows without anyone having really decided what level of risk is acceptable.

And when you allow an assistant to access your mailbox or your document spaces, I find it even more necessary to examine the permissions granted. The scope then goes far beyond the document you would have chosen to copy.

Why I keep investing in local AI

This is the approach I put into practice with CityPilot, the application I developed for the Salon des communes et des intercommunalités, the trade show for municipalities and their groupings.

For its various uses, I rely on smaller models suited to specific tasks. They need fewer resources and can run on more compact hardware, locally. For these needs, I don’t need frontier models, the most advanced models on the market.

I find this approach more consistent: choosing a model according to the job to be done makes it possible to control the resources needed while keeping the data on my own infrastructure.

When I need the capabilities of a more advanced model, I go through an anonymisation step before sending it the documents. I developed a tool for this, with one point to watch: removing names is not enough if the rest of the content still makes it possible to identify people or reveals confidential information.

With CityPilot, I keep exploring a way of using AI that fits my needs and my ethics. I want to be able to benefit from these tools while staying in control of what I entrust to them.

---

In your company, do you know which tools your employees use and what data they put into them?

https://emerging-it.com/en/services/cybersecurity/