Italiano 
The most common risk is everyday, not technical
When people talk about AI and data, they think of attacks and breaches. In practice the most frequent case is much simpler: someone copies a document into a tool to get help and does not know whether they were allowed to. Contracts, quotes with prices, customer lists: often nobody has said where you can and cannot.
Banning AI rarely works. What works better is saying clearly what can be done, with which tools and with which data.
This article gives practical guidance, not legal advice: for privacy and compliance matters it is always worth talking to an adviser.
Three categories of data, three rules
The simplest way to begin is to split data into three groups and give each one a clear rule.
- Public or already published data. Website text, catalogues, press releases. Usually fine to use, always reviewing the result.
- Internal, non-sensitive data. Procedures, drafts, working material that is not confidential. Use only with the tools the company has chosen.
- Confidential or personal data. Contracts, quotes with prices, customer lists, information about people. Not to be entered into public tools; use only in defined environments and after clarifying the rules with an adviser.
If you are still choosing where to begin with AI, you will find a method in Where to start with AI in business: how to choose the first process to improve.
What to ask a tool before using it with company data
Before putting company data into a service, it helps to have an answer to a few questions. If you cannot find it in the terms of use, ask the provider:
- Where and how is the data I enter processed?
- Can my content be used to improve the service?
- Who, inside and outside the company, can access what I write?
- Can I delete the data and the conversations?
- Is there a record of who did what?
An assistant that works only on the company's sources
An alternative to copy and paste is an assistant connected to approved sources: documents, price lists, answers already validated. It replies using that content and not what it finds elsewhere. This is the logic of the webRay® AI assistant for events, which answers about programme, access and services using content approved for the event.
When the assistant must also work with CRM, email and management systems, you need to decide carefully which data it can read and which actions it can take. This is the topic of the pages on AI integration and workflows and AI agents and assistants (Italian pages). For a similar case in events, see Integrare la segreteria organizzativa con i sistemi aziendali: come farlo bene (Italian).
For examples of AI applied to an event secretariat, see Segreteria eventi 4.0: come usare l'IA (Italian) and IA negli eventi: come rivoluzionare l'organizzazione (Italian).
The internal rules to write: one page is enough
- List the approved tools. The ones the company has chosen and checked. Any others are for public data only.
- Classify the data. Use the three categories and add your own examples: the documents your team uses every day.
- Decide what always needs human review. Anything that goes out to customers or suppliers, before it is sent.
- Say who to ask when in doubt. A person or an address, so nobody decides alone.
- Explain why, with examples. Ten minutes with real cases works better than a long rulebook.
Before giving company data to an AI assistant
Check these six points
Data category known: public, internal or confidential.
Tool approved by the company for that type of data.
Terms of use read, with answers to the five questions.
Approved sources defined, if the assistant will answer customers.
Human review planned before any external use.
Adviser involved for privacy matters.
Frequently asked questions
It depends on the tool, its terms of service and the type of data, and it should not be taken for granted. First check the terms of use and talk to a privacy adviser. Yes. That is why approved sources, rules on what it may answer and a handover to a person in doubtful cases are used. It helps, and it can be short: approved tools, data categories, what needs review and who to ask. What matters is that it is clear and that people know it. The head of each area, together with whoever handles privacy and security. An adviser can help set the categories.Can I use public AI tools with customer data?
Can an assistant connected to my documents make mistakes?
Do I need a written policy?
Who decides which data is confidential?
Want an assistant that works only on the company's content?
Let's talk: we can assess together which sources to use, which data stays out and how to keep control of the answers.
Let's talk
