It usually starts innocently. Someone needs a client email rewritten, a spreadsheet formula explained, or a contract summarised before a meeting. So they open a free AI chatbot, paste the details in, and get a decent answer in seconds. The problem is what happens to that information next, and whether your business can still claim it is GDPR and Cyber Essentials compliant.
Most free AI chatbots are consumer products. When your office manager pastes a customer complaint, a supplier contract, or a list of employee details into one, that text leaves your business and lands on someone else's servers. Depending on the tool's terms, it may be stored, reviewed by humans, or used to train future models.
You would not let a member of staff email a client list to a stranger. Pasting it into an unapproved AI tool is the same thing, just faster and harder to spot.
This is not about being anti-technology. It is about knowing where your data goes. Under UK GDPR you are the data controller, which means you are responsible for what happens to personal data even when an employee moves it somewhere unwise.
GDPR asks you to know what personal data you hold, where it is, and who can see it. If staff are quietly feeding names, addresses and case notes into three different AI tools, none of that is true any more.
Cyber Essentials is more practical. It wants evidence of controlled access, patched devices, malware protection and a clear understanding of your technical estate. Shadow AI sits outside all of it. It is another account, another login, another place your data lives that nobody is managing.
If you ever need to answer a subject access request, or explain a breach to the ICO, "we think a few people used ChatGPT" is not a comfortable answer.
This is exactly the sort of gap our cyber security services are designed to close, usually in a single review session.
Vibe coding tools let people build working apps and automations by describing what they want. That is genuinely useful. A capable office manager can now produce a small internal tool in an afternoon.
But speed does not change security fundamentals. Someone still has to decide who gets access to that tool. Someone still has to make sure it is not holding a database of customer records on a free tier with a shared password. Someone still has to patch it when a dependency is updated.
Common problems we see with quick-built tools include:
The tool is new. The mistakes are old. Access control, strong passwords and backups still matter, and they are exactly what a professional setup gives you.
Banning AI outright rarely works. Staff will use it on personal phones instead, which is worse because you cannot see it at all. The better answer is to give people approved tools with sensible guardrails.
Microsoft Copilot inside your existing Microsoft 365 tenant is the obvious starting point for most small businesses. Because it sits inside your tenant, it respects the permissions you have already set. A user cannot ask Copilot to summarise a document they were never allowed to open.
That single feature removes most of the accidental data-leak risk. You can also control whether prompts and responses are retained, restrict which apps Copilot can reach, and keep everything inside your existing compliance boundary.
If your Microsoft 365 setup has grown organically over the years, the permissions underneath may need a tidy first. Our Microsoft 365 support team can review sharing settings and guest access before you switch anything on.
Alongside the technology, a one-page AI policy is worth more than most people expect. Keep it plain:
You do not need a huge project. You need a short, honest conversation about what your team is already doing.
Ask your IT provider three questions. Which AI tools are actually being used on our network and accounts? What data are they touching? What settings, licences or policies would let us use AI safely and stay compliant?
A good provider will look at your Microsoft 365 tenant, check who has what access, review your sharing settings, and suggest a sensible starting point. They will also tell you honestly if a tool you have heard about is not right for your size of business.
This is not about slowing anyone down. Staff who know the rules get on with their work instead of worrying, and you stop losing sleep over what left the building last Tuesday. If you would like a straightforward review of your AI use and compliance position, our managed IT security service is built for exactly this.
We will review your Microsoft 365 setup, check your sharing and access settings, and help you put a simple AI policy in place that keeps you GDPR and Cyber Essentials compliant.
Explore managed IT security → Book a FREE IT Consultation →Related services: cyber security services · Microsoft 365 support · IT support contracts
When you subscribe to the blog, we will send you an e-mail when there are new updates on the site so you wouldn't miss them.
© SysFix IT Support Ltd, 2003-2026
VAT Number: GB 206 7821 12
Company Number: 09416191
