Artificial intelligence is improving work in more and more businesses, from marketing and customer service to software development and legal teams. But implementing AI is not just about choosing a tool. It also means taking responsibility for data, people and regulatory compliance. Below are practical steps worth considering, regardless of your company’s size or industry.
If you are interested in the technical side of building AI-powered solutions, for example with Azure OpenAI, read our article “How to use Azure OpenAI to build AI software”.
1. Develop a policy for using AI tools
Setting clear rules for the use of AI tools in your business is the starting point for a safe implementation. A policy helps ensure that:
- Employees know which solutions they may use and on what terms.
- The business limits legal, operational and reputational risks.
- The organization brings team knowledge to a consistent level and prevents inadvertent mistakes.
- Clients and business partners can see that the business is adopting technology responsibly.
Why does this matter?
Without internal rules, tools may be used without control. In the absence of guidance, employees may enter trade secrets, contact details or code fragments into AI tools. This can create:
- Risk of disclosing confidential data: information may be sent to external models that the business does not control.
- Risk of a GDPR breach: personal data may be processed without a legal basis.
- Risk of disputes over authorship: there are no rules for content generated with AI.
- Risk of losing know-how: the business loses control over its intellectual property.
Actions
- List the AI tools that are approved for use in the organization.
- Specify the purposes for which each tool may be used, such as creating marketing materials, coding assistance or analytical support.
- Define prohibited uses, for example using AI for HR decisions, automated employee assessments or generating legal content.
- Set rules for the data that may be entered into tools, such as allowing only non-personal, public data and excluding sensitive information about clients or employees.
- Require a security audit before implementing a new AI tool in the business.
- Separate access, for example by assigning dedicated AI accounts or instances to specific teams.
- Use paid, professional versions of AI tools that provide greater control over data processing and privacy settings.
2. Review and assess the AI tools already in use
Before adopting a formal policy, check which tools are already being used, often without the knowledge of management or the IT department. Employees may use popular text generators, data-analysis tools or coding assistants that have not been reviewed. The goal is to identify the tools in use, assess their risks and decide which may remain available and which should be blocked.
Why does this matter?
Free or widely available AI tools often rely on models trained using data entered by users. Information entered by employees, including client data, may therefore become part of a training dataset. The business can lose control over confidential information and even its intellectual property.
Actions
- Inventory the tools in use: find out which AI tools teams use, both at organizational and individual level.
- Assess security: check whether data is encrypted, where it is processed, and the provider’s licensing terms and data-processing rules.
- Make a decision: based on the assessment, decide which tools to approve, possibly after purchasing a license or enterprise version, and which to disable.
3. Amend agreements with employees and B2B contractors
Introducing new technology may require updates not only to internal procedures, but also to agreements with people who use these tools. The purpose is to define duties for responsible AI use, both for employees and B2B contractors.
Why does this matter?
Anyone using AI tools in the business may, even unintentionally, expose the organization to significant legal risks:
- Entering personal data into an AI tool may create a risk of a GDPR breach.
- Entering know-how or copyright-protected materials may create a risk of disclosing trade secrets or infringing intellectual property rights.
- Without formal allocation of responsibility, the business may bear financial and reputational consequences without recourse against the person responsible.
Responsibilities and information duties should therefore be expressly included in agreements with the team.
Actions
- Duty to follow the AI policy: each agreement should require compliance with the current version of the internal AI-use policy.
- Ban on unapproved tools: contractors and employees should be required to use only tools approved by the business and to report a proposed new tool before using it.
- Acknowledgements: require a statement confirming that the person has read and accepted the AI-use rules.
- Liability clauses: agreements should address liability for improper AI use, including data-protection breaches, disclosure of confidential information and copyright infringement.
4. Be transparent with clients about AI use
Businesses adopting AI should aim for full transparency with their clients. The goal is to build trust and tell clients whether their data may be processed using AI-based tools.
Why does this matter?
Clients should know whether and how AI processes their data. Using AI without prior notice may be perceived as a breach of trust and, in some cases, may lead to allegations of a GDPR breach or breach of the terms of cooperation.
Actions
- Communicate clearly: tell clients in privacy policies, agreements, proposals or on your website that the business uses AI, in which areas, and how personal data is protected.
- Label content: if the business publishes content generated by AI, such as reports, summaries or analyses, mark it with a note, a statement at the end of the document or an icon. This increases credibility and helps clients assess the nature of the information.
5. Amend agreements with clients
Using AI to provide services may require changes to client agreements. The goal is to define the scope of permitted AI use and who is responsible for its results.
Why does this matter?
AI use, even as support for human work, may have unforeseen consequences, from unintended errors to generating content that infringes third-party rights. If the agreement does not address these risks, the parties may find it difficult to determine who is responsible for any resulting damage.
Actions
- Information clauses: include provisions telling clients that the business may use AI tools to deliver services, for example for data analysis, generating supporting content or automating processes.
- Liability limitations: add disclaimers addressing responsibility for the effects of AI tools, especially where AI is used to support human work.
- Copyright provisions: specify who owns the results of work involving AI and how intellectual property rights and the business’s confidential information are protected.
6. Monitor compliance with the AI Act
The AI Act is the first regulation governing artificial intelligence in the European Union and is already being applied. Check whether AI solutions your business develops or deploys fall within its scope and what obligations follow. This is particularly relevant to businesses developing their own AI systems or integrating such tools into products and services.
Why does this matter?
The AI Act imposes specific legal obligations, especially on providers and developers of AI systems classified as high-risk, including:
- Data quality management.
- Ensuring transparency and the ability to explain how the system works.
- Recording incidents.
Failure to meet these obligations may result in financial penalties and suspension of the solution from the EU market.
Actions
- Assess whether the AI Act applies: analyze whether solutions used or developed by the business, such as recommendation models, risk-assessment systems or chatbots, fall within the AI Act and, if so, to what extent.
- Address the issue in agreements: if the business develops or deploys AI systems, include appropriate contractual provisions, including responsibility for training data, transparency and the ability to explain how an algorithm works (explainability), in line with AI Act requirements.
7. Consider on-premise tools for confidential data
On-premise solutions are installed and operated on the business’s own local infrastructure. They allow the business to retain full control over its data and limit exposure to external threats. Use them where disclosure of data could have serious legal or financial consequences.
Why does this matter?
Most publicly available AI tools, especially SaaS products, rely on cloud solutions over which the user does not have full control. Risks include:
- Data sent to models may be replicated and processed outside the EU.
- Data may be used for further model training if that option is not disabled.
- The business loses control over where and how data is processed.
For confidential or classified data, this risk is unacceptable.
Actions
- Analyze business needs: identify areas where the business processes sensitive or strategic data and consider on-premise AI tools, especially where data must not leave local infrastructure.
- Separate environments: distinguish environments that may use SaaS, such as marketing or trend analysis, but only paid versions and after a prior security audit, from environments handling confidential data, which should operate only locally or on controlled servers.
Frequently asked questions
What should an AI-use policy for a business contain? It should list approved AI tools, permitted purposes such as marketing, coding or analytics, and clear prohibitions, for example using AI for HR decisions or generating legal content. It should also set data rules, including what information may be entered, require a security audit before a new tool is deployed, separate access between teams and require paid tool versions that provide control over data processing.
How can you check whether tools already used by your team are secure and compliant? Start with an inventory of the AI tools used by teams and individuals, including tools used without management’s or IT’s knowledge. Then assess each tool’s security: whether data is encrypted, where it is processed, and the provider’s licensing and data-processing rules. Based on that assessment, decide which tools to approve, possibly after purchasing an enterprise version, and which to block.
Do agreements with employees and B2B contractors need to change when AI is introduced? Yes. Each agreement should require compliance with the internal AI policy, prohibit unapproved tools and require an acknowledgement that the rules have been read and accepted. Add liability clauses covering improper AI use, including GDPR breaches, disclosure of confidential information and copyright infringement. Without these provisions, the business may bear financial and reputational consequences without recourse against the person who caused the problem.
How should a business tell clients that it uses AI to avoid concerns about lack of transparency? State in privacy policies, agreements, proposals or on the website where AI is used and how personal data is protected. If you publish AI-generated content, such as reports, summaries or analyses, label it with a note, a statement at the end of the document or an icon. Such labeling increases credibility and helps clients assess the nature of the information.
When should a business consider on-premise tools instead of SaaS? Consider on-premise solutions where the business processes sensitive, confidential or strategic data and disclosure could have serious legal or financial consequences. SaaS tools rely on cloud infrastructure, where data may be replicated outside the EU or used to train models. For confidential data, the source describes this risk as unacceptable. Separate environments: marketing and trend analysis may use paid SaaS tools after a security audit, while confidential data should be processed only locally or on controlled servers.
