Uncontrolled AI use brings risks you can't undo.

• Personal data walks out of the door

  Names, BSNs (Dutch citizen service numbers), salaries, medical details and addresses end up with an American provider. Without a data processing agreement and a record of processing activities, that is a risk under the GDPR, with a possible duty to notify.

  What you do about it: only let the assistant see text in which names and numbers have already been replaced. See Pseudonymise or anonymise.

• You don't know what is kept

  With consumer versions of AI chatbots, input may be kept and used to train models, depending on the settings. Business versions usually offer more control, but without deliberate configuration and a data processing agreement you have no certainty about what happens to the data.

  What you do about it: choose a business subscription and switch training off. See Which subscription you may use for business.

• Transfers outside the EU

  Processing on servers outside the EU requires a valid transfer mechanism — such as the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs) or an adequacy decision — and a risk assessment. With uncontrolled chat use, that is usually missing. A European provider largely removes this concern, but not the others: ‘in the EU’ says where your data is stored, not what you may put into it. There too, the entire client file goes along.

  What you do about it: record for each provider where the data goes and on what lawful basis. See A data processing agreement with an AI provider.

• No trail, no proof

  The supervisory authority asks: which data, whose, when, on what lawful basis? A chat history on a private account doesn't answer that. Nor does a record of processing activities.

  What you do about it: put the use in your record of processing activities and keep track of who shared what. See A record of processing activities for AI tools.

• Shadow AI can't be stopped with a ban

  An AI ban moves the use to phones and private laptops. Employees want the convenience. You're better off offering it safely than banning it blindly.

  What you do about it: offer a route that is allowed, and write down what isn't. See Shadow AI.

• The EU AI Act raises the bar

  Since 2 February 2025 the AI literacy obligation has applied (Art. 4); other obligations on transparency and high-risk systems follow in phases. A document search function doesn't automatically fall into the high-risk categories, but if AI is used for decisions about people (HR, credit, clients), strict requirements apply.

  What you do about it: arrange the AI literacy of your employees. See AI literacy is mandatory.

"We thought our accountant, adviser and HR colleagues only worked with anonymised documents. At the first spot check, it turned out nobody knew exactly what had been uploaded." From a conversation with a client. Sound familiar? This is the standard situation in SMEs, not the exception.