A business leader showed us the text he had just sent to a public chatbot: it contained the name of his biggest client, negotiated rates, and actual margin.
The danger that day wasn’t a conscious machine taking over his company, but a thirty-second copy-paste.
Here are the risks already present in daily professional use, and the framework we apply before approving a tool for our clients.
Key points
- Treat every prompt like a public message: no client data, rates, or contracts.
- Check the terms of use before adoption: training on your exchanges, opt-out available or not.
- Review all outputs before use, as a hallucination implicates your business, not the provider.
- Maintain an internal skillset capable of doing the work without the tool.
- Document your usage: the AI Act scales obligations based on risk level.
What happens to a prompt once sent
A prompt, meaning the text you type into an AI tool, leaves your workstation upon validation and goes to a third-party provider’s servers.
The right question isn’t whether the file is lost, but who can read it later and what it’s used for.
The terms of use of major public tools allow, in some cases, the reuse of exchanges for model training, with or without opt-out, meaning without explicit refusal.
These terms change and differ between a free version, a professional subscription, and an enterprise offer.
A professional data leak via generative AI doesn’t look like any intrusion: it takes the form of a rushed employee pasting a contract excerpt into a chat window.
An incorrect response implicates your name
Models sometimes produce inaccurate information with confidence, known in the industry as hallucinations.
Error rates and data on biases circulate widely and should be sourced before being included in an internal memo or client presentation.
The operational risk is more mundane: a quote built on an invented rate, a bid response citing a non-existent rule, content published with a faulty formulation.
In front of your client, it’s your business responding, and the tool doesn’t appear anywhere in the discussion.
Recent positions of insurers and professional bodies on liability related to AI use are evolving, a call to your insurer is better than guessing.
The dependency that costs later
A tool adopted by the entire team becomes a production block, and its pricing conditions and features can change without your consent.
The second effect is less visible: an internal skillset that is rarely used erodes, and the team loses the ability to judge a questionable output.
A writer who no longer constructs an outline, a salesperson who no longer reviews a clause, that’s how a time-saving measure turns into a loss of control.
Recent models make this issue more tangible, as detailed in our analysis of what Claude Opus 5 concretely changes for a business.
The legal framework already exists
The European AI Act categorizes uses by risk level and scales obligations accordingly, with a staggered implementation timeline.
A small business generating marketing content and one automating candidate sorting don’t fall under the same level of requirements.
Check the category your usage falls into before extending a tool to multiple departments, and keep a written record of your decisions.
The specialization of models by industry, evident with OpenAI’s vertical model dedicated to life sciences, makes this scope question even more concrete.
The evaluation framework before adopting a tool
Five risks cover almost all situations encountered in small and medium-sized businesses.
| Risk | Warning sign | Immediate action |
|---|---|---|
| Data leak | Client content pasted into a public tool | Written rule on what never leaves the company |
| Incorrect response | Output used without human review | Mandatory validation before any external sending |
| Provider dependency | Terms of use changed without notice | Regular content export and second tool tested |
| Legal liability | Generated content published without control trace | Check with insurer and usage log |
| Loss of skills | No one knows how to do the task without the tool | Task rotation and internal training |
Test a tool on a complete fictitious case before entrusting it with a real file: you’ll see its errors without paying for them.
Where to start this week
Write a page, not a twenty-page regulation: what can go into a prompt, what can’t, who reviews before publication.
Then open the terms of use of the tool your team already uses, and look for the mention of training on your data.
If you want an external review of your usage, our team works on this topic daily and presents its approaches to AI applied to work.
FAQ
Can my data be seen by other users?
The scenario of a response regurgitating your contract to a competitor is still rare, the realistic scenario is the reuse of your exchanges for model training, as provided by some public terms of use, sometimes with a refusal option, sometimes without, which requires reading the page before entering any client data.
An employee has already pasted a confidential document, what should I do?
Delete the conversation and history when the tool offers it, check the account retention settings, inform the person concerned internally, then write the missing rule rather than sanctioning, as the lack of clear instructions explains most of these situations in companies with fewer than fifty people.
Is a paid subscription safer than a free version?
Often yes on paper, professional and enterprise offers display different commitments regarding training and retention, provided you check the signed contract rather than the marketing page, and keep in mind that these commitments evolve with updates to the terms of use.
