The Business Risks of Personal AI Accounts at Work

Employees are adopting AI tools faster than many organisations can assess them. The problem is not AI itself; it is company information being copied into personal, unapproved accounts with unclear contracts, retention, access and oversight.

What can go wrong?

• Customer, employee or commercially sensitive information is entered into an unapproved service.
• The organisation cannot retrieve or delete content held in a personal account.
• Inputs may be retained or used in ways the employee did not understand.
• A personal account lacks corporate multifactor authentication, logging or lifecycle controls.
• Generated content is inaccurate, biased or unsuitable but is treated as authoritative.
• Copyright, confidentiality or regulatory obligations are overlooked.

Begin with data classification

Tell staff which information must never be entered into public AI services. Examples may include passwords, authentication codes, personal data, customer records, contracts, source code, security configurations, incident details and unreleased financial information. Use examples relevant to real roles rather than a vague ban.

Offer an approved route

If AI can provide legitimate value, choose business accounts with suitable contractual terms, administrator controls, multifactor authentication and retention options. Define permitted use cases and assign an owner. Blocking every tool without a usable alternative often drives activity out of sight.

Keep people responsible for the outcome

AI output requires review. High-impact decisions, legal or financial advice, customer communications and technical changes need appropriate human approval. Generated code and documents should be tested, checked for sensitive data and treated as untrusted until verified.

Monitor proportionately

• Include AI services in the software and supplier register.
• Review sign-in methods, data locations and subprocessors.
• Use existing data-loss controls where appropriate and lawful.
• Provide a route for staff to report accidental disclosure quickly.
• Review policy as products and contractual terms change.

Responding to accidental disclosure

Record what was shared, which service and account were used, who could access it and whether deletion is possible. Involve the organisation’s privacy and security leads. Assess notification obligations and do not discipline people merely for reporting promptly; early reporting reduces harm.

Astley Digital can help organisations establish identity, device and data controls through our managed cyber security services and wider managed IT support.