Generative artificial intelligence has entered offices in a matter of months: summarising documents, writing emails, analysing data. Often, however, it is used without rules, with company information or personal data entered into systems without knowing where it ends up.
In this guide we look at the main privacy and confidentiality risks, a checklist of 10 checks to carry out before adopting business AI, a sample table of contents for an internal policy and how ThorIA addresses these points.
The risks of generative AI with company data
Data sent to a third-party provider
When an employee pastes text into an online AI tool, that data leaves the company and is processed by the provider's systems. If it contains personal data about customers or employees, or confidential information, the company is in effect entrusting processing to an external party.
Contractual terms
What the provider can do with the data depends on the terms of service and the contract. Free or personal versions and business versions can have very different rules. Without an adequate contract it is hard to know what guarantees you have.
Use for training
Some services may use the data entered to improve or train their models. For a company this is an essential point to clarify: confidential information used for training slips out of its control.
Location
Knowing where data is stored and processed matters both for security and for privacy obligations, particularly when data could be transferred outside the European Union.
On top of these risks there is "shadow" use: tools adopted by individual employees without the company knowing. The first step in managing the risk is therefore knowing which tools are being used and for what.
Quality and checking of results
Finally, there is a risk less tied to privacy but just as real: AI-generated content can contain errors. Using it unchecked in documents, customer communications or internal decisions can cause problems. That is why every result should be checked by a person before it is used.
Checklist: 10 checks before adopting AI
Use this table to assess any AI tool before introducing it in your company.
| # | Check | Question to ask |
|---|---|---|
| 1 | Contract and DPA | Is there a clear contract and a data processing agreement (DPA)? |
| 2 | Where the data is | In which country is the data stored and processed? |
| 3 | Use for training | Is the data entered used to train models? |
| 4 | Retention | How long is the data kept and how is it deleted? |
| 5 | Access and roles | Who can use the tool and what information can they access? |
| 6 | Internal policy | Are there written rules on what can and cannot be done? |
| 7 | Logs | Are activities recorded and can they be consulted? |
| 8 | Employee training | Do the people using AI know how to use it correctly? |
| 9 | Support | What support does the provider offer, at start-up and over time? |
| 10 | Certifications | Does the provider hold verifiable security certifications? |
No single check is enough on its own: it is the full set of answers that tells you whether a tool is suitable for the use you have in mind. A tool that is acceptable for writing public texts may not be for processing staff data. If AI is used to manage staff in Italy, also take into account the information obligations under Law 132/2025 on AI.
It is useful to document the outcome of the checks for each tool: that way, if a colleague asks whether they can use a certain service, the answer is already available, and in the event of an audit you can show the assessments carried out.
Internal usage policy: a sample table of contents
A written policy turns the company's choices into rules everyone can understand. Here is a possible table of contents to adapt to your organisation:
- Purpose and scope: who the policy applies to and for which tools.
- Authorised tools: a list of approved AI tools and the procedure for requesting new ones.
- Usable data: which information can be entered and which is excluded, for example personal or confidential data.
- Permitted and prohibited uses: concrete examples for the different departments.
- Checking results: generated content must always be checked by a person before use.
- Transparency: when and how to inform customers, users and workers about the use of AI.
- Roles and responsibilities: who approves tools, who checks, who to contact with questions.
- Security: credentials, access, incident reporting.
- Training: training paths for people who use AI.
- Review: how often the policy is updated.
The policy is also the starting point for complying with the AI Act: for the updated deadlines, read our article on the AI Act and the Digital Omnibus. For technical terms, see our glossary.
An effective policy is short and concrete. A few clear rules, with practical examples for the different departments, are better than a long document nobody reads. It should be communicated to all employees, included in training and updated when the tools in use change.
How ThorIA addresses these points
ThorIA, Thorsoft's business AI, meets several of the checklist's checks:
- Where the data is: data is hosted in the EU (Milan, Italy).
- Use for training: data is never used to train models.
- Access: unlimited users, with access for everyone authorised.
- Customisation: the Thorsoft team configures ThorIA on business processes.
- DPIA: available on request.
- Certifications: ISO 27001, ISO 27017 and ISO 27018.
Thorsoft classifies ThorIA in the AI Act's limited-risk category. The internal policy, staff training and the assessment of its own processing remain the company's responsibility.
Adopting AI safely does not mean giving up its benefits, but using it with clear rules: knowing what data is entered, where it ends up and who can access it is the condition for making it work in the company's favour.
F.A.Q. - Frequently asked questions
Can I use ChatGPT at work?
It depends on the data processed, the contract and the service settings: assess the DPA, data location and use of data for training before entering company information.
What are the main risks?
Data sent to a third-party provider, unclear contractual terms, possible use of data for training, and data location outside the company's control.
What should I check before adopting business AI?
Contract and DPA, where the data is, use for training, retention, access and roles, internal policy, logs, employee training, support and certifications.
Do we need an internal AI policy?
It is strongly recommended: it sets out which tools are allowed, which data can be used, how to check results and who is responsible.
Does ThorIA use my data for training?
No. With ThorIA, data is hosted in the EU (AWS Milan, Italy) and is never used to train models.
Request a demo
Find out how to use AI at work with data in the EU, never used for training.
General information only, not legal advice: always check the current legislation.