AI Data Security Checklist for Companies: 20 Items

An AI data security checklist for companies starts before the tool: with a decision about which information may leave your environment. This one has 20 items in four groups, each with why it matters and how to verify it. It works whether you are about to buy a solution or already have people using chat tools on their own.

Group 1: what never goes into an AI tool

1. Personal data of customers and staff, such as ID numbers, addresses, health and pay. Matters for privacy law; check that workflows anonymize first.
2. Technical drawings and projects under confidentiality. A leak exposes your edge; review NDA clauses with customers.
3. Pricing, margins and negotiated terms per customer. Keep a cost sheet version without names.
4. Passwords, API keys and access credentials. Never in prompts; use a password vault.
5. Source code and product formulas. Decide who can approve exceptions.
6. Contracts and legal documents under negotiation. Get legal sign-off before use.

Group 2: contract and tool configuration

1. A business plan, not free personal accounts, which sit outside your control.
2. A clause barring use of your data to train models. Look in the contract or privacy terms.
3. Where data is processed and stored. Ask about region options and whether your customers care.
4. A list of subprocessors, meaning who else touches the data. Request it in writing.
5. Single sign-on and two-factor authentication for everyone. Check that the admin panel can enforce it.
6. Permission controls: who sees which chat, knowledge base or integration. Test with a regular user.

Group 3: retention, logging and incidents

1. A defined retention period for conversations and uploaded files. Confirm you can delete on demand.
2. Access and usage logs, so you know who did what. Ask for a sample report.
3. A process for data-subject deletion requests where the law requires it. Test with a made-up case.
4. A breach response plan: who tells whom, and how fast. Write it on one page.
5. Backups and export of your data in case you switch vendors. Check the export format.

Group 4: internal policy and culture

1. A one-page AI use policy in plain language, with do and do-not examples. Review it twice a year.
2. A list of approved tools and a way to request new ones. Without it, people improvise.
3. Short training of 30 to 60 minutes using real company cases. Record who attended.
4. Mandatory human review before any generated text, calculation or spec reaches a customer. AI is wrong with confidence.
5. A named owner who answers questions and updates the rules. No owner, no policy.

How to use this checklist in practice

Print it, mark each item as met, partial or not met, and prioritize groups 1 and 2, which cut the most risk for the least effort. For larger integrations, such as an assistant wired into your ERP, bring in IT and legal.

If you are planning an automation that touches internal data, see how we handle it in our AI and automation services. This checklist is a starting point and does not replace legal advice for your situation.

Frequently asked questions

Can we use the free version of an AI chat at work?

For tasks with no internal data, such as generic brainstorming, risk is low. For anything about customers, projects or pricing, use a business plan with contractual guarantees.

Do privacy laws apply to AI use?

Yes, whenever personal data is processed, including pasting a customer email into a tool. Ask a lawyer about legal basis and vendor agreements.

Should we ban AI to protect our data?

Bans tend to push use underground. Offering an approved tool, clear rules and training is safer.