Define how staff may use AI
List work purposes, tools and responsible people—for example, organising public information, drafting text or assisting with documents. Specify which content may be used, which actions require approval and who checks the results. Treat AI output as a draft requiring review, rather than directly using it for important decisions or unapproved external communications.
- List approved tools, accounts and use cases.
- Appoint reviewers and approvers for actions with business impact.
- Provide a contact route for errors, unusual behaviour or suspected data leakage.
Protect information before choosing document controls
Customer, employee, financial, design and other sensitive information should not be entered into AI tools without approval. Review data types, upload methods and vendor data-processing arrangements, then plan permissions, endpoint protection and DLP controls. Whether controls apply to a particular AI website or application depends on product capabilities and testing.
- Distinguish public, internal and sensitive content.
- Evaluate workflows with de-identified or test data rather than real customer information.
- Understand whether data is retained, used for training or passed to third parties, and who can access it.
Limit what tools can read, change and do
AI tools connected to email, documents or other systems should receive only the resources and read/write permissions needed for their work. External documents, websites and emails may contain malicious instructions. Keep source content separate from operating instructions, and independently check outputs, recipients, file locations and action parameters. Rules written in a prompt alone cannot fully prevent prompt injection.
- Consider read-only access before granting write or modification permissions.
- Require human approval before sending emails, changing or deleting files, and other consequential actions.
- Separate staff, vendor and tool accounts, retain necessary records and make access revocable.
Testing, recovery and enquiry preparation
AI security planning also covers plug-in, connector and vendor permissions and updates. Trial tools within a limited data set and scope, checking incorrect outputs, requests for excessive access and suspension methods. Important files and systems still need backups and recovery procedures. Usage guidance, permissions and backups can be introduced in stages; settings and tests for individual AI tools are scoped to the business scenario.
- Provide tool names, account types and actual work purposes.
- List the data and systems involved, and whether content is sent or changed automatically.
- Describe existing permissions, backups, vendors and approvers.
- Use examples without sensitive information to explain the workflow you want to improve.
Service scope, hours and fees are subject to the agreed proposal.
Information and references
When is this service suitable?
Common needs
- Staff use AI to process customer data, documents or work content.
- AI tools connect to email, files or systems, requiring clear read/write boundaries.
- You want usage guidance and approvals for important actions.
Which service do I need?
- Cybersecurity solutions
Bring AI use into existing account and data protection.
- DLP business data loss prevention
Confirm available controls against data flows.
- Business data backup
Prepare recovery from accidental deletion or incorrect actions.
Prepare for an enquiry
- Describe AI tools and their main tasks.
- Data types processed and systems to connect.
- Who approves tools, manages permissions and reviews results.
For an initial enquiry, describe the issue and equipment only. Do not submit passwords or verification codes. The team will arrange a secure channel for sensitive documents and incident records.
EnquireAI usage and business data security planningCybersecurity and AI useExplore security planning, responsibilities and acceptance considerations
Cybersecurity · Safe AI use
Business cybersecurity and managed protection: security planning priorities
「AI use and data security planning for SMEs」 includes the following security priorities; measures, tests and deliverables are specified in the proposal.
- Assets and defencesIdentify systems, endpoints and networks to protect, checking applicable products, modules and policies for each scenario.
- Data and monitoringClarify log, intelligence and alert sources, exchanged data and recipients, defining monitoring and handling activities covered by the service.
- Response and responsibilitiesDiscuss incident classification, policy changes, recovery and business/support responsibilities, documenting owners and procedures for each task.
AI considerationsInventory AI assistant or agent data, service accounts and tool permissions separately. Network or endpoint protection does not cover every prompt-injection or agent-action risk.
Planning and acceptance recordsAsset and control lists, policy and alert-test records, incident procedures and service responsibilities.
You may also want to know
If staff only use AI to draft text, do we need a new security product first?
Start by listing the tools, data types and review responsibilities, and establish clear usage guidance. Then assess actual gaps in accounts, permissions, endpoint or document controls. Different use cases need not be forced into one product.
Can we upload customer documents to an AI tool for analysis?
Obtain company approval and understand data processing, retention and third-party arrangements first. Do not upload real sensitive information while these remain unclear. Use de-identified or test content to explore a suitable workflow.
Is a prompt telling the AI not to leak information sufficient?
No. Limit tool and account permissions, separate external content from instructions, verify outputs and action parameters, require human approval for consequential actions, and provide suspension and recovery procedures.