Companies Are Rethinking AI Use Over Data Leakage Concerns

Corporate adoption of artificial intelligence has entered a new phase.

In recent years, the priority was to deploy AI as quickly as possible. Now, the question is changing:

what happens to the data sent to these models?

Concerns have grown as companies increasingly use AI to analyze contracts, internal documents, source code, commercial proposals, and customer information.

In September 2026, major technology and consulting companies began reassessing or restricting the use of certain AI models for tasks involving proprietary information. The shift highlights an important change: security, data retention, and governance are becoming just as important as model capability.

The problem goes beyond what the AI answers

When an employee uses an AI tool to summarize a contract, the content may be processed on external infrastructure, and some information may remain stored for technical reasons.

This raises important questions:

• how long is the data retained?
• who can access it?
• where is it processed?
• can the provider reuse the information?
• what contractual protections are in place?

For strategic or confidential information, these questions become critical.

Corporate data requires clear policies

The risk increases when employees submit information such as:

• contracts;
• customer data;
• financial reports;
• proprietary code;
• legal documents;
• strategic plans.

Even without intentionally sharing information outside the company, employees may create data flows that the organization does not fully control.

This is closely related to Shadow AI: the use of artificial intelligence tools without proper organizational approval or oversight.

A company may have dozens of employees using different AI services without knowing exactly what information is being shared.

"Not used for training" does not answer everything

Many providers state that enterprise data is not used to train their models.

That is important, but it is not the whole picture.

Companies still need to understand whether information may be temporarily retained for:

• security;
• auditing;
• abuse prevention;
• incident investigation.

For some organizations, reduced or zero data retention policies may become an important criterion when selecting AI providers.

Companies need to classify what can be sent to AI

A practical approach is to establish information sensitivity levels.

• Public content: generally acceptable.
• Routine internal material: permitted under defined policies.
• Customer data: requires additional controls.
• Strategic information: restricted.
• Passwords and credentials: should never be submitted.
• Trade secrets: only within specifically authorized environments.

This classification reduces improvisation and gives employees clear rules.

Corporate AI use requires governance

Organizations need to know which tools are approved and what information each system is allowed to process.

Basic measures include:

• mapping AI tools already in use;
• establishing usage policies;
• limiting the sharing of sensitive information;
• reviewing contracts and data retention policies;
• documenting critical AI applications;
• training employees.

More mature organizations may also use intermediary control layers capable of removing sensitive information or routing tasks only to approved models.

AI agents increase the risk

The issue becomes even more significant when AI agents have direct access to:

• email;
• CRM systems;
• corporate files;
• databases;
• business APIs.

In this scenario, employees no longer need to manually copy information into a chatbot. The agent itself may access the data.

This makes the principle of least privilege essential.

A sales agent does not need access to the entire finance environment. A customer service agent should not be able to export the entire customer database.

Each agent should have only the permissions required to perform its role.

What can companies do now?

The answer does not need to be banning artificial intelligence.

The goal should be to govern its use.

Important measures include:

1. map the AI tools already being used;
2. define which data may be shared;
3. create a list of approved solutions;
4. review providers' retention policies;
5. separate experimental use from critical processes;
6. control access and permissions;
7. train employees;
8. periodically review the company's AI policy.

Conclusion

The corporate conversation around artificial intelligence is maturing.

At first, the main question was:

which model is the smartest?

Now, other questions are becoming equally important:

• where is my data processed?
• how long is it retained?
• who can access it?
• what information may be submitted?
• which systems can use that information?

Companies do not need to choose between using AI and protecting their data.

They need to build an architecture where both can coexist.

The next phase of corporate AI adoption will likely be defined by the ability to clearly answer:

which AI system can access which data, for which task, and under which rules.

That is the difference between simply using artificial intelligence and establishing real AI governance.

References

• Reuters. September 2026 coverage of companies reassessing the use of AI models amid concerns over data security and intellectual property.
• Google Security. Publications on securing agentic capabilities and risks associated with indirect prompt injection.
• NIST. Artificial Intelligence Risk Management Framework — AI RMF.
• Public materials on AI governance, data retention, and information security in corporate environments.

Editorial notice: this article is informational and analytical in nature. Artificial intelligence and data protection policies should be adapted to each organization's technical, regulatory, contractual, and operational requirements.

Content produced for the Vórtice Blog — technology, artificial intelligence, security, regulation, automation, and digital transformation.