Your colleague in the office is probably talking to a chatbot for help at this moment. Whether it's a quote, a contract review or the answer to an angry customer, that convenience comes at a cost. AI security risks grow every time someone passes your team data you'd rather they not - here are 7 quick checks to gauge your risk.
Why AI Security Risks Deserve Attention Now
Sign up for an AI tool in less than 60 seconds and no one has to ask permission. So, AI tools can spread across your organization even faster than any manager can keep up. And every prompt you run could contain a customer's name, a price list, or a personal email address. Once that text leaves your network, you lose visibility over it-and the owner often finds out about the leak last.
7 things to verify before trusting the AI
1. Know Every Tool in Use
Make a fun, non-accusatory poll. Have everyone write down all of the AI apps they use over a week. Keep all of those replies in a single shared list as the most sneaky apps are the hardest to guard against. Use the list each time a new app appears.
2. Determine What Can't Get Through
Things you definitely don't want going into a public-facing bot
- Passwords
- Bank details
- Notes about the dentist
- Never-handwritten contracts
Write it down somewhere that no one can take a stab at it, and stick it on the wall.
3. Discover where your information ends up
Free plans may keep your prompts and use them to improve the product. Check the privacy policy before joining, and upgrade to a paid business plan that commits to keeping your content private.
4. Keep All Accounts Safe
For each of the users, create an individual account and switch on a two-factor authentication system. Disable the login access of the employee on his date of resignation. Never assign a common password as this can make it difficult to know who exactly made the changes.
5. Put a Human on Review Duty
Chatbots can make false facts sound totally believable. It's important to have one person go over all of the information that will be seen by the user - prices, dates and legal language in particular. One mistake with those types of data can lose a customer and spending an hour proofing is much cheaper.
6. Comply with Australian Privacy Legislation
Many Australian businesses are subject to the Privacy Act. Copying and pasting your customer records into an AI system may violate those obligations. For free, easy-to-understand privacy tips, go to the Australian Cyber Security Centre.
7. Create a single page AI Guidelines
Maintain a cheat sheet of your policies: whats OK, whats not OK, who to call in case of ambiguity. Distribute to all new hires and review quarterly. Those three pages are certainly much easier to get through than one thousand page user guide to your system.
Getting Started
Tackle steps one and two this week. They together take about an hour for your team, and expose most of what you need to know. Then do one additional check every other day, and have your team report back to you on what they find. Being slow on the solution will eliminate pain down the line.
Need AI for Backup? We have helped Melbourne businesses automate their AI from day one, and safeguard their automation. Book a FREE consult and we'll show you how your team has already been using AI.
FAQs
What are the main security challenges posed by AI for SMBs?
The top safety dangers embrace employees sharing personal buyer data with a public AI chatbot, weak or shared passwords, and publishing AI solutions with out testing when the consumer displays up.
Is it fine to put customer info into ChatGPT?
Avoid using it on free versions of the tool you find publicly, as this could result in your prompts being saved or reused, and choose a business plan with decent privacy controls and training disabled if it is essential.
Is an AI policy really necessary for a small team?
Yes, because one page specifying permitted tools, what information not to include and who to call can avoid straightforward mistakes that might be costly and embarrassing.
Can using AI tools breach Australian privacy law?
Yes - in some circumstances, including if your data is being shared without your consent or you are at risk of harm. Speak to your provider about where and how your data is stored, used and protected.
How often do we need to review the tools we are using?
Review them at least quarterly to bi-annually. Review them each time you purchase a new software, change providers or lose a person who you have granted access to.