Home › Answers › Data, privacy and GDPR
Are AI tools secure for business?
Short answer
The major AI tools run on secure, encrypted services, but that isn't the whole picture. The National Cyber Security Centre warns that AI can state wrong facts confidently, can be tricked by "prompt injection", and can be corrupted through its training data. For a small business, the biggest risk is usually staff pasting sensitive information into personal accounts.
The risks the NCSC highlights
| Risk | What it means for you |
|---|---|
| Hallucination | AI states incorrect things as fact. Check figures, law and prices before using them |
| Bias and gullibility | Leading questions get agreeable answers |
| Prompt injection | Hidden instructions in a web page, email or document make the AI do something you didn't intend |
| Data poisoning | Tampered training data skews results |
| Shadow AI | Staff using unapproved tools; the NCSC published on this in September 2026 |
A security checklist for small firms
- Use business plans for business data. They usually exclude your data from training and give you admin controls.
- Turn on two-factor sign-in for every AI account.
- Turn off model training on any personal accounts staff use for work.
- Never paste passwords, bank details or API keys into a chat.
- Be careful with agents and connectors that can read your email or files, because that's where prompt injection bites. See can AI agents be trusted?
- Write a one-page AI policy. See do I need an AI policy?
Related questions
Is AI safe to put my information into?
Not all of it. Treat a chat box like an email to a supplier: fine for general questions, not for anything confidential. See how to use AI safely at work.
Which AI tools protect business privacy best?
Business plans from the major providers: ChatGPT Business, Claude Team, Microsoft 365 Copilot and Gemini in Workspace all say they do not train on business data by default.
Why do AI tools need my data?
To answer, the tool has to read what you send it. Training is separate, and on most tools you can switch it off.
Sources
- NCSC: AI and cyber security, what you need to know
- NCSC: prompt injection is not SQL injection
- ICO: guidance on AI and data protection
Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI agents be trusted?
- Can AI read my WhatsApp messages?
- Can I put customer data into ChatGPT?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.