Before You Roll Out AI Tools: A Data and Security Checklist

In most companies the AI rollout has already started, whether management decided on it or not. Someone pasted a contract into a chatbot to summarize it. Someone connected an AI assistant to their email. Someone in sales is generating proposals with a tool nobody in IT has heard of.

None of this is necessarily bad. These tools can save real time. But they also move company data to new places, under new terms, through accounts nobody manages. Before you turn individual experiments into an official rollout, it is worth checking a few things.

This checklist is not about whether AI is useful. It is about making sure that when you do use it, you know where your data goes and who is responsible for it.

Start by finding out what is already in use

You cannot assess risk for tools you do not know about. Before anything else, find out what your team is actually using.

The simplest way is to ask, and to make it clear that the goal is to understand, not to punish. People will tell you more if they are not worried about getting into trouble. You can complement this with a look at expense reports and card statements for AI subscriptions, and with your identity provider or browser management, if you have one, for connected apps.

Write the results down: tool, who uses it, what for, and what kind of data goes into it. That list is your starting point.

Data: what goes in, and where does it go?

This is the most important part. For each tool, find out:

What data your team puts into it. Public information, internal documents, customer data, financial data, source code?
Whether the provider uses your data to train its models. Many consumer plans do by default; business plans often do not. Check the actual setting, not the marketing page.
How long the provider keeps your data, and whether you can delete it.
Where the data is stored and processed. This matters if you have customers or contracts with data residency requirements.
Whether the tool connects to other systems, such as email, drive or CRM, and what permissions those connections have.

A useful rule of thumb: classify before you allow. Decide which categories of data are fine for which tools. Public marketing text in a general chatbot is a very different risk from customer records in the same tool.

Accounts: who owns them?

When an employee signs up for an AI tool with a personal email and a personal card, your company has no control over that account. When the employee leaves, the account and everything in it leaves with them.

Business accounts under company control for any tool used for work.
Single sign-on where the tool supports it, so access ends when employment ends.
Admin visibility: someone in the company can see who has access and what is connected.
A clear owner for each approved tool, responsible for settings and renewals.

Contracts and terms

The free or cheapest plan of an AI tool usually comes with consumer terms, which are written to protect the provider, not you.

Read the terms that apply to your plan, specifically on data use, confidentiality and liability.
Check whether a data processing agreement is available if personal data is involved.
Check your own customer contracts. Some of them may restrict sharing client data with third-party services, and an AI tool is a third-party service.
Know who owns the output. For most business use this is not a problem, but it is worth confirming for anything you plan to publish or sell.

Quality: who checks the output?

AI tools produce fluent, confident text even when it is wrong. That is the risk that is easiest to underestimate.

Define where a human must review the output before it is used: customer communication, contracts, financial figures, code that goes to production.
Decide who is accountable when AI-assisted work contains an error. It should be the person who used the tool, not the tool.
Spot-check the output of tools that are used at scale. A small sample reviewed regularly tells you more than a big review once.

Cost: what does it really cost?

AI tools are often priced per seat or per use, and both add up quietly.

List all AI subscriptions, including those on individual cards.
Check for overlap. Several teams may be paying for different tools that do the same thing.
Watch usage-based pricing. Tools billed per request or per token can grow fast once they are connected to automated workflows.
Compare cost with actual use. Seats nobody uses are the easiest savings you will find.

Then write it down

Once you have the answers, turn them into a short, readable policy. One or two pages is enough: which tools are approved, what data may go into which tool, who to ask about new tools, and where human review is required.

Keep it practical. A policy that bans everything gets ignored, and people go back to using whatever they want, only now in secret. A policy that says "yes, here is how" gets followed.

The goal is not to slow AI adoption down. It is to make sure that when it speeds up, you still know where your data is.

For a structured way to evaluate a specific tool, use our free AI Tool Risk Assessment guide. It turns the questions above into a scoring sheet you can fill in for each tool in about half an hour.