Keeping board information private when using AI

Data is the main reason boards hold back on AI, and they're right to be careful. Here is what to insist on before any board material goes near an AI tool.

When we talk to directors about AI, the first concern is rarely cost or complexity. It's data. Board papers carry strategy, results before they're public, legal matters and people decisions. Putting that into the wrong tool is a real risk, and boards are right to take it seriously.

The good news is that the risk is manageable. It comes down to choosing the right setup and insisting on the right commitments, in writing.

Where the real risks are

• Personal and consumer accounts. Free or personal AI accounts may have different terms on how data is used and kept. Board material doesn't belong there.
• Shadow AI. If the company hasn't provided a safe option, staff and even directors will use whatever is convenient. That's how sensitive documents leak.
• Copies everywhere. Every download, upload and pasted extract creates another copy. The more copies, the harder it is to control.
• Too much access. Connecting AI directly to finance or ERP systems widens the exposure far beyond what a board actually needs.

What to insist on

1. Business-grade terms. Use AI services whose commercial terms keep your data out of model training, and understand what they retain and for how long.
2. Your workspace, your data. Information should live in accounts your company owns and controls, not in an adviser's or vendor's systems.
3. Contracts first. A non-disclosure agreement and a data protection agreement signed before anyone sees a document.
4. Least access. Work from the reports and papers you choose to share. No standing access to ERP or finance systems.
5. Stored only where it must be. Anything kept for dashboards and trends should sit in an environment set up only for you, encrypted with keys you control, and be deleted when you leave.
6. Proper sign-in and audit. Single sign-on, multi-factor authentication, and a record of who accessed what.

Questions to ask any AI provider or adviser

• Where exactly does our data go, and where is it processed?
• Is any of it used to train AI models? Can you show us that in the terms?
• What do you keep, for how long, and how is it deleted?
• Who on your side can see our information?
• If we stop working with you, what do we keep and what is removed?

A provider who can't answer these clearly and in writing isn't ready for board-level work.

Careful isn't the same as standing still

The answer to data risk isn't to avoid AI. It's to adopt it deliberately, with the right setup, so that directors get the benefit without the exposure, and so that staff aren't left to improvise with tools nobody has checked.