The post AI is Listening: What Executives Must Know about Privacy in the Age of Workplace AI Assistants appeared first on Foster Institute.

Tool Approval: You could include a note about a procedure to approve AI tools before they’re used, especially for work that involves private or company-sensitive information, such as “Before using a new AI tool, check with the security or IT team… Make sure it’s on the approved list.”

Human Accountability: Consider stating that they, the person, not AI, are ultimately responsible for decisions and documents they send out. AI suggestions should be reviewed by someone who understands the context, especially since AI is prone to hallucinations, trying to please the user, and being out of alignment with your culture. For example, “If an AI tool writes an email or gives advice… read it before sending it out or acting on it.”

Confidentiality Protection: Remind employees not to share confidential company or customer information with AI platforms unless approved. Such as “Don’t copy and paste customer names, contracts, or financial reports into any AI tools unless explicitly approved in writing.”

Incident Reporting: To help drive home the seriousness of privacy, tell them to notify you with wording such as “If an AI tool shares the wrong info or leaks something by accident… report it like you would a security breach.”

Usage Boundaries: You could state what activities are acceptable to use AI (e.g., summaries, brainstorming) and where AI is not allowed (e.g., signing contracts, making hiring decisions) such as “AI can help draft ideas or summarize documents and produce narratives… but don’t use it to make final calls on people or legal stuff.”

Work Documentation: Consider telling people to save a copy (or cc someone) of all AI-generated work outputs, especially if they’ll be used in decisions or presented to clients. For example, you could say, “If an AI tool creates something you plan to use or send… save a copy of the input and output so we can check it later if needed.”

Ethical Guidelines: Include something about the ethical use of AI tools, such as: “Only use AI tools in ways that are ethical, fair, and respectful of others. Just because a tool can do something doesn’t mean it should.”

Risk Assessment: You could also get them to think a little more by saying, “Before using AI for something any task… ask yourself: could this create bias, mislead someone, or share something private? Ask us if you have any doubt.” (you might want to replace “us” with a specific person).

Harassment Prevention: Address using AI for harassment or anything that violates someone’s rights. For example: “Never use AI tools to create or spread harmful, threatening, or harassing content. Report it right away if you see it.”

Societal Impact: You could also include text to get your team thinking about AI’s effects on people and society. For example, “When using AI, ask whether it could hurt someone’s rights or reputation or lead to larger problems in society… If in doubt, stop and ask.”

Mandatory Training: Providing training is essential for AI use. Include a clause that employees must participate in training about responsible AI use. You could phrase it: “We’ll offer training to help you understand how to use AI safely and fairly… and you must participate.”

Approved Tools: Mention the AI tools you have approved. You might say, “The only allowed AI tool(s) at (your organization’s name) is/are the (tool or tools) using the identity and credentials you’ve been provided by (your organization’s name). No other versions, nor any other AI tools, are allowed and are expressly prohibited unless explicitly approved ahead of time by (person’s or department’s name). Don’t sign up for AI tools using your work email or passwords unless approved.”

Usage Monitoring: Some tools help your IT team track and block access to AI tools. You might consider adding some accountability, such as: “AI usage can be so dangerous that we are keeping records of which tools you use so we can refer to that information later if there are any problems.” (This is an example of when it is essential to ask your organization’s legal counsel whether monitoring what sites they go to is okay.)

Data Ingestion: Caution them about the ingestion of data. An example would be, “Be aware that AI tools with document or email access permissions may ingest, index, and learn from content you create, even if you delete it later, from documents you save, including spreadsheets and letters, and unsent emails. Even if you delete content later, the information may remain accessible through AI systems that have previously processed it. Never enter sensitive, confidential, or potentially problematic content into any document or email draft, even temporarily. If you use the previously common practice of typing emotion-filled documents while “venting,” even if you never intend to share the information, use handwritten methods rather than documents or email messages.”

Meeting Privacy: Be sure to address that online meetings are no longer completely private due to AI. Something like, “Know that meetings are no longer private spaces to have conversations. Content discussed in meetings may be captured in AI-generated transcripts, summaries, or recordings, making even previously casual conversations potentially discoverable in legal proceedings. Avoid discussing sensitive personnel matters, confidential information, or ‘off-the-record’ topics in meetings where AI transcription or summarization tools are active. With some commonly used operating systems and tools, this recording is always enabled and difficult to block.”

Summary Review: Give guidance on meeting summaries, such as “Disable automatically sending AI-generated meeting summaries to attendees. As the meeting organizer, you must review summaries to ensure accuracy before sending them. AI technology can be prone to hallucinations and errors in transcription, especially if the audio quality is less than optimal. People may use the summaries to make decisions, so the summaries must be accurate.”

Policy Updates: Document that you’ll be updating your policy regularly. You could include “Check this policy at least once a month or when we ask you to. We will update it as new tools, laws, risks, or AI-related situations arise.”

I’m not a lawyer, and this is not legal advice; check with your legal counsel. These are essential aspects that some organizations later wish they’d included after they experience a bad outcome. As you review this list, you may think of other aspects specific to your organization or industry that you want to include.

A solid AI policy is essential. Please forward this to your friends so they can help ensure they’ve included often overlooked parts, too.

The post The Executive’s AI Policy Checklist: Is Yours Missing These Essential Clauses? appeared first on Foster Institute.

What is DeepSeek AI?

They’re a company that has upended the concept that only massive companies with lots of money can, given enough time, create chatbots such as OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini), and Microsoft (Copilot). DeepSeek AI released a free chatbot in late January that consumers feel competes well against the big players. It does seem to excel in areas such as math and coding, although not all benchmarks agree. The revelation that DeepSeek AI achieved advanced AI capabilities with fewer and slower chips in less time shook the stock market.

While their technical achievements are remarkable, government agencies worldwide and many companies are restricting or banning using DeepSeek AI, citing privacy and security concerns.

No Privacy:

DeepSeek AI chatbot’s privacy policy states they can expose user-entered data to third parties, including information about the device you are using and your Internet address.

Interestingly, they announce they store information about how you type. Some organizations have suggested that keystroke patterns, when measured to precise timing, while not as accurate as fingerprints or facial scans, can help identify and track specific people.

One silver lining is that DeepSeek AI’s processing requirements are so light that some researchers have found ways to run DeepSeek AI’s entire large language model application offline and locally within a single user’s computer using tools such as LM Studio and Ollama. While complicated to set up, this potentially expands the possibility of eventually having your own personal assistant on your computer, which could help ensure privacy since it never sends information anywhere outside of your device.

“The Company You Keep” – The Biggest Concern

Most chatbots are designed to have guardrails to refuse to help humans do things out of alignment with ethics and morals. But adding and maintaining guardrails takes a lot of expertise, money, and time. Giving humans an all-knowing assistant without strong safety controls is dangerous.

Cisco used prompts from Cornell University’s popular HarmBench to test for safety, and they reported DeepSeek AI’s guardrails were consistently bypassed. Promptfoo states that their testing found the controls “brittle” and easy to break. There are “jailbreaks” to bypass many chatbots. This is more important now since less guarded chatbots are becoming easier to access and more popular.

We’ll see more chatbots with varying levels of safety controls; let’s consider the powerful implications these have for your business.

Nvidia CEO Jensen Huang emphasizes that AI is a tutor, mentor and coach at work. The key point he’s not mentioning: AI programming must align with our highest ideals and have a moral compass.

Could you ever have an upset worker who asks their chatbot for ideas on how to access company secrets, install a virus, retaliate against an office bully, or make an explosive? Will their favorite chatbot naively become a coconspirator since it is programmed to be helpful?

Stuart Russell (world-renowned AI pioneer) describes the competition in advanced AI development as “a race towards the edge of a cliff.” Steven Adler (safety researcher at OpenAI) quit in November, explaining he was “pretty terrified” about how quickly AI is evolving without enough attention to safety. Geoffrey Hinton (referred to as the Godfather of AI) talks about his concern about our ability to keep AI aligned with humanity’s best interests and predicts there’s a 10% to 25% likelihood that AI will cause us to become extinct in the next 30 years. Notice that he didn’t say AI will kill us; it could be humans using an unbridled AI as a tool to help them know how to create a plague or something else.

How can you help protect individual and business safety at work? See the recommendations below, including increasing awareness about how each person must be vigilant to recognize and resist a program’s bad advice.

On the bright side, Anthropic (Claude) recently released a technology designed to stop jailbreaks in AI models that are already programmed for safety. They’ve issued a challenge for people to try to break the protections. But will all AI models invest money into safety?

Many experts believe it will take an AI disaster to wake up humanity. Recent tragic fires and crash disasters in the US have stirred people to take action to increase safety measures around cities and airports. Are we so oblivious that we need an AI catastrophe to wake everyone up to the importance of having AI safety measures?

Recommended Action Steps:

• Be sure your workers watch for unsafe recommendations and resist them, especially if the worker is upset and vents to AI.
• Clearly classify your data and identify what information should never be entered into AI systems.
• Inform your workers about the risks of sharing sensitive information with unguarded AI and any AI tool.
• Require user training and give quizzes to help ensure users understand your organization’s guidance.
• Provide additional education to your workers in highly targeted positions, such as your fellow executives, the legal team, R&D, and finance departments.
• Consider using technology that will restrict or block access to AI tools, especially AI tools with few privacy controls, such as unguarded AI.
• You might wait until you can run a local offline version of unguarded AI that won’t share information with third parties.
• Utilize Data Loss Prevention (DLP) tools and features designed to monitor what information users provide chatbots while on your network or company-issued devices, block users from sharing sensitive information, and send real-time alerts to their managers or the IT Team.
• Consult with your legal team about the risks and exposure of sensitive information.
• Update your organization’s AI usage policies with guidelines on what is not allowed. Have users sign off.
• Ask your third parties who generate or access sensitive information related to your organization if they use AI. Ensure your contracts address AI privacy concerns and have discussions with their executives about AI. You may find they’re oblivious to the risks or ignoring the dangers; your company cannot afford that exposure.
• Have an incident response plan for AI data leaks.
• Inquire with your insurance provider about AI-related coverage for reputation damage and lawsuits from releasing sensitive information.
• Have an AI privacy and security specialist perform an AI risk assessment at your organization.

Conclusion

DeepSeek AI has cemented a memorable milestone in AI history. What happens next, including the other AI tools that will come in its wake, will set the path for our future. As an executive, you have a powerful influence. New open-data and unguarded AI tools are rocking traditional concepts related to AI; make sure it doesn’t rock your company, too.

The post Executives – Know and Manage the Risks of DeepSeek AI and Unguarded AI Tools appeared first on Foster Institute.

1. Assemble Your AI Implementation Team

• Choose a person or team to lead AI implementation
• Include representatives from leadership, legal, and IT

2. Educate Your Team on AI Applications

• Watch the 7-minute educational video showcasing 23 Business Uses for Chatbots in 7 minutes
• Alternatively, schedule a “lunch and learn” webinar or workshop to explore practical AI uses

3. Collaborate and Brainstorm

• Discuss insights from the video/workshop
• Identify potential AI applications relevant to your business

4. Explore Multiple AI Tools

• Test various chatbots (e.g., Perplexity, Anthropic Claude, ChatGPT, Microsoft Copilot, Google Gemini)
• Consider paid plans, privacy of sensitive information, and the ability to create custom chatbots
• The setting to make the model better for everyone means your data will be less private

5. Review Industry-Specific AI Tools

• Investigate AI solutions tailored to your industry
• Consult a curated list of AI tools for practical options

6. Consult with Your IT Team

• Discuss potential added support requirements
• Address concerns about job complexity
• Develop strategies to integrate AI without overburdening your IT team

7. Engage Your Legal Counsel

• Address privacy concerns
• Review automatic ingestion vs. uploading of data for different AI tools
• Analyze privacy and security policies of prospective AI solutions
• Consider internal data access and permissions per user or department
• Evaluate potential implications for mergers and acquisitions
• Consider that data from recordings of meetings will be discoverable during the due diligence phase

8. Assess User Access Control

• Discuss with IT about controlling access to AI tools
• Implement measures to manage access to AI on company networks and devices

9. Establish an AI Ethics Framework

• Develop guidelines for ethical AI use within your organization
• Address issues like bias, fairness, and transparency

10. Create a Data Governance Strategy

• Establish protocols for data handling, storage, and access in AI systems
• Ensure compliance with relevant data protection regulations (e.g., GDPR, CCPA)

11. Implement Security Measures

• Work with IT to set up necessary security protocols for AI systems
• Consider encryption, access controls, and monitoring systems
• Utilize sensitivity labels and permissions to limit employee access by role, etc.
• Establish data retention time policies

12. Plan for Ongoing Monitoring and Evaluation

• Establish KPIs to measure the effectiveness and impact of AI implementation
• Set up regular review processes to assess and adjust AI usage

13. Develop a Crisis Management Plan

• Prepare for potential AI-related incidents or breaches
• Outline response procedures and communication strategies

14. Draft an AI Policy

• Based on input from IT and legal, create a comprehensive AI usage policy
• Define the scope and purpose of the AI policy
• List approved AI tools and outline acceptable use cases
• Establish guidelines for data handling and privacy compliance
• Specify required security measures for AI use
• Address ethical considerations like bias and fairness
• Clarify ownership of AI-generated content and intellectual property
• Outline required AI literacy training for employees
• Define monitoring procedures and consequences for policy violations
• Set criteria for selecting and evaluating AI vendors
• Provide a framework for responding to AI-related incidents
• Establish a schedule for reviewing and updating the policy

15. Conduct User Training

• Train employees on approved AI resources
• Educate staff about the new AI policy, including ethics and protecting sensitive information
• Encourage users to look at their daily tasks and see which tasks AI might streamline or improve in other ways

By following all these steps, you’ll be more prepared to deploy AI in your organization while addressing some essential security, legal, and operational concerns. Successful AI implementation is an ongoing process requiring continuous attention and adaptation. AI is here to stay; you want to be thoughtful sooner to avoid costly problems later.

The post AI Implementation Roadmap: The Executive’s Guide to Avoiding Million-Dollar Mistakes appeared first on Foster Institute.

Key things You Need to Know:

Data collection: Search engines, many websites, apps, and chatbots might record your name, IP address, location, prompts, websites you visit, apps you use, search terms, content downloads, social media activity, and more. Marketing companies call this intent data that provides insight into your interests, needs, and purchase intentions.

Data sharing: As with apps and websites, when users input information into AI tools, it is unclear how it will be used. Privacy policies usually express the right to share information with unidentified third parties. You have no control over how third parties will secure or share your information.

Security breaches: Hacking attacks and inadvertent disclosure of sensitive information could lead to personal details being unwittingly spilled. To minimize the risks, chatbots should forget information or store it anonymously.

Lack of transparency: A big problem is determining the exact data stored and the security risk presented by the chatbots. Their privacy policies are in flux, so read them carefully.

Some chatbots provide the option not to store your prompts and conversations nor use them to train their models. For example https://help.openai.com/en/articles/7730893-data-controls-faq explains Data Controls for ChatGPT.

Protect Your Privacy when using Chatbots:

Provide the minimum necessary information for the chatbot to give you what you need.

Avoid entering sensitive information such as personally identifiable information (PII) such as full names, addresses, birth dates, and usernames.

Substitute fictitious names for people and companies you want to keep private. For instance, if you’re crafting a document for “Company and Sons,” tell the chatbot it’s for the “ACME” company. Once you’ve finished with the chatbot and have your document ready, use your word processor to search for “ACME” and replace it with “Company and Sons.”

The Evolution of Digital Trust:

Many websites and apps gather similar data and raise the same concerns. Most people realize that most search engines capture details for marketing and to provide better search results.

Individuals and companies alike expect file storage services, such as OneDrive® and Dropbox®, to keep the content of files private. Some AI tools like Cody®, Pragma®, and Microsoft Copilot® advertise their intent to keep your private data private.

Privacy for free AI tools may end up somewhere between search engines and file storage services. However, AI tools expecting businesses to adopt them must guarantee total privacy before organizations will trust them with sensitive information.

Conclusion:

Keep privacy in mind as you use the fantastic new AI tools, many of which can save you a tremendous amount of time and allow you to streamline operations and serve your customers better than ever! If you don’t adopt AI, and your competitors do, you’ll find yourself behind and struggling to catch up.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

(Image source: Bing. Learn more at [Bing.com].)

The post Chatbots: Helpful Friends or Privacy Foes? How to Safeguard Your Information appeared first on Foster Institute.