88% of small business owners already use AI tools, while 54% use them without formal guidelines or policies. As more businesses connect AI to CRM systems, shared files, email, c, and financial systems, those tools also gain access to business information.
Businesses need to review that access before employees connect tools such as ChatGPT, Claude, or Gemini to company systems. A CRM connection, for example, could expose customer records, while a shared-drive connection could give an AI platform access to internal or confidential files.
For businesses in Manhattan and across New York City, the same questions apply: What can the AI access? Who can use it? What happens to the data? How is that access monitored? These questions form the foundation of AI data security.
This guide covers the data, access, vendor, security, and compliance controls to review before connecting AI to company systems.
AI Data Security Checklist for BusinessesUse this checklist to review the controls before connecting an AI platform to company systems:
|
Before you review technical permissions, define what the AI is there to do. This gives you a basis for deciding what it needs access to and where you need human supervision :
Set the Business Purpose: Document the specific task or problem the AI will support. Be clear about how employees will use it, such as drafting content, summarizing documents, analyzing data, or assisting with customer support.
Define the Workflow: Identify where the AI enters the process and what happens before and after its involvement. This helps clarify which systems, information, and employees are involved.
Set Its Level of Authority: Decide whether the AI should only generate information or have permission to create, edit, send, approve, or delete information in connected systems. Give it only the level of authority the workflow requires.
Set Boundaries for Sensitive Work: Identify workflows that involve sensitive business functions or decisions and determine where additional approval is required. This is particularly important when AI handles financial, employee, customer, or other restricted information.
Set Human Review Points: Decide where an employee must review or approve AI output before it reaches a customer or changes a business record. Also clarify who is responsible for that review.
Account for Existing AI Use: Check for consumer AI accounts, browser extensions, and other tools employees already use for work. Include these tools in the review so your AI data security requirements account for AI use across the business.
Your business should first classify the information the AI will handle, then define what employees may enter, upload, or retrieve. Limit access to the information required for the approved purpose. or retrieve.
Use a practical classification system based on data sensitivity:
Public: Information already available outside the company, such as website content, published pricing, or public marketing materials.
Internal: Business information intended for employees, such as internal communications, draft documents, meeting notes, or operating procedures.
Confidential: Information that could harm the business or customers if exposed, such as financial records, employee information, customer data, intellectual property, or proprietary documents.
Restricted or Regulated: Information subject to legal, regulatory, or contractual requirements, such as protected health information, payment card data, or regulated personal information.
Specify what employees may enter into AI prompts.
Define which files they may upload.
Identify which records the AI may retrieve from connected applications.
List information that must never enter the AI platform.
Apply least-data access based on the approved workflow.
Document the specific data sources each AI platform is approved to access. For example, an AI tool used to draft internal documents may need access to a specific document repository, while a CRM-connected workflow may require access to selected customer records.
Before approving an AI platform, review how the vendor handles business information and what protections the selected plan provides. Focus on data use, retention, security, and contractual terms.
Check whether the vendor uses prompts, files, or outputs to train models.
Review available data-use and model-training settings.
Check whether these practices differ across consumer, business, and enterprise plans.
Check how long the vendor retains prompts, files, outputs, and account information.
Review deletion options and timelines.
Identify where the vendor stores and processes data.
Review the vendor’s subprocessors and their roles.
Check relevant security certifications and attestations.
Review incident notification requirements.
Review available DPA, BAA, and other contractual terms.
Check customer or industry-specific restrictions on data processing.
Confirm that the selected plan provides the security and administrative controls your business requires.
Record the approved plan, important data-handling terms, security requirements, and contractual terms before connecting the platform to company systems.
If the vendor does not provide enough information to assess its data-handling practices or security controls, pause the connection until you resolve the outstanding questions.
Set access according to each user’s role and the approved AI workflow. These AI access controls should limit both user permissions and the actions available through connected systems.
Review each AI integration before granting access, including connections to:
Microsoft 365 and Google Workspace
CRM platforms
Internal business applications
APIs and OAuth connections
Service accounts
Browser extensions and third-party connectors
For each connection, determine whether the AI can read, create, edit, or delete information. Grant only the permissions required for the approved workflow.
|
Do Not Approve Every Available Connector: Not all of an AI platform’s available integrations need to be enabled. Approve connections based on the business purpose, data involved, and actions permitted. |
Once access is in place, put controls around how the AI and its users handle company information. Controls should restrict sensitive data, record activity, and flag unusual behavior.
Configure DLP controls to identify and restrict sensitive information.
Block or limit prohibited data from entering AI platforms where supported.
Use endpoint and browser controls to restrict unsanctioned AI activity where appropriate.
Enable AI activity logging where available.
Review authentication and account activity.
Monitor activity across connected applications and integrations.
Set alerts for unusual, unauthorized, or potentially risky activity.
Assign responsibility for reviewing logs and alerts.
Investigate unusual AI activity or security events.
Retain relevant logs and evidence for investigation where required.
DLP controls restrict sensitive data. Logging records activity. Monitoring and alerts help your team identify activity that requires investigation.
After reviewing the vendor, identify the regulatory, contractual, and internal requirements that apply to your business, data, and AI workflow.
Review regulations that apply to the data involved.
Consider HIPAA when the workflow involves protected health information.
Review PCI DSS when the workflow involves cardholder data.
Consider GDPR or CPRA when applicable to the personal information being processed.
Check industry-specific requirements that apply to your business or customers.
Check customer contracts for restrictions on third-party data processing.
Review existing security and data-handling policies.
Check cyber insurance requirements related to AI use and security controls.
Determine which agreements, such as a BAA or DPA, your business needs based on the data, workflow, and applicable requirements.
A secure AI platform does not automatically make a business compliant. Compliance depends on the data involved, how the business uses the AI, applicable obligations, and the controls in place for AI data security.
Several safeguards should be in place before an AI platform moves into production, including controlled testing, employee guidance, and an incident-response process.
Start with a limited user group and controlled data:
Test User Permissions: Confirm that each user receives only the access required for the approved workflow.
Test Application Connections: Verify that each connector provides only the permissions required.
Test DLP Controls: Confirm that sensitive or prohibited information is restricted as intended.
Validate Logging: Check that required AI, authentication, and integration activity appears in the relevant logs.
Review AI Outputs: Check outputs for accuracy and identify actions that require human review.
Test Human Approval: Confirm that required review takes place before AI output reaches customers or changes business records.
Test Access Revocation: Remove a test user’s access and confirm that the change applies to the AI platform and connected applications.
Document Issues: Record problems found during testing and resolve them before wider deployment.
Employees need clear rules for using approved AI tools and handling company information.
Approved AI Use: Explain which AI tools and business use cases employees are permitted to use.
Prohibited Data: Specify what information employees must not enter into prompts or upload.
Safe Prompt & File Handling: Explain how employees should handle business information when using AI.
Personal Accounts: Prohibit personal AI accounts for company work where business accounts are required.
Connected Applications: Explain the risks of giving AI access to business applications and files.
Reporting Procedures: Explain how to report accidental disclosures, unauthorized access, or other AI-related security incidents.
Define the response process before deployment so your team knows what to do if an AI-related security issue occurs.
The process should address:
Accidental data disclosure
Unauthorized access
Compromised AI accounts
Unsafe connectors or integrations
Vendor security incidents
Unexpected AI actions
The response plan should define containment, access revocation, evidence and log preservation, escalation, notification, and post-incident review.
These steps help protect AI data security if an incident affects company information or connected systems.
A Managed Service Provider (MSP) provides the technical expertise to assess, configure, and manage the controls surrounding AI adoption. Its role continues after deployment as users, permissions, applications, and security requirements change.
Assess AI Readiness: Review the existing IT environment, AI tools, accounts, integrations, and security controls to identify technical gaps before deployment.
Configure AI Security Controls: Set up authentication, MFA, permissions, endpoint, cloud, monitoring, and other security controls required for the approved AI environment.
Manage AI Integrations: Support the IT infrastructure, cloud environments, and application connections that support AI workflows, including technical configuration changes as systems evolve.
Support Compliance Requirements: Help implement technical controls that support applicable regulatory, contractual, insurance, and internal requirements. The business remains responsible for determining which legal and contractual obligations apply.
Provide Ongoing Monitoring: Monitor security events, access, configurations, and the wider IT environment after deployment, with regular reviews as users, systems, and AI tools change. Regular reviews help maintain AI data security as users, systems, and AI tools change.
Support AI-Related Incidents: Help respond to unauthorized activity or security incidents involving AI-connected accounts, applications, or systems through containment, remediation, log review, and escalation.
If your internal team needs additional support managing these requirements, an MSP can provide ongoing technical oversight across your IT environment.
iTeam Technology’s IT consulting services help businesses assess their IT environment, address technical gaps, strengthen security controls, and manage ongoing IT requirements.
A secure AI implementation requires ongoing review as your tools, users, integrations, and data access change. The controls you put in place before deployment should continue through access reviews, security monitoring, and regular updates.
iTeam Technology helps businesses in Manhattan and across New York City assess AI readiness, configure identity and access controls, secure cloud and application integrations, and support ongoing IT and cybersecurity management.
Request an AI Data Security Assessment
Review the AI platform’s approved use case, data access, vendor policies, user permissions, application connections, security controls, and compliance requirements. A business should also test the setup with a limited group before connecting the platform to production systems or sensitive information. An AI readiness assessment helps identify gaps in these areas before deployment.
Start with data classification and define what employees may enter into prompts, upload as files, or retrieve through connected applications. Apply least-privilege access, DLP controls, user permissions, and activity monitoring. Employees should also know which information they must never submit to an AI platform. These measures form an important part of AI data security.
AI access controls determine who can use an AI platform, what permissions each user receives, and which business applications the platform can reach. SSO, MFA, role-based permissions, least privilege, account provisioning, and regular access reviews help limit unnecessary access.
Review the vendor’s data-use and model-training policies, retention periods, deletion options, storage locations, subprocessors, security certifications, incident notification terms, and available contractual agreements. Also confirm that the selected plan provides the administrative and security controls your business requires. This review forms an important part of a secure AI implementation.
No. AI compliance depends on the data involved, how the business uses the platform, applicable regulations, customer contracts, internal policies, and the controls the business has in place. A secure vendor platform supports compliance efforts, but it does not determine whether the business meets its legal or contractual obligations.