Somebody in your office has already pasted a client email, a patient note or a spreadsheet into an AI chatbot to get a quick summary. They weren't being careless. The tool was right there and it saved them twenty minutes. But that data may now sit with a service you never approved, under terms you never read. This is shadow AI, and it's one of the fastest-growing ways sensitive information leaves a business.
What the project includes
- AI usage visibility. Finding out which AI tools are actually in use across your organization, using Microsoft Purview's AI reporting (Data Security Posture Management for AI) and the security tools you already have.
- AI acceptable use policy. A clear, short policy on approved tools, what data can and can't go into them, and when AI output needs a human check.
- Approved alternatives. Giving staff a sanctioned option, such as Microsoft Copilot Chat with your organization's data protections, so they don't need to go around the rules.
- Purview protections. Policies that detect and limit sensitive information going into AI apps, and that keep labeled content out of Copilot responses. For blocking sensitive data across email and files generally, see our Purview data loss prevention project.
- Access controls. Unapproved AI apps blocked or restricted where your policy calls for it.
- Staff training. Short, practical training on using AI safely, delivered through our security awareness training.
Why it matters for regulated businesses
A healthcare practice that puts patient information into an unapproved AI tool may have shared protected health information with a vendor that never signed a business associate agreement. A financial or legal firm risks client confidentiality the same way. The fix isn't banning AI. It's giving people a safe way to use it and making the unsafe way harder.
How the work runs
- Discovery. We review which AI tools are in use and what kinds of data are involved.
- Policy. We draft the AI acceptable use policy with you, in plain language.
- Controls. Purview protections and access controls are set up and tested.
- Training. Staff learn what's approved, what isn't and why.
- Review. Reports are checked after rollout and the controls adjusted.
What you get at the end
- A picture of AI use across your organization.
- A written AI acceptable use policy.
- Protections that reduce sensitive data reaching unapproved AI tools.
- Trained staff who know the safe way to use AI.
Staying ahead of it
New AI tools appear every month. Our security awareness training keeps staff current, and an AI readiness assessment is the place to start if you're also planning a Copilot rollout. Mash IT is based in Lexington, Kentucky, and works with businesses across Central Kentucky.
Common questions
AI tools staff use without the organization's approval, often free consumer chatbots. The risk is sensitive data being shared with services you haven't vetted.
Blocking alone usually pushes people to personal devices. A better approach is an approved tool, a clear policy and controls that catch the risky cases.
When staff sign in with their work account, Copilot Chat runs under your organization's data protections, and Microsoft states prompts and responses aren't used to train its foundation models. That makes it a reasonable approved option for many businesses.
It supports it. Keeping patient information out of unapproved AI tools is part of protecting PHI. Your organization still owns its compliance program.