In summary
- AI has already entered your company, with or without permission: 45% of the workers use it regularly on company equipment and 67% access it with personal accounts (Verizon, 2026).
- The two real risks: customer data being pasted into free tools and Copilot showing files that were already poorly shared in SharePoint and OneDrive.
- Five rules fit on a page and solve most of the problem. The most important one: set permissions before you start using Copilot.
- The AI Act already requires: from February 2, 2025, anyone who uses AI in the company must promote the AI literacy of their staff (article 4).
In this article
- AI is already being used. The question is how.
- Risk 1: customer data in free tools
- Risk 2: The Copilot sees what their permissions allow them to see
- The 5 rules on one page
- AI Act in simple language: what already applies
- A real case: 200 positions in three offices, the same rules
- What to do this week
- Frequently Asked Questions
- AI rules and permissions revised in 10 working days
AI in the company Without rules, there is no innovation — it is a data leak waiting to happen. The short answer: before generalizing ChatGPT or turning on Copilot, define which tools are approved, which data never gets there, and who can see what in Microsoft 365. These are management decisions, not computer science ones, and they are made in a meeting.
AI is already being used. The question is how.
Verizon’s 2026 data breach report measured what happens on companies“ computers: 45% of the workers are already regular users of AI on company equipment (compared to 15% the year before), and 67% access these services with accounts that are not company-owned. The so-called ”shadow AI” — tools used without approval — is already the third most common non-malicious internal action in data breach records.
Banning it doesn't work. Without an approved tool and clear rules, people use their personal account and the company loses control over what goes out.
Risk 1: customer data in free tools
None of this is malicious: accounting pastes an extract to “summarize,” a sales rep pastes a customer’s email, HR requests help to rewrite a performance evaluation.
The problem lies in the terms of use. OpenAI, for example, indicates that in its services for private individuals it can use the content of conversations to train its models, unless the user disables this option. In the business plans and the API, the rule is the opposite: the content is not used for training by default. The difference between the two situations is that the company manages the business account.
Risk 2: The Copilot sees what their permissions allow them to see
Microsoft 365 Copilot does not “interfere” with anything. Microsoft itself explains that Copilot only shows data from the organization that each user already has, at least with read permission. That’s where the risk lies.
In the audits we carry out, it is common to find old shared files that no one has reviewed: the management folder shared with “Everyone,” a link “anyone in the organization” created three years ago for a payroll file, an old project SharePoint site open to everyone. To this day, no one noticed it. With Copilot, you just ask “what are the sales team’s salaries?” — and the answer comes, if the permissions allow it.
The right order: first review permissions in SharePoint, OneDrive, and Teams; then connect Copilot to a pilot group. It's configuration work. Microsoft 365 for business, Not a new purchase.
The 5 rules on one page
One A4 sheet for the entire team, signed by the management — not by the IT department.
| Rule | What it means in practice | Who guarantees |
|---|---|---|
| 1. Only approved tools, with company account | Short list of authorized tools. No personal accounts for work. | Administration + IT |
| 2. Data that never gets in | Personal data of customers and employees, health information, salaries, passwords, contracts and confidential proposals. | Each user |
| 3. Permits arranged before the Copilot | Reviewing shared files and open links in SharePoint, OneDrive, and Teams. Copilot first in a pilot group. | IT |
| 4. A human revises and signs | AI prepares; a person confirms numbers, names, and facts before sending them to a client. | Leadership |
| 5. Training and registration | A short session for everyone, with attendance records. It is the basis of the literacy requirement in AI. | Human Resources |
These rules naturally fit into internal cybersecurity policies that any company with more than 10 people should have it in writing.
Checklist before turning on Copilot
- Multi-factor authentication is active on all accounts.
- Accounts of former employees removed and licenses recovered.
- “Anyone” sharing links has been reviewed and, where possible, disabled.
- Management folders, human resources and finance with restricted access to those who need it.
- Defined pilot group (5 to 10 people) and deadline for evaluating results.
AI Act in simple language: what already applies
The European Regulation on Artificial Intelligence (Regulation (EU) 2024/1689) is in effect since August 1, 2024 and applies in phases. For a SME that uses ChatGPT or Copilot, the essential is this:
- Since February 2, 2025 The prohibited practices apply and Article 4, on literacy in AI: companies that use AI systems must take measures to ensure that their staff have sufficient knowledge to use them judiciously.
- In July 2026, Regulation (EU) 2026/1744 — the so-called “Omnibus Digital” on AI — postponed the rules for high-risk systems: December 2, 2027 for autonomous systems and August 2, 2028 for those integrated into products. The literacy requirement remained in place.
- “High risk” covers uses such as recruitment, biometrics or critical infrastructure — if you use AI to screen candidates, talk to your lawyer.
DataRoad does not provide legal advice: we implement the technical measures — accounts, permissions, records — and help prepare the training.
A real case: 200 positions in three offices, the same rules
A Velv by OnRising, a software development company with offices in Porto, Lisbon and Rio de Janeiro, has about 200 IT Unlimited contract jobs with DataRoad. International clients account for 45% of the portfolio, and the contract includes the management of the firewall, network security and protection policies.
In such a company, the question “which customer data can go to an AI tool?” is not theoretical — and the answer has to be the same in all three offices. AI rules are not a separate project: they are part of the policies that already protect the company and are applied by the same team that manages accounts, permissions, and equipment.
What to do this week
Ask the team what AI tools they use, choose an official tool with a business account, and request a permission review before any Copilot pilot. If multi-factor authentication isn't already resolved, start there: it's the first step. Zero Trust for SMEs and protects it with or without AI. AI is also on the side of the attacker: it’s worth it Train teams to detect phishing and deepfakes.
Frequently Asked Questions
Should I ban ChatGPT in the company?
Banning without an alternative pushes people into personal accounts, where the company has no control. It is safer to approve a tool with a business account and set that data never gets there.
Can the Copilot show a collaborator files that he should not see?
The Copilot only shows what that person is already allowed to see. If the permissions are misconfigured — shared folders with everyone, old open links — the Copilot makes this error visible. Therefore, the permissions are reviewed before activating it.
Does the literacy requirement in AI apply to a SME?
Yes. Article 4 of the AI Act applies from February 2, 2025 to anyone who uses AI systems in their professional activity, regardless of the size of the organization. A short training, written rules, and attendance records are a good starting point; for legal reading, consult your lawyer.
Do I need new licenses to use AI safely?
Not necessarily. Much of the work is configuring what the company already has: multi-factor authentication, review of permissions, and enterprise accounts in approved tools. The Copilot licenses only make sense after this foundation is in place.
AI rules and permissions revised in 10 working days
We review your Microsoft 365 sharing settings, show you what the Copilot would make visible, and deliver the ready-to-sign rules page. For businesses with more than 10 seats · support contract · remote and on-site support. Security is included in the plans IT Unlimited Premium, with managed cybersecurity from tip to toe.
AI rules ready in 10 working days
Microsoft 365 permissions, reviews, and AI policy on one page.
Sources
- Verizon — 2026 Data Breach Investigations Report, Executive Summary
- Microsoft Learn — Data, privacy, and security of Microsoft 365 Copilot
- OpenAI — How your data is used to improve model performance
- EUR-Lex — Regulation (EU) 2024/1689 (Regulation on Artificial Intelligence)
- EUR-Lex — Regulation (EU) 2026/1744 (Omnibus Digital on AI)
- European Commission — Agreement to simplify AI rules (new deadlines for high risk)
![mun[it] logo, a digital marketing agency — a DataRoad client](https://www.dataroad.pt/wp-content/uploads/2026/09/logo-cliente-munit.png){kind=logo}
