Risks and best practices of using generative AI in the corporate environment

Why the risk is real

An IBM report on the cost of data breaches in 2025 found that incidents related to the unauthorized use of AI occurred in around 20% of cases analyzed, increasing the average cost by approximately $670,000. Shadow AI refers to the use of AI tools not approved by an organization, such as personal chatbot accounts.

The study also found that most companies that experienced such incidents lacked adequate access controls for these tools.

What not to share

Customer data

Information such as names, social security numbers, emails, purchase history, and service records is protected by the General Data Protection Law (LGPD). Sending a CRM spreadsheet to a chatbot for profile analysis, for example, could constitute improper sharing.

Contracts and internal documents

Contracts often include confidentiality clauses. Sending draft agreements, meeting minutes, strategic plans, or unpublished communications could violate these obligations, as public tools do not always guarantee the same level of confidentiality.

Financial information

Unpublished financial statements, projections, proposal values, and merger and acquisition data are sensitive information. In publicly traded companies, some of this data may be considered insider information, and its disclosure can result in legal consequences.

Proprietary code

Code snippets, system architectures, and especially API keys and passwords should not be entered into chatbots. A developer who sends an entire module to request an error correction may expose the company’s intellectual property and security vulnerabilities.

How to use AI more safely

The first step is to consult the company’s internal AI policy, if one exists. Corporate versions of AI tools typically include contracts that prevent the use of data for training, which is generally not the case with free and personal accounts.

Another recommendation is to anonymize information before sending it: replace names with codes, remove values, and use fictional data in examples. It is also possible to disable conversation history and review each platform’s privacy settings.

It is important to remember that the LGPD provides for sanctions imposed by the National Data Protection Authority (ANPD), which can reach up to 2% of revenue, limited to 50 million reais per violation. As a result, many companies have established rules, training programs, and approved tools for daily AI use.