AI security

AI tools such as ChatGPT, Copilot and Claude are used in most businesses today, often without management knowing exactly where and for what. That creates new risks that ordinary IT security does not cover. Here we explain the most important ones, what the rules require, and what we can help you with.

Want to know where your biggest risk is? Write to us, and we'll take a 20-minute conversation →

What can go wrong?

The most common problem is confidential information leaving the business. When an employee pastes a customer contract, a payroll list or a patient record into a free AI service, the information then sits with the provider. Depending on the service's terms, it may be stored, read by the provider's staff or used to train new models. That can be a breach of GDPR. It rarely happens out of malice, but because nobody has told employees what they are allowed to do.

Many employees also use AI tools the company has not chosen, on their private accounts. This is called shadow AI. Management cannot protect data in tools it does not know are being used.

When AI is built into the company's own systems, a new kind of attack arrives. A language model follows instructions written in plain language, and it cannot tell the difference between your instructions and instructions hidden in the text it reads. If the solution reads incoming emails or websites, an outsider can hide a message in the text, for example telling it to forward confidential files. This is called prompt injection. A firewall or a password does not stop it, because the attack comes in through exactly the content the solution is meant to read.

Finally, a language model can write something wrong with great confidence. That is rarely a problem when an employee reads the answer through. It becomes a problem when the answer goes straight to a customer or sets an action in motion without anyone having looked at it.

The risk is greatest when the same solution has access to your confidential data, reads content from outside and can send something out of the building on its own. An AI assistant that reads customers' emails, looks things up in your customer system and replies by itself does all three. Such solutions can be made secure, but it has to be thought through before they are built.

What do the rules say?

GDPR also applies when information is processed by an AI. You need to know where information about people ends up, have a lawful basis for using it, and have a data processing agreement with the provider that processes it on your behalf.

The EU AI Act divides the use of AI by how much harm it can do. It is the purpose that determines the requirements, not which tool you use. Most of what businesses use AI for, such as writing texts, summarising documents or searching their own files, has no special requirements. A chatbot on the website must tell customers they are talking to a machine. If you use AI to sort job applicants, assess creditworthiness, or in health and education, it counts as high risk, and then you must be able to document your data, your risk assessment, a log of the use, and that a human is in control. Some uses are banned outright, such as scoring people for their behaviour.

What we help with

We write a short AI policy together with you. It fits on one page and says what AI may be used for, what information must never be put into it, and who to ask when in doubt. A one-page policy gets read. A twenty-page one does not.

We sort your information into groups, such as public, internal and confidential, and make a list of which AI tools are approved for which groups. That way the individual employee does not have to judge whether it is all right to put a contract into a chatbot.

We review an AI solution before it goes into production. Where does its data come from, what can it do on its own, and what happens if someone tries to trick it? The solution should only have access to what it needs, and a human must approve actions that cannot be undone, such as sending an email to a customer or deleting data.

We sort your use of AI by the AI Act's risk levels, so you know where there are requirements and where there are not. For most businesses that comes as a relief.

We sell neither security software nor AI tools, so our recommendations do not depend on what we can deliver ourselves.

How to get started

  • AI Starter Kit, €10,000. A workshop and a review of your business, where we also look at data and rules, ending with a prioritised list of what you should do.
  • Ongoing AI support, from €2,000 per month. A fixed number of hours each month for questions, assessing new tools and reviewing solutions before they are put to use.
  • AI: Essential for the board (in Danish). A three-hour course that equips the board to ask the right questions about AI and risk.

All prices exclude VAT. If you need a review of a specific solution or an AI policy, write to us and we'll give you a price.

Read more (in Danish)

Contact us

Tell us briefly how you use AI today, or what you are considering. We'll take a conversation of about 20 minutes and tell you honestly where we see the biggest risks.

Write to us