Last updated: 9 November 2026
Before your business adopts or expands any AI tool, decide which tools are allowed, check who can see what in Microsoft 365, set simple rules for staff, and name an owner. This notice is advisory guidance from ABCOM, not legal advice.
AI tools such as Microsoft Copilot, ChatGPT, Claude and Gemini can save real time. They can also reach your files, email and chats, and pass what they find to a third party. This notice sets out the main risks and what we suggest you have in place first. Everything here is a suggestion to help you decide. The decisions stay with you.
The five risks that matter
Data leaving the business
Staff paste customer details, contracts or pricing into a tool. If you would not email it to a stranger, do not paste it into a prompt.
Access wider than anyone realised
A connected tool can see whatever the person connecting it can see. Tidy old SharePoint, Teams and mailbox permissions first.
Wrong answers that sound right
Treat output as a first draft from a new starter and check it before relying on it.
Rules you still have to follow
UK GDPR, sector rules, insurance terms and customer contracts still apply to AI use.
Tools nobody approved
Free accounts, browser add-ons and meeting recorders appear without a decision. This is often the biggest risk.
How to judge a request
| Band | Examples | What we suggest |
|---|---|---|
| Lower risk | Drafting emails, summarising non-sensitive notes, working with public information | Go ahead with a short staff rule |
| Needs review | Connecting AI to Microsoft 365, email or SharePoint; internal policies; financial data; third-party AI apps | Review permissions and approve in writing first |
| Formal review | Health or children’s data, customer databases, regulated or privileged information | Complete an impact assessment and take advice |
This is a starting point for your own decision, not a decision made for you.
Before you switch anything on
- A business-grade plan, not a free personal account
- Written approval from a director
- Permissions reviewed on the SharePoint, OneDrive and mailboxes the tool will touch
- A staff rule on what may and may not go into the tool
- A named person inside the business who owns it
- Confirmation from your insurer or broker that the tool does not affect your cover
Where ABCOM can help
Decisions for you: whether and how to use AI, what data it can reach, how it fits with data protection and sector rules, how to check output, and whether you need an impact assessment.
What we can advise on: the options and how they compare, setting up tools you have decided to use, and technical controls such as multi-factor authentication, access limits and data-loss rules.
For legal, regulatory or data protection questions, speak to a qualified adviser. We can explain the technical side, but we do not give legal advice.
If something goes wrong
If you suspect an incident involving an AI tool, we suggest you stop using it, change any affected passwords, and tell us straight away so we can help you look into it. Decide with your own adviser whether it needs reporting to the ICO or to affected people.
Quick answers
Is this notice legal advice?
No. It is practical, advisory guidance from ABCOM. For legal, regulatory or data protection questions, speak to a qualified adviser.
Does it approve any AI tool?
No. Each tool or connection is a separate decision for your business.
Can I print it or save it as a PDF?
Yes. Use your browser’s Print command and choose “Save as PDF”.
Want help applying this in your business? Call ABCOM IT Solutions on 01444 871200 or book a free 20-minute call.
Related answers and guides
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.