Data Privacy and AI at Work

The question facing an IT or compliance lead is not whether to allow AI. It is what to do about the use that is already happening.

Why blocking alone tends to fail

Blocking the tools removes the visible symptom. The underlying reason people used them, a slow route to information they need, is untouched. The usual result is that the behaviour moves to personal devices and personal accounts, where there is no oversight at all.

Policy helps only when there is a workable alternative. Otherwise it asks staff to be slower at their jobs, and most will quietly decline.

What actually happens to a document in an AI tool

It is worth being precise, because vague reassurance from vendors is common. Broadly there are three arrangements.

• Consumer tools. Content is sent to the provider. Depending on the account type and settings, it may be retained and may be used to improve their models. Control sits with the provider, not with you.
• Business tools with contractual terms. Content is still processed by the provider, but under an agreement covering retention, training and sub-processors. Control depends on what the agreement actually says.
• Deployment inside your own infrastructure. Processing happens within an environment you control. This offers the strongest position and usually costs more to run.

Eveia.AI is offered as a managed service and, for organizations with stricter requirements, deployed within your own infrastructure. On the managed service, selected content is processed by an approved model provider. We say that plainly because a vendor who implies otherwise is either being careless or hoping you do not ask.

Questions worth asking any AI vendor

Ask these directly, and ask for the answers in writing rather than in a conversation.

• Is our content used to train your underlying models, and can that be turned off?
• Where is content processed, and which sub-processors are involved?
• What is retained after a request is answered, for how long, and how is deletion handled?
• Does the tool respect the access permissions we already have in place?
• Is there a log showing who asked what and when?
• Can it be deployed inside our own environment if we require that?
• Are these commitments in a signed agreement, or only on a webpage?

A vendor who answers these clearly is easy to assess. One who does not has told you something useful.

What a governed alternative looks like

The practical goal is to make the safe route the fast route.

Eveia.AI lets authorized staff ask questions across the documents your organization has approved and connected, and get source-supported answers with a link back to the document behind them. Access follows role, so people see only what they are entitled to. Because the answer arrives faster than searching manually, staff have a reason to use it rather than work around it.

It is assistive. A person still checks the source and decides.

On compliance

No tool makes an organization compliant with a data protection law. Compliance depends on your deployment, the data you place in the system, your agreements, and your policies. In the Philippines this sits under the Data Privacy Act, and questions about a specific use should go to your data protection officer, your legal counsel, or where appropriate the National Privacy Commission. In other jurisdictions the equivalent regulator applies. What a tool can do is support your controls, not replace them.

A first step that costs nothing

Before evaluating anything, find out what is already happening. Ask a few teams, without blame, how they currently get answers out of long internal documents. The answers usually reveal both the real problem and the exposure, and they make the case for a solution better than any vendor material.