A few weeks ago, a student asked me if she could use ChatGPT to summarise a client pitch deck.
She works for a mid-sized consultancy in Lisbon. Smart woman, good instincts, trying to work efficiently.
I asked her: “Does your company have an AI policy?”
She laughed. “We have an AI ban.” 😂
Then she leaned in and whispered: “But everyone uses it anyway.” 🤫
This conversation happens at least once per class.
The location changes (Barcelona, Bangkok, Lisbon), but the pattern remains identical. Companies either lock AI down completely or pretend the security risks don’t exist.
Both approaches are disasters.
After three decades in digital marketing (ufff, that’s old) and now teaching AI implementation across multiple universities, I’ve watched businesses make the same mistake repeatedly. They treat AI cybersecurity as a binary choice: paranoia or negligence.
The reality?
Most organisations are sitting on a ticking bomb, and they don’t even know which wire to cut.
The Numbers Don’t Lie (But They’ll Terrify You)
Let me share something that should make every business owner sit up straight.
IBM’s 2025 Cost of Data Breach Report just dropped, and the findings are brutal. The global average cost of a data breach hit $4.44 million. In the United States, that figure jumped to $10.22 million.
But here’s where it gets interesting for those of us using AI tools.
97% of organisations that experienced AI-related security incidents lacked proper access controls. Not 70%. Not 80%. Ninety-seven per cent. 🤯
And 63% of organisations have no AI governance policies whatsoever. They’re flying blind, hoping for the best whilst their employees paste proprietary client data into ChatGPT to “save time.”
The data gets worse. Organisations dealing with “shadow AI” (those unauthorised AI tools your employees are definitely using behind your back) paid an average of $670,000 extra in breach costs.
That student I mentioned? She’s not an outlier. She’s the norm.
The Two Extremes (And Why Both Are Rubbish)
In my workshops and also when we work with clients, I encounter two types of organisations.
Type One: The Paranoid
These companies ban everything. No ChatGPT, no Claude, no Gemini. They block AI tools at the network level and send stern emails about “unauthorised software.”
Their employees nod politely in meetings, then pull out their personal phones and use AI anyway.
What does that mean? The company loses visibility into what data is being processed, where it’s going, and who’s accessing it. They’ve created the exact security nightmare they feared, just with zero oversight.
Type Two: The Naive
These organisations embrace AI with open arms and closed eyes. “Innovation! Efficiency! Future of work!”
No policies, no training, no controls. Employees paste customer PII, financial data, proprietary algorithms, and confidential strategies into public AI platforms.
Last year, Samsung engineers accidentally leaked proprietary source code into ChatGPT while debugging. Apple restricted internal AI use after similar concerns. Amazon discovered employee inputs that looked suspiciously like internal data appearing in AI outputs.
These weren’t small startups.
These were massive, sophisticated organisations with entire security departments.
If it can happen to them, it’s already happening to you.
What the EU AI Act Actually Means for Your Business
Whilst companies dither between paranoia and negligence, European regulators have made their position clear.
The EU AI Act isn’t a suggestion. It’s the law, and the compliance clock is ticking.
Here’s what you need to know:
February 2, 2025: Prohibited AI practices are now banned. AI literacy requirements for employees are mandatory. This isn’t future tense, believe me, it’s active right now.
August 2, 2025: General-purpose AI obligations kick in. Governance rules activate. If you’re using AI systems, you need policies in place.
August 2, 2026: Full compliance required for high-risk AI systems. This includes many customer-facing applications, HR systems, and automated decision-making tools.
The penalties? Up to €35 million or 7% of global turnover, whichever is higher, for prohibited practices.
For data governance violations, you’re looking at €20 million or 4% of global turnover.
We’re not talking about theoretical fines. European regulators are setting up enforcement infrastructure as I write this. The Member States are designating their national authorities.
But here’s what frustrates me about the compliance conversation: most organisations are so focused on avoiding fines that they miss the actual point.
The AI Act isn’t just about punishment, as you might think. It’s a blueprint for avoiding preventable security incidents that could destroy your business. Get it?!
GDPR Didn’t Disappear (It Got More Complicated)
Whilst everyone obsesses about the AI Act, they forget that GDPR still applies. And AI makes compliance significantly harder.
The CNIL (French data protection enforcer) recently clarified: if your AI model is trained on personal data, GDPR applies to the entire pipeline. Training data, model outputs, prompts—all of it.
You need to be able to explain automated decisions (Article 22). You need data protection by design and by default (Article 25). You need legitimate interest or consent for processing.
Most LLMs fail at least two of these requirements out of the gate.
A referral passed me the contact of a marketing director who nearly had a breakdown when he realised his team had been feeding customer data into free AI tools for six months. No consent, no legitimate interest assessment, no idea where the data went or who could access it.
His company now faces a Data Protection Impact Assessment, potential regulatory investigation, and the delightful task of notifying thousands of customers that their information may have been compromised.
All because someone wanted to write email copy faster. 🤦♂️
The Real Threats on AI Cybersecurity (Beyond the Hype)
Let’s talk about what actually happens when AI cybersecurity fails.
Deepfake fraud has exploded. In Q1 2025 alone, 179 deepfake incidents were reported: that’s 19% more than the entire year of 2024. Not to mention the others that haven’t been reported.
Financial institutions are particularly vulnerable. 53% of financial professionals have experienced deepfake scam attempts. One Hong Kong firm lost $25 million in a single video conference where every participant except the employee was an AI-generated fake.
Think about your own video calls. Could you spot a deepfake of your CEO? Your CFO? Your largest client?
Most people can’t. Research shows only 0.1% of people can consistently identify deepfakes.
Phishing has evolved. Traditional phishing had about a 12% click-through rate. AI-generated phishing? 54% click-through rate.
The cost to launch these attacks dropped 95%.
The speed increased 40%. And they’re personalised to each target using scraped data and AI analysis.
Supply chain compromises are devastating. Third-party breaches cost an average of $4.91 million and take 267 days to identify and contain. These attacks exploit trusted vendor relationships… exactly the kind of access AI tools require.
When you connect ChatGPT Enterprise to your Google Drive, Salesforce, or SharePoint, you’re extending your attack surface. Every integration is a potential entry point.
What Actually Works (A Practical Framework)
Right. Enough doom. Let’s talk solutions. 😉
After implementing AI systems for agencies, SMEs, and multinational clients across three continents, I’ve developed a framework that balances security with productivity.
It’s not perfect, but it works.
Phase 1: Know What You’re Dealing With
Start with an AI inventory. Not next quarter: today.
Survey your organisation. What AI tools are people using?
I guarantee you’ll find at least three you didn’t know about.
Common culprits: ChatGPT (free version), Google Gemini, Grammarly, Otter.ai, various Chrome extensions, mobile apps, and that “productivity tool” someone installed because “everyone uses it.”
For each tool, document:
- Who’s using it?
- What data are they inputting?
- Whether it has proper enterprise-grade security.
- If it trains on user data (most free tools do).
It’s not optional. You can’t secure what you can’t see.
Phase 2: Classify Your Data
Not all information carries the same risk.
Public marketing copy? Low risk.
Client names and project details? Medium risk (medium risk doesn’t mean it’s ok, just to clarify this).
Financial data, PII, proprietary algorithms? High risk.
Create a simple classification system. I use three tiers:
Green (Public): Can be used in any AI tool.
Amber (Internal): Enterprise AI only, with proper controls.
Red (Confidential): Never enters AI systems, period.
Train your people on this system. Make it visual.
Put colour-coded labels on documents. Make it impossible to claim ignorance.
Phase 3: Choose Your Tools Wisely
Free AI tools are free for a reason.
You’re not the customer at this point; you’re the product.
For business use, invest in enterprise-grade solutions:
ChatGPT Enterprise/Business: Data isn’t used for training. You get a Data Processing Addendum (DPA) for GDPR compliance. Encryption at rest and in transit. SOC 2 certified.
Claude for Enterprise: Similar protections. No training on user data by default. Clear privacy commitments.
Microsoft Copilot for Business: Integrated with Microsoft 365. Respects existing permissions. Compliance documentation.
These aren’t cheap, but they’re dramatically cheaper than a data breach.
Cost comparison:
- ChatGPT Enterprise: ~€50/user/month
- Average data breach: €4.44 million
- Data breach with AI involvement: €5.11 million
The maths isn’t complicated.
Phase 4: Build Actual Governance
This is where most organisations fail.
They buy the tools, then assume the problem’s solved.
Governance means:
Written AI Acceptable Use Policy that clearly states what’s allowed and what isn’t. Make it specific. “Don’t share confidential information” is useless. “Never input client names, financial data, or project specifics into AI tools” is actionable.
Mandatory AI literacy training for everyone who’ll touch AI tools. The EU AI Act requires this from February 2, 2025. You’re not ahead of the curve at this point; you’re catching up.
Access controls that enforce your policies. Multi-factor authentication. Role-based permissions. Audit logs that actually get reviewed.
Regular security assessments of your AI systems.
Penetration testing. Vendor audits. Incident response drills.
A clear escalation path when things go wrong. Because… they will go wrong. 😬
Phase 5: Vendor Due Diligence
Before connecting any AI tool to your systems, ask these questions:
- Where is data stored? (Data residency matters for GDPR)
- How long is data retained?
- Who can access it?
- Is it used for model training?
- What security certifications do they hold?
- Do they provide a DPA?
- What happens if we want to delete our data?
- Who are their subprocessors?
If a vendor can’t answer these questions, walk away.
I don’t care how impressive their demo was.
The Middle Path (That Actually Functions)
Here’s what I tell my students and clients.
AI isn’t going away.
Banning it completely just drives usage underground, where you can’t monitor or control it.
But treating AI like any other software misses the unique risks it introduces.
The middle path looks like this:
- Provide approved tools with proper security. Give your team legitimate ways to use AI efficiently.
- Train them properly. Not a single email, not a PDF nobody reads. Actual training with examples, scenarios, and clear consequences.
- Monitor usage without being creepy. You’re not spying… you’re protecting. Ok?!
- Update regularly. AI security isn’t set-it-and-forget-it. New threats emerge weekly.
- Build a culture where people feel comfortable asking questions. If someone’s unsure whether data can be used in AI, they should ask rather than guess.
Start Here (Three Things for Monday Morning)
If you do nothing else:
- Create an AI inventory this week. You can’t manage what you don’t measure. Survey your team. Find out what’s actually being used.
- Implement a data classification system. Green, amber, red. Simple, visual, enforceable.
-
Set up one enterprise-grade AI tool with proper security. Give your team a legitimate option so they stop using sketchy free alternatives.
These three actions won’t solve everything, but they’ll move you from “flying blind” to “actually managing risk.”
The Uncomfortable Truth
I don’t see AI cybersecurity as a fundamentally technical problem but rather a human problem.
The tools exist.
The frameworks exist.
The regulations exist.
What’s missing is the willingness to do the uncomfortable work of implementing proper controls whilst maintaining enough flexibility for people to actually do their jobs.
Every class I teach, I see the same pattern.
People understand the risks intellectually. They nod at the statistics. They agree that security matters.
Then they go back to their organisations where “moving fast” beats “staying secure,” where quarterly targets trump long-term risk management, where IT departments are chronically understaffed and security is someone else’s problem.
Until it isn’t. 🙄
Until that breach notification lands. Until those regulatory fines arrive. Until that client lawsuit gets filed.
The IBM report is clear: organisations that extensively use AI and automation in security saved $1.9 million in breach costs and contained breaches 80 days faster than those that didn’t.
The technology can help. But only if you actually implement it properly.
A Final Thought
One of the reasons I started teaching was that I was tired of watching businesses make preventable mistakes.
The AI gold rush reminds me of the early internet days (yes, I’m that old), with massive opportunity, minimal oversight, and everyone assuming “it’ll probably be fine.”
It wasn’t fine then. It won’t be fine now.
But unlike the early internet, we don’t have the luxury of learning slowly. The stakes are higher, the threats are faster, and the regulatory environment is already here.
You have a choice.
You can wait until a breach forces your hand. You can hope your competitors get hit first, that regulators look elsewhere, that your employees never make mistakes.
Or you can accept that AI cybersecurity is now part of doing business, as it is accounting, as HR, as every other operational necessity you don’t particularly enjoy but absolutely require.
The paranoid companies will eventually realise they can’t maintain their restrictions. The naive ones will learn through expensive lessons.
The smart ones?
They’re already building the systems that let them move fast and stay secure.
Which one are you?
Leave a Reply