Most businesses start using AI because it saves time. Someone needs to rewrite an email, summarise a meeting, improve a proposal, or make sense of a spreadsheet. A free tool is open in a browser, so they paste the information in and carry on with their day.
The problem is that business information can leave your control long before anyone realises it.
That does not mean small businesses should avoid AI. AI can be useful. But it needs the same basic care you would apply to email, cloud storage, passwords, or online banking.
The question is not only, “Is this AI tool useful?” It is also, “What information is being put into it, where does it go, and who is responsible for it?”
Why Free AI Needs Attention
Free AI tools are easy to start using. A staff member can create an account with a personal email address, paste in information, and get an answer within seconds.
That convenience is useful, but it also means the business may have no clear record of:
- Which AI tools staff are using
- Which accounts are connected to those tools
- What information has been entered
- How long information is stored
- Whether prompts or uploads may be used to improve the service
- Whether data is processed outside South Africa
For businesses that handle client records, employee details, financial information, legal documents, health information, or confidential commercial information, this needs attention.
POPIA requires private bodies to process personal information lawfully and take reasonable steps to protect it. The fact that a business uses an external AI tool does not remove its responsibility for the information it provides to that tool.
1. Pasting Client Details Into a Chatbot
This is probably the most common issue.
A staff member receives a long client email and pastes it into a chatbot with a prompt such as:
“Summarise this complaint and draft a professional response.”
It seems harmless. But the email may contain the client’s name, email address, phone number, account details, order history, medical information, identity number, or other sensitive information.
The same thing happens when people ask AI to:
- Summarise customer complaints
- Rewrite sensitive emails
- Draft responses to legal or HR issues
- Analyse client notes
- Translate personal documents
- Prepare reports from customer data
The risk is not necessarily that the AI tool will immediately expose the information publicly. The problem is that the business may not know how the provider stores, retains, reviews, or uses that information.
A safer approach is to remove identifying information before using an AI tool.
For example, instead of pasting this:
“Please reply to John Smith at Coastal Property Group regarding his unpaid invoice of R18,500.”
Use this:
“Draft a polite follow-up email to a client regarding an overdue invoice. Keep it professional but firm.”
You still get help with the wording, without giving the AI tool the customer’s identity or account details.
2. Using Personal Accounts for Business Work
Free AI tools are often used through personal accounts.
An employee signs up with Gmail, Microsoft, Apple, or another personal email address. From there, they may use the tool to help with work every day without the business knowing.
This is sometimes called shadow AI: staff using AI tools outside the business’s approved systems, policies, and oversight.
The issue is not that staff are doing something malicious. Usually, they are trying to work faster. But the business loses visibility and control.
If the employee leaves, the account stays with them. The business may not know what information was uploaded, which conversations were saved, or whether documents were connected to the account.
Free and personal accounts also usually provide fewer business controls. You may not have:
- A central list of users
- A way to remove access when staff leave
- Audit logs showing activity
- Business-level security settings
- Clear retention controls
- Support agreements or data-processing terms suitable for business use
A business should know which AI tools it has approved, who has access to them, and what information staff are permitted to enter.
3. Uploading Documents Without Reading the Fine Print
Many AI tools allow users to upload files. That can include Word documents, PDFs, spreadsheets, photos, meeting notes, contracts, and presentations.
This is where the risk can increase quickly.
A document may contain far more information than the person uploading it realises. A proposal might include pricing. A spreadsheet could contain customer names and bank details. A contract may include confidential terms, signatures, addresses, and identity information.
Common examples include:
- Asking AI to summarise a supplier contract
- Uploading a tender document for help with a response
- Analysing a spreadsheet of customers or leads
- Improving a quotation or proposal
- Asking AI to review a staff policy
- Uploading financial reports for quick insights
- Copying source code or technical documentation into a chatbot
In 2023, Samsung restricted the use of generative AI after employees entered sensitive company information into ChatGPT, including source code and internal meeting notes. The incident is a useful reminder that information can be valuable to an employee for completing a task, while still being confidential to the business.
Before uploading a file, ask:
Would I be comfortable emailing this document to an unknown third party?
If the answer is no, it should not be uploaded to a free AI tool without checking the provider’s privacy terms, security settings, retention rules, and business controls.
4. Letting AI Meeting Tools Record Everything
AI meeting assistants can record calls, create transcripts, generate summaries, list action items, and write follow-up notes.
That can save time. It can also create a detailed record of conversations that may previously have existed only in people’s notes.
A meeting transcript may contain:
- Client names and contact details
- Commercial discussions
- Pricing and quotations
- Staff performance concerns
- Legal or disciplinary discussions
- Confidential project information
- Passwords or access details mentioned verbally
- Sensitive client or patient information
Some meeting tools automatically join calls once connected to a calendar. Others can save recordings or transcripts to cloud platforms. In some cases, attendees may not fully understand that the meeting is being recorded, transcribed, or processed by an external provider.
This is especially important for businesses working with regulated or sensitive information, including legal, financial, medical, property, HR, and professional services.
Before using an AI meeting tool, make sure you know:
- Whether participants are told the meeting is recorded
- Where recordings and transcripts are stored
- Who can access them
- How long they are retained
- Whether recordings can be deleted
- Whether the tool is connected to staff calendars or cloud storage
- Whether sensitive meetings should be excluded entirely
5. Assuming “Free” Means There Is No Cost
Free tools do not always cost money, but they can still cost control.
Consumer AI platforms may use conversation data in different ways depending on the provider, product, account type, and privacy settings. Some allow users to opt out of model training. Others retain conversations for safety, abuse prevention, or operational reasons.
The details matter.
A free account may not offer the same protections as a paid business or enterprise account. Business plans may offer clearer contractual terms, central administration, stronger access controls, and commitments around whether business data is used for model training.
That does not mean every paid AI plan is automatically safe. It means the business has a better chance to ask the right questions and put proper controls in place.
Before approving an AI tool, find out:
| What to check | Why it matters |
|---|---|
| Does the provider use prompts or uploaded files to train its models? | You need to know whether business information may be used beyond the immediate request |
| Can training be disabled? | An opt-out setting may reduce unnecessary use of business data |
| Where is the data stored and processed? | Data may be handled outside South Africa, which requires consideration under POPIA |
| How long is information retained? | Old prompts, recordings, and uploads can become forgotten data stores |
| Can an administrator manage users and remove access? | You need to remove access when staff leave or roles change |
| Does the provider offer a data-processing agreement? | This helps clarify each party’s responsibilities for personal information |
| Can staff use the tool with a business account? | Business accounts are easier to manage than personal accounts |
POPIA places conditions on cross-border transfers of personal information. Before sending personal information to a provider outside South Africa, businesses should understand where information is processed and whether the transfer is permitted under section 72 of POPIA.
What Your Business Should Do
You do not need a long, complicated AI policy to start using AI more safely.
A one-page set of rules is often enough for a small business. It should explain what staff may use AI for, what information may never be entered, and who to ask when they are unsure.
At a minimum, your business should:
- List the AI tools staff currently use for work
- Decide which tools are approved and which are not
- Prohibit staff from entering passwords, banking details, identity numbers, health information, legal documents, or confidential client information
- Require personal details to be removed before AI is used to summarise or rewrite information
- Use business-managed accounts instead of personal accounts where possible
- Turn off data-sharing or model-training settings where the provider allows it
- Check connected apps, meeting bots, browser extensions, and cloud-drive permissions
- Remove access when staff leave
- Include AI tools in your normal cybersecurity and POPIA conversations
- Train staff to stop and ask before uploading sensitive information
The goal is not to make staff afraid of AI. It is to make sure they understand that an AI prompt is not private simply because it is typed into a chat window.
Where Bridgelytic Fits
I work with SMME businesses and regulated professionals in Ballito and surrounds who want practical IT support without unnecessary complexity.
That includes helping businesses understand where their data is going, which tools staff are using, and what basic controls need to be in place before a small convenience becomes a larger problem.
The aim is simple: use useful technology, protect client information, and keep control of your business systems.
If you are unsure whether staff are using AI safely, that is worth checking. A short review of the tools in use, user accounts, file-sharing settings, and basic policies can identify risks before they become an incident.
Got an IT concern, or want to talk through how AI fits into your business? WhatsApp me or send an email, and let’s get it sorted.
Sources
Information Regulator South Africa, Protection of Personal Information Act (POPIA): https://inforegulator.org.za/
Information Regulator South Africa, POPIA Guidance Notes: https://inforegulator.org.za/guidance-notes/
Information Regulator South Africa, Processing Special Personal Information: https://inforegulator.org.za/popia/
National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
Cybersecurity and Infrastructure Security Agency, Artificial Intelligence: https://www.cisa.gov/ai
Protection of Personal Information Act, Section 72: Transfers of Personal Information Outside the Republic: https://popia.co.za/section-72-transfers-of-personal-information-outside-republic/
Samsung Newsroom, Samsung Electronics Bans Generative AI Use to Protect Company Data: https://news.samsung.com/global/samsung-electronics-bans-generative-ai-use-to-protect-company-data