Before You Roll Out AI: What to Check So It Doesn’t Become a Security Risk

This Halloween, the scariest thing in your office might be an AI tool your team is already using without your knowledge. Statistics Canada reports that just over one in three Canadian workers used generative AI for work in the 12 months to March 2026. Over roughly the same period, only 19.2% of Canadian businesses reported using AI to produce goods or deliver services. The two surveys measure different activities, but the gap points one way: employees are adopting AI faster than their employers are setting rules for it.

Often, staff are simply looking for ways to save time, such as asking a chatbot to polish a client email or summarize a contract. But pasting sensitive business information into an unapproved tool can expose data to services the business hasn’t assessed. Before AI use spreads further, you need to know which tools your team is using, what information they’re sharing, and whether those tools have the right security and privacy safeguards.

At Bulletproof IT, the AI conversations clients bring us have moved from “should we try this?” to “what do we need to sort out first?” The follow-up questions tend to be the same from one business to the next, and this article answers them: how AI changes your security exposure, what to settle before you switch anything on, and which rollout approach to avoid. By the end, you’ll be able to match your AI approach to the data you hold and the level of risk you’re prepared to carry.

Why AI Changes Your Security Picture

In June 2026, the Canadian Centre for Cyber Security urged organizations across the country to act on AI-related risk. It named three risks that start inside the business: unapproved use of AI tools, exposure of sensitive data, and systems relying on inaccurate or manipulated outputs. It also warned that attackers are using AI to make their scams more convincing. Below, you’ll see how each of those four risks plays out in practice, and later, what you can do to protect your business against them.

AI Makes Buried Files Easy to Find

Nearly every business has files that were shared too widely at some point. This could be a payroll spreadsheet saved to a team-wide folder or a sharing link set to “anyone in the organization” so a contractor could open one document years ago. Or perhaps it’s an HR folder that inherited permissions from the folder above it. Those files stayed protected mostly by obscurity. Finding them meant knowing the folder path or the file name.

An AI assistant connected to company data removes that cover. Ask it what the business pays its project managers, and it searches everything the person asking is allowed to open, including files they never knew they could see. The assistant follows the permissions already in place, so a file that was overshared becomes a file anyone can surface with a plain-language question.

Here’s why that matters: if the wrong person finds a salary file, pay comparisons can sour a team. If it’s a client’s financial records, you could lose the client. And if personal information is exposed, your business may have to report it as a privacy breach.

Company Data Can Leave Through the Prompt Box

The reverse problem is staff carrying company information out to an AI tool the business doesn’t control. In KPMG in Canada’s 2024 survey of Canadian employees, 24% of generative AI users had entered proprietary company data, such as HR or supply chain information, into public AI tools, and 19% had entered their employer’s private financial data. By 2025, that financial-data figure had fallen to 14%, which is still about one user in seven.

Very little of this is malicious. An employee drafting a proposal pastes in last year’s pricing to save time, or a bookkeeper asks a chatbot to explain a variance in a client’s ledger. How much risk that creates depends mostly on the type of account. Business and enterprise plans typically include contractual terms covering how inputs are stored, who can access them, and whether they’re used to train models. A free personal account runs on the individual’s own settings, so company information typed into it falls under terms your business never agreed to and has no way to audit.

AI Can Be Tricked by What It Reads

AI assistants process emails, documents, and web pages to answer questions and complete tasks. But these sources can also carry hidden instructions written to manipulate the assistant. This is known as prompt injection.

An attacker might hide instructions in an email or shared document that try to persuade an AI assistant to retrieve sensitive information or send it somewhere it shouldn’t go. If the assistant has access to that information and the right safeguards fail, data could be exposed without the user realizing what happened.

This risk has been demonstrated in a real-world product. In June 2025, Microsoft disclosed a critical Microsoft 365 Copilot vulnerability (CVE-2025-32711), nicknamed “EchoLeak” by the researchers who discovered it. A specially crafted email could manipulate Copilot into disclosing information from its context without the user clicking a link or opening the message. Microsoft deployed a server-side fix, so customers didn’t need to install an update themselves, and reported no evidence that the vulnerability had been exploited in the wild. The flaw is fixed, but the lesson applies to any AI tool that reads outside content while it has access to company data: every email or document it reads is a possible way in.

Attackers Are Using AI Too

Your business doesn’t need to adopt AI to face AI-powered attacks.

The Cyber Centre’s National Cyber Threat Assessment 2025-2026 finds that AI is lowering the barrier to entry for malicious cyber activity. In practice, that means more convincing phishing emails, phone scams, and deepfake impersonations. Familiar warning signs, such as poor grammar or generic greetings, are becoming less reliable. A fake invoice might reference a real project, while a cloned voice could make an urgent payment request sound as though it came from your boss.

For a small business, one convincing request can be enough. Email remains the top attack vector for small businesses, and a payment sent to a scammer’s account is often money you won’t get back.

How Claude and Copilot Reach Your Company Data

Those scams can reach your business whether or not you use AI. The other three risks depend on which AI tools you choose and how you configure them, starting with a simple question: what can AI see once it’s connected? Claude and Microsoft Copilot, the two assistants Bulletproof IT clients ask about most, can both reach company information through Microsoft 365. They differ in how that access gets set up, what administrators can control, and which account or plan your team uses. 

Microsoft Copilot Works Inside Your Existing Microsoft 365 Data 

Copilot works across Outlook, Teams, Word, Excel, and SharePoint. Sean notes that because it bolts onto data the business already keeps in Microsoft 365, it largely settles the risk discussion by default. According to Microsoft, your data stays within the Microsoft 365 service boundary, protected by the security, compliance, and privacy policies your organization already has in place. In other words, your files don’t go to a new company under new terms. What Copilot doesn’t settle is who can see what. It respects existing permissions, so it can surface anything a user already has access to, and Microsoft notes that SharePoint’s sharing settings default to the most permissive option.

Claude Connects to Company Data When You Set It Up

Claude works as a standalone assistant until someone connects it to Microsoft 365, so access is a separate decision. The connector sees only the data each user can already view, and on Team and Enterprise plans, an organization owner and a Microsoft Entra administrator must approve it before anyone can use it. Write access, such as sending emails or editing files, can be controlled separately.

With either tool, account type matters. Copilot’s enterprise data protection only applies when staff sign in with a work or school account. By default, Anthropic doesn’t use data from commercial plans, such as Team and Enterprise, to train its models, while on consumer plans (Free, Pro, and Max), each user decides. An employee using a personal account for company work may be under very different terms than the business expects.

For both tools, the same rule applies: check permissions before connecting AI to company data.

Three Questions to Answer Before You Turn AI On

You’ve seen where AI risk comes from and how Claude and Copilot reach your company data. Now for what to do about it. Sean Tindall, President at Bulletproof IT, recommends sorting out three areas before rolling out AI: the risks, who can access your data, and the rules employees must follow. The questions below turn those areas into practical steps you can start this week, with or without outside help.

1) Should AI be connected to your company data at all?

Start by deciding what AI actually needs to access. Connecting an assistant to company files, email, and chat gives it more to work with, but it also widens the exposure if access controls fail. Many useful tasks need no connection at all, such as drafting a job posting, polishing a customer email without personal details, or summarizing a public industry report.

A simple way to set boundaries is to sort information into three tiers:

• Open: Information employees can use with an approved tool.

• Handle with care: Sensitive internal information, such as financials, contracts, and pricing strategy.

• Off-limits for now: Information that stays out of AI tools until stronger safeguards are in place, such as client health or financial records, employee files, and confidential third-party information.

Privacy obligations should guide these decisions. Canada’s federal, provincial, and territorial privacy regulators have published principles for organizations that use generative AI, calling for safeguards that match the sensitivity of personal information and for assessments, such as privacy impact assessments, to identify risks. For most Alberta businesses, the Personal Information Protection Act (PIPA) also applies. Whatever your industry, the starting point is the same: decide what information AI may handle, and document that decision.

Quick check: List the five or six places your most sensitive information lives, then decide which, if any, AI can access in the first phase.

2) Do you know who has access to what?

AI tools connected to Microsoft 365 can reach whatever the signed-in user can open. The fix is least-privilege access: employees should have access to what their roles require, and no more. Permissions pile up as people change roles, join projects, and get added to groups, and excessive access becomes a significant security risk when no one cleans it up.

Microsoft’s Copilot readiness guidance points to a few fixes that suit small businesses:

• Tightening company-wide sharing defaults and limiting “anyone with the link” access.

• Narrowing folders shared with everyone to the people who need them.

• Removing access for former employees, past contractors, and finished projects.

• Restricting HR, finance, and legal files to defined groups.

Account security matters, too, since identity-based threats can evade traditional security measures. An attacker who takes over an account gets the same access, and AI can help them search it. Require multi-factor authentication (MFA) on every account, starting with administrators. Where you can, use phishing-resistant options such as passkeys, which only work on the real site and can’t be handed to a scammer.

Quick check: Ask your IT provider for a list of folders shared organization-wide or by public link, plus any accounts without MFA. If they can’t produce one, that’s your first gap to close.

3) What are the rules for using AI at work?

Without clear guidance, employees decide for themselves which tools to use, what to share, and when to trust the results. KPMG’s 2025 survey found that 42% of Canadian employees weren’t aware of any employer controls on generative AI use, up from 37% the year before, and only 29% said their employer had a comprehensive AI policy. Among workers who hadn’t used generative AI, Statistics Canada found that just 5.0% said workplace policies held them back.

The Cyber Centre recommends an internal acceptable-use policy, approved and blocked tool lists, and controls for unsanctioned AI use. For most small businesses, a short policy can cover the essentials:

• Which tools and account types are approved, including whether personal accounts are allowed for company work.

• What information stays out of prompts, based on the data tiers above.

• When a person must check AI-generated content before it goes to a client, enters company records, or informs a decision.

• Who to ask when unsure, and how to report mistakes or accidental disclosures without fear of blame.

Short security-awareness refreshers keep the policy alive. They can introduce newly approved tools, show examples of risky prompts, and run phishing simulations based on AI-generated scams. They should also reinforce one rule: verify unexpected payment requests and banking changes through a trusted phone number already on file.

Quick check: Ask three employees which AI tools they’ve used for work in the past month, and whether on personal or company accounts. Their answers will show where practice and policy differ. 

Rolling Out AI, From Safest to Scariest

Sean describes three ways businesses bring AI in, and only two of them are sensible. Choosing between those two depends on the sensitivity of your data, the systems you want to connect, and how much preparation your business needs.

The Structured Implementation Project

Sean calls this the most structured and mature way to implement AI. It starts with two stages before anyone uses the tools: auditing file permissions, then setting an AI use policy. Doing the audit first means the files AI can surface for each person are the files that person should actually see, and the policy can then reflect what the audit turned up.

The trade-off is the effort up front. Reviewing years of shared folders and permissions takes work, and managers may need to help decide who should have access to what. This approach makes sense for businesses handling sensitive client or financial information, working in regulated sectors such as accounting, legal, health care, or financial services, or planning to connect AI to core business systems.

The Small Pilot: A Few Users, Learning as You Go

The second approach is to give a couple of people access to an approved AI tool and figure it out as you go. Sean considers this a reasonable way to start, and for many smaller businesses, it’s the right fit. A pilot lets you test real tasks and spot confusing rules, unexpected results, or gaps in your setup while only a few people are affected.

Three safeguards make a pilot more effective:

1. Give the group clear rules. Specify which tool and account type to use, what stays out of prompts, and when AI-generated work needs a human review.
2. Limit access to sensitive information. Start without connecting company systems, or choose pilot users whose permissions are already appropriately restricted.
3. Decide how you’ll assess the results. Set a date to review what worked, what went wrong, and whether to expand, adjust, or stop.

A pilot suits smaller teams with lower-sensitivity data who want to see AI’s practical value before committing more time and budget. What you learn can also show which permissions and rules need attention before a wider rollout.

Licences for Everyone and Fingers Crossed

Then there’s the approach Sean describes as throwing caution to the wind: licences for the whole team, everything switched on, and fingers firmly crossed. So far, no Bulletproof IT client has tried it. 

The appeal is speed: everyone gets the same tools at once, without waiting for a formal project. The risk is that existing problems spread across the business just as fast. Overshared files, unclear rules, and untrained staff all become issues from day one. If last year’s restructuring plans sit in a folder the whole company can open, every new licence holder can now find them by asking. And without a small group to test the setup first, mistakes can reach client work before anyone spots them.

If you want to move quickly, start with a pilot instead. You’ll still make progress, without turning your entire company into the experiment.

Which Businesses Should Slow Down Before Using AI?

Some businesses will get more out of AI by doing the groundwork first. Slowing down here means preparing before connecting AI to company systems or sensitive information. If any of these situations sound familiar, give yourself more time.

• You handle regulated or highly sensitive personal information. Patient records, client financial statements, legal files, and information about children may be subject to privacy laws, professional obligations, and contractual restrictions. An exposure can trigger reporting requirements and damage client trust, and it’s difficult to undo.

• Your client contracts restrict how their data can be handled. Some agreements limit where information can be stored or which outside services can process it. Confirm that your intended AI tool and setup meet those terms before entering client information.

• The basics covered above aren’t in place yet. If you can’t say where your sensitive files live, MFA isn’t on every account, or staff are already using personal AI accounts for work, close those gaps before connecting AI to company data.

• Nobody owns the decision. If no one has time to set rules, review permissions, and answer staff questions, AI adoption tends to happen informally, one personal account at a time.

You can still make progress while you close these gaps. Start with an approved business-grade tool that isn’t connected to company systems, use it for low-risk tasks such as drafting generic content or researching public information, and set clear rules about what staff can enter. Permission reviews and an AI use policy can move forward in parallel.

Start Your AI Rollout With a Conversation About Your Data

You now have three questions to answer before turning AI on, a clearer picture of how Claude and Copilot reach your company data, and a way to choose a rollout approach that fits your business. Whether you start with a structured implementation project or a small pilot, the first step is understanding what information you hold and who can access it.

The biggest AI risks often start with gaps that were already there: overshared files, weak login security, and no clear rules for staff. AI can make those gaps easier to find, so addressing them protects your business whether you adopt AI now or later.

If you’re unsure whether your current IT provider can help you prepare, our guide to what to look for in a managed IT provider can help you assess whether you’re getting the support you need.

When you’re ready to plan your rollout, talk to us. We’ll start with where your data and permissions stand today and which approach fits your business. Everything covered in this article, from file permissions and MFA to security awareness training, is part of our managed IT services.

Frequently Asked Questions About Rolling Out AI

Can we block free AI tools on work devices?

Yes, to a large extent. Application controls can restrict unapproved desktop apps and browser extensions, while web and DNS filtering can block access to known AI websites. However, blocking requires ongoing maintenance as new services emerge, and AI features appear in software employees already use. It also won’t cover personal phones or every route to an AI tool. Pair technical restrictions with an approved alternative, so employees have a practical way to use AI for legitimate work.

Does using AI change our obligations under privacy law?

Your existing privacy obligations generally still apply when you use AI. Your business remains responsible for handling personal information appropriately, including when it is shared with an external AI provider. The rules that apply depend on your location, sector, and the type of information involved. If personal information is exposed through an AI tool, you may also have breach assessment or notification obligations. Review the relevant privacy requirements before introducing a tool and consult a privacy lawyer about your specific circumstances.

Who in a small business should own the AI use policy?

Name one person, usually the owner or an operations manager, as the person accountable for the policy, with your IT provider advising on technical safeguards. Canada’s privacy regulators recommend a clear internal governance structure with defined roles and responsibilities. The policy owner should approve the tools, answer staff questions, coordinate responses to mistakes, and review the rules when the business adopts new tools or a vendor changes. The key is to make ownership explicit, even if one person wears several hats.

Do we need separate rules for AI agents that take actions?

Yes. Your policy should distinguish between AI that generates suggestions and tools authorized to send emails, edit files, update records, or take other actions. Mistakes involving an agent can have consequences before anyone reviews the output. The Cyber Centre recommends human checkpoints in automated workflows and emergency shutdown procedures for high-impact actions. Require human approval for sensitive actions, such as external communications or financial transactions. Give each agent only the permissions its task requires, and keep records of the actions it takes.