“If you don’t know what you’ve got to lose in the business, you have failed already."
That was Security and Risk Adviser Dr Thomas Jreige’s message to around 50 WA business leaders at a recent CCIWA and AQ Intelligence (AQi) event, Leading Through the AI Shift.
At a glance:
Your staff are likely already using AI tools at work, and some of what they enter may be your most sensitive information. Knowing what data you hold and who can send it where is the first step to protecting it.
It’s a harsh line for some, but the problem behind it is simple. Your staff are likely already using AI, whether your company has authorised it or not, and some of what they put into it may be your most sensitive information.
AQi Advisory Board Member Rita Bose said sensitive business and personal information is already going into AI tools, often with no guardrails in place.
Brown said data protection is about more than avoiding a breach, but looking after something that gives your business value.
The first fix doesn’t need a new tool. It starts with knowing what you have.
Your data is worth protecting
AQi Chairperson Dr Chris Brown said every business has “an intangible asset that doesn’t sit on the balance sheet”, and that is its data.
When someone wants to buy a business, “they do their [due diligence]; it’s all on data and the capability that data projects”.
That changes how you think about protection.
Brown said data protection is about more than avoiding a breach, but looking after something that gives your business value.
Encore 5.0 Co-founder and Partner Tony Adcock told the room that “doing nothing [around AI] is not an option”, but AI should be seen “as an opportunity as much as we see it as a risk”.
For most businesses, the practical starting point is closer than you might think.
Four ways to lock things down
Jreige told the room that the first fix isn't always implementing an AI tool. Many businesses aren’t using the full protections in the Microsoft or Google subscriptions they already pay for, he said.
The panel shared the following tips:
Decide what is public, what stays inside the business and what must never leave it, such as financial records, client contracts and staff files.
Jreige said many businesses hadn’t classified their information at all, which means there are no rules to enforce. In Microsoft 365, you can turn those categories into sensitivity labels (for example Public, Internal and Confidential) that staff apply to files and emails.
In Adobe Acrobat, choose the option that requires a password to open a PDF. Avoid the restriction-only option that limits printing or copying, because it is easy to get around. Word and Excel have their own setting under File, Info, Protect. Send the password separately from the file, by text or phone.
In Microsoft 365, a sensitivity label can go further. It can encrypt a file so only named people can open it, and stop it being forwarded, copied or printed. It won’t stop someone trying to upload the file to an AI tool, but the tool can’t read what’s inside. The same goes for a password-protected file. Anyone who has the password can still open it and paste the contents anywhere, so treat it as a lock on the door, not a guard on the room.
Write a one-page AI rule set: which tools are approved and what can and can’t go into them. Include a note on accounts, because free versions of popular AI tools typically offer little protection and feedback buttons can send your content back into training, as one attendee pointed out.
Other attendees suggested regular AI refresher modules for employees, like the cyber and personal safety training many businesses already run.
Encore 5.0 Co-founder and Partner Jonathan Smith said staff using AI without controls was a growing problem, and singled out one example.
“Probably the worst one is embedded AI in mobile devices, bringing mobile devices to meetings, and that conversation is being captured in the public cloud,” he said.
Before your next sensitive discussion, decide what’s allowed. Are AI note-takers and voice assistants OK? Do people need to ask before recording? Do phones stay out of the room for the conversations that matter most?
Europe is also setting the pace on AI rules. Smith said the European Union’s AI Act, which is already in force, carries penalties of up to €35 million or 7% of global annual turnover for the most serious breaches.
It can apply to businesses outside Europe whose AI systems or outputs are used there, which is worth watching as the Australia-EU Free Trade Agreement moves towards taking effect.
Find out where your business stands
“Most of our members are already using AI in some form,” said CCIWA Head of International Trade Services Michael Carter.
“The sensible next step is to know where your sensitive information sits and who can send it where, before the tools get ahead of the rules.”
If you want to understand where your business stands on AI governance, Guardrail Technologies, AQi’s technology partner, can help. Take the survey as the first step towards a full AI governance audit.
Feel like you missed out? Be the first to find out about our events and training opportunities by subscribing to The Guide.
“If you don’t know what you’ve got to lose in the business, you have failed already."
That was Security and Risk Adviser Dr Thomas Jreige’s message to around 50 WA business leaders at a recent CCIWA and AQ Intelligence (AQi) event, Leading Through the AI Shift.
At a glance:
Your staff are likely already using AI tools at work, and some of what they enter may be your most sensitive information. Knowing what data you hold and who can send it where is the first step to protecting it.
It’s a harsh line for some, but the problem behind it is simple. Your staff are likely already using AI, whether your company has authorised it or not, and some of what they put into it may be your most sensitive information.
AQi Advisory Board Member Rita Bose said sensitive business and personal information is already going into AI tools, often with no guardrails in place.
Brown said data protection is about more than avoiding a breach, but looking after something that gives your business value.
The first fix doesn’t need a new tool. It starts with knowing what you have.
Your data is worth protecting
AQi Chairperson Dr Chris Brown said every business has “an intangible asset that doesn’t sit on the balance sheet”, and that is its data.
When someone wants to buy a business, “they do their [due diligence]; it’s all on data and the capability that data projects”.
That changes how you think about protection.
Brown said data protection is about more than avoiding a breach, but looking after something that gives your business value.
Encore 5.0 Co-founder and Partner Tony Adcock told the room that “doing nothing [around AI] is not an option”, but AI should be seen “as an opportunity as much as we see it as a risk”.
For most businesses, the practical starting point is closer than you might think.
Four ways to lock things down
Jreige told the room that the first fix isn't always implementing an AI tool. Many businesses aren’t using the full protections in the Microsoft or Google subscriptions they already pay for, he said.
The panel shared the following tips:
