Sensitive Information in AI Chat, Teams, and WhatsApp: The Moment Before Sending

Where Microsoft 365 Ends

In the blog post about Microsoft Purview, you saw what Business Premium already protects: email and files in OneDrive and SharePoint. A file you share in Teams is also included.

Not the chat message in Teams. According to Microsoft, DLP for Teams chat requires an E5 license. And Microsoft doesn’t detect AI chat in the browser or an app on a laptop at all.

AI Chat and Confidentiality

An employee pastes a letter to a client into a free AI chat—using his personal account—to help him word it better. The client’s name, address, and the reason for the case are included and sent to a service with which your organization has no data processing agreement.

Bans don’t work well. The tool remains useful, and those who aren’t allowed to use it will use it secretly. A better approach: find out which AI tools your team is using, and agree on what’s allowed for each tool.

WhatsApp is not a file

The community nurse sends a photo to the colleague who is taking over the shift. The technician texts the customer a quote with the customer’s address. It’s quick, and it’s often done on a personal phone.

This means that business data is stored on a device that the organization does not manage, in an app that it cannot archive. If the employee leaves, the conversations go with them. Any alternative must be just as fast; otherwise, no one will use it.

A warning at just the right moment

You’ll forget a training session on data breaches in a week. But you won’t forget a notification that appears the moment you send an email. In Outlook, Microsoft 365 already does this: if an email contains sensitive information, a notification appears at the top of the screen before the email is sent. For chat and for apps outside of Microsoft, you’ll need software installed on your device to enable this feature.

Protect without spying

Any form of data breach prevention raises one question for employees and the works council: Is the employer monitoring our communications? Ask yourself that question before you make a decision. A single report per type of data is enough to prevent a breach. Names and message content are not necessary for this.

Start with an AI overview

You don’t have to start with software. Start by making a list of the AI tools your team uses, what they’re used for, and what data they process. Often, the list will include tools that no one expected.

The European AI Regulation requires providers to label AI output. Since August, they have been required to label what their AI generates in a machine-readable format; for tools that were already on the market, the transition period runs until December 2. That is their obligation. Your job is to know what you’re using.

The AI Registry does not provide a legal opinion. However, in about ten minutes, it generates an overview of your AI tools, including the transparency statements, and sends it to you as three documents via email.

This Is How We Do It

We’ll start with the AI overview and the specifications for each tool. Next, we’ll enable Purview for email and files. We’ll address the gaps outside of Microsoft with on-device data breach prevention, as an add-on to the modern workplace. We operate in accordance with ISO 27001:2023, ISO 9001:2015, and NEN 7510:2024.

Frequently Asked Questions

Can an employee use an AI chatbot for work?

You decide that yourself, on a per-tool basis. Specify which tools are allowed and what data should not be included in them. A business subscription with a data processing agreement is different from a free version with a personal account.

Does Business Premium protect Teams?

Files you share in Teams are included, since they’re stored in SharePoint or OneDrive. The chat message itself isn’t; for that, Microsoft requires E5.

Do I need to label AI output myself?

It is the AI tool provider’s responsibility to label AI output. What matters for you is that you know which tools you’re using and what you’re inputting into them.

Conclusion

A data breach usually starts with a patch, not a hacker. Microsoft 365 protects email and files; the chat feature, the AI tool, and the app on your laptop are not covered. Start by getting an overview of what your team uses, and agree on what’s allowed for each tool.

Would you like to discuss this before sending it? Schedule a meeting with ALTA-ICT.