A developer pastes a production error into an AI assistant. A support agent pastes a customer complaint. HR uploads employee feedback. A sales employee asks an AI tool to summarise a CRM export.
Nobody intended to create a new personal-data flow. The data still left the controlled environment.
Start with the input
AI tools can receive names, email addresses, support conversations, logs, contracts, source code, KYC documents and internal identifiers.
The first control is therefore simple: know what data enters AI tools.
Shadow AI is shadow SaaS with a model attached
Employees can adopt AI tools faster than procurement can approve them. That creates an inventory gap similar to shadow SaaS.
Build an AI vendor register with:
- Tool and owner
- Use case
- Data categories
- Retention
- Training/model-improvement use
- Processing location
- Sub-processors
- Deletion
- Contract
Classify inputs
A practical internal model can separate public data, internal non-personal data, ordinary personal data and high-risk personal data. Then define which tools can receive each category.
The strongest control is not a warning saying “do not paste PII.” It is a gateway that can detect, redact or block sensitive input before it leaves the environment.
Agents create a bigger problem
A chatbot receives input. An agent can read systems and take actions.
Agent
↓
CRM
↓
Database
↓
Email
↓
External API
Now privacy risk includes tool permissions, purpose boundaries and action logs.
Do not forget your own logs
Even if the AI vendor does not retain prompts, your API gateway may. A request body can enter application logs, SIEM, backups or S3 exports.
The AI integration therefore belongs in the same data map as every other processor.
Vendor questions
Ask whether prompts are retained, whether they are used for training, where they are processed, who can access them, what subprocessors receive them, and how deletion works. Review the exact product and plan rather than relying on a generic vendor privacy page.
The self-test
Can you name every AI tool your employees use? Which receive personal data? Which can access production systems? What happens to prompts? Who owns the risk? If nobody can answer the first question, start there.
Where Privra fits
Privra maps AI services into the same data-flow and processor inventory as the rest of your stack, so an AI tool cannot become an invisible processing channel simply because it was adopted by engineering.