Skip to content
IT-Checklist

AI usage: checklist and advice

Last updated: · IT-Checklist editorial team · All changes

AI assistants have quickly become ordinary tools. Staff use them to summarise quotes, write emails and check code. Often with a personal account the business doesn't know about. That's fine, as long as there are clear agreements on what may and may not go in.

This topic is about keeping control. You want to know which tools are in use and stop customer data from quietly ending up with an AI service. New kinds of fraud come up too.

Check where your business stands on ai usage

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

Whatever you paste into a free AI service may be used to train the model further. Customer data, contracts or source code can leave your business that way. For personal data you then also have no data processing agreement.

With voice cloning and deepfakes, criminals can convincingly pose as a director or supplier. A call 'from the boss' about an urgent payment no longer proves anything.

The EU AI Act comes into force in phases. The transparency requirements have applied since 2 August 2026. For example, you must tell people they are talking to a chatbot. Because of the Digital Omnibus, the requirements for high-risk AI, such as in recruitment and staff evaluation, apply from 2 December 2027.

The 9 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. We know which AI tools are used within the company (including employees' private accounts).

    Important

    Take stock of which AI tools employees use. Invisible AI usage ('shadow AI') is the biggest risk.

  2. There are agreements on which business and customer data may and may not be entered into AI tools.

    Do first

    Draw up a short AI guideline: no customer data, passwords or confidential figures in public AI tools without a business agreement.

  3. AI output that goes to customers is always reviewed by a human.

    Important

    Agree that AI texts, calculations and advice are always reviewed before they go out. AI can be convincingly wrong.

  4. For business AI subscriptions, it is configured that our data is not used for training.

    Recommended

    Choose business versions of AI tools and verify the 'do not use data for training' setting. Document this.

  5. We are alert to AI fraud such as voice cloning and deepfake invoices, and have verification agreements for payments.

    Important

    Agree on a fixed verification step for payment requests (call back via a known number, four-eyes principle), even if it seems to be 'the boss'.

  6. One person is responsible for AI policy and keeping track of AI developments within the company.

    Recommended

    Appoint an AI point of contact (this can be the owner). Without an owner, AI policy stays on paper and new tools creep in unnoticed.

  7. Before using an AI tool for business, we check where the data resides and whether there is a data processing agreement (GDPR).

    Important

    Treat AI tools like any other cloud vendor: check the privacy terms, where data is stored and sign a data processing agreement if personal data goes in.

  8. Employees are informed about safe AI use and the risks, such as fabricated answers and data leakage.

    Recommended

    Discuss AI use in a team meeting: what is and isn't allowed, and why. AI tools can give convincingly wrong answers ('hallucinations') — that awareness prevents mistakes.

  9. We have checked whether our AI applications fall under the European AI Act and what it requires from us.

    Recommended

    The AI Act is entering into force in phases and sets requirements for e.g. AI in recruitment, employee evaluation and customer selection ('high risk'). Check whether your use falls under it and whether you meet the transparency requirements.

Where to start

  • Ask the team which AI tools everyone uses. Agree together which ones are allowed for work.
  • Write down in three lines which data must never go into an AI tool. For example customers' personal data, passwords and confidential contracts.
  • On business subscriptions, switch off the use of your data for training. Also check where the data is stored.
  • Agree that any payment asked for by phone or video call is first checked through a second channel you already knew.

Common mistakes

  • Banning AI without offering an alternative. Staff then keep using it secretly with personal accounts.
  • Sending AI-written text to customers without checking it. Models sometimes give answers that sound convincing and are still wrong.
  • Giving an AI agent that reads email or opens files full rights, with no human approving important actions.

Official sources

Read next

All topics in the checklist