Bringing AI into a business safely: data, permissions and output control

Employees often use AI before the company has a rule. Customer data, contracts or source code can then pass through tools nobody in the company can see.

This article covers bringing AI into a business at the governance level. Sources are NIST and OWASP, the privacy pages of 4 AI providers, and Vietnamese law read through reprinted copies, checked up to October 21, 2026.

Click Star already has articles on analyzing data with AI, prompt injection, RAG, MCP, AI agents and chatbots. This one places them in a common framework.

Key points

• AI governance starts with knowing which tools employees use with which data; NIST AI RMF 1.0 puts the AI inventory under Govern.
• Click Star's reference framework has 5 gates: data classification, approved tools, least privilege and logs, output reviewers, incident handling and training. It is Click Star's proposal, not from an outside source.
• On official pages read October 21, 2026, Anthropic, Microsoft, Google and OpenAI's API docs say business or API plans do not train on customer data by default; consumer plans differ.
• A provider's certification does not replace the company's own control over data, access and outputs.
• Vietnam's AI Law 134/2025/QH15 (effective March 1, 2026) sets the principle that humans keep control.

Why governance must come before rollout

In the 2024 Work Trend Index from Microsoft and LinkedIn (May 8, 2024, 31,000 people in 31 countries), 78% of AI users bring their own tools to work, which Microsoft says puts company data at risk. The figure is self-reported, global.

Varonis's summary of IBM's Cost of a Data Breach 2026 report (secondary, not checked against the original) says shadow AI appeared in 43% of the organizations in the sample, up from 20% a year earlier. The sample is 602 breached organizations, so it does not represent all businesses. Shadow AI means AI tools the company has not approved or does not know about.

For Vietnam, Microsoft's 2026 Work Trend Index (June 24, 2026, 2,000 knowledge workers) says 48% of AI users see clear leadership direction on AI, against 26% globally, with no BYOAI figure.

4 reference frameworks

NIST AI RMF 1.0 (January 26, 2023, voluntary) has 4 functions: Govern, Map, Measure and Manage; the original says Govern runs through the others. GOVERN 1.6 calls for an AI system inventory.

NIST AI 600-1 (July 26, 2024) is the generative AI profile with 12 risks, including confabulation, data privacy and information security. It suggests an acceptable use policy, a plan to halt deployment and incident response.

ISO/IEC 42001:2023 is the AI management system standard (the iso.org page blocked Click Star's tool). Microsoft Learn says customers must still assess their own implementation.

The OWASP Top 10 for LLM Applications 2025 has 10 entries. This article uses the 3 Click Star read: LLM02 sensitive information disclosure, LLM05 improper output handling, LLM06 excessive agency.

Gate 1: data classification and the permission matrix

Click Star's reference framework (not from an outside source) has 4 data levels, extending the green, yellow, red split in its article on analyzing data with AI.

• Public: any tool type, with a person still reviewing the output.
• Internal: only approved business accounts, controlled gateways or private infrastructure.
• Business-sensitive (contracts, source code): only after the terms are checked and a person approves.
• Personal data: never in personal accounts; external tools only get de-identified data or data cleared by a legal assessment.

Tools fall into 4 types: personal or free accounts, approved business accounts, a controlled gateway or API, and private-infrastructure models. Decree 356/2025/NĐ-CP (reprint) lists sensitive data such as health, biometrics, location, bank accounts.

Gate 2: an AI use policy and shadow AI

A short policy (NIST AI 600-1 suggests one) should answer: which tools are allowed and who approves; which data level goes into which tool; which work needs human review; how to request an exception; how to self-report wrongly entered data.

Click Star's view: a total ban usually pushes use somewhere harder to see, while approved tools plus a fast exception path last longer. This is an opinion; no Vietnamese study measures it.

Vendor checklist: what the official pages say

As read on October 21, 2026; terms can change, so match your plan.

• Anthropic (privacy page, August 18, 2026): commercial products do not train on data by default, except feedback or opt-in; the API deletes server-side data within 30 days. Certification page (March 16, 2026): ISO 27001:2022, ISO/IEC 42001:2023, SOC 2.
• OpenAI (API data guide): no training unless the customer opts in; abuse-monitoring logs kept up to 30 days; the regional storage list has Singapore, Japan, the US and Europe, not Vietnam.
• Microsoft (Copilot page, updated October 8, 2026): prompts and responses are not used to train foundation models; retention is set through Purview. Certifications listed include ISO 27001 and ISO 42001.
• Google Workspace (October 6, 2026): customer data is not used for training without permission. Gemini in Workspace lists SOC 1/2/3 and ISO/IEC 27001, 42001; no data regions described.

Consumer plans differ: per Anthropic's Claude Code docs, Free, Pro and Max users choose whether to allow training, with 5-year retention if yes and 30 days if no. openai.com/business-data blocked Click Star's tool (error 403), so ChatGPT Business and Enterprise defaults and OpenAI certifications are not stated.

7 questions for every provider: which plans train on data; retention and any no-retention mode; storage region and sub-processors; certifications and scope; admin logs; how deletion works; the data processing agreement.

Gate 3: permissions and logs

AI should not read more than the person using it. The Microsoft and Google pages say Copilot and Gemini only show data the user already has access to. Broad shared folders let AI expose data faster, so clean up permissions first.

OWASP LLM06 names 3 root causes: too much functionality, permission and autonomy. Mitigations: minimal tools and permissions, human approval for high-impact actions, authorization checks downstream. Logging limits damage but does not prevent it.

Logs should record who used which tool, which data level, when and who approved, without sensitive content. Decree 356/2025/NĐ-CP (reprint), Article 4(2), requires rules limiting access to sensitive data.

Gate 4: output control and reviewers

NIST AI 600-1 describes confabulation as false content presented confidently, and automation bias as a tendency to over-trust AI. When output flows into other systems, OWASP LLM05 says to treat it as untrusted data and check it before use.

Click Star's 3 review levels (not from an outside source):

• Level 1, internal use: drafts and summaries for yourself; self-check.
• Level 2, sent outside: customer emails, quotes, published content; a qualified person reviews first.
• Level 3, consequential actions: editing data, automatic sending, payments; an explicit human approver.

AI Law 134/2025/QH15 (reprint), Article 4, clause 2, says AI does not replace human authority and responsibility, and human ability to intervene must be kept.

Gate 5: incident handling and training

AI Law Article 12, clause 2 (reprint) says deployers and users must record and promptly report serious incidents. Click Star's 5-step reference process:

1. Stop: switch off the tool or revoke keys, keep the logs.
2. Define scope: data level, number of people or records, tool.
3. Notify internally and the provider.
4. Assess legal duties with a qualified person.
5. Fix and record the lesson in the matrix.

For personal data, a Law 91/2025/QH15 briefing on tgu.edu.vn (secondary) gives at most 72 hours from discovery to notify the specialized authority of a reportable violation.

On training, Decree 356/2025/NĐ-CP (reprint), Article 9, clause 2, requires periodic staff training when processing big data. Teach the 4 data levels, real examples, output review and reporting.

Vietnamese law: what was read

thuvienphapluat.vn blocked Click Star's tool. The points below come from reprinted copies, not the official portal, and are not legal advice.

• Law 91/2025/QH15 (effective January 1, 2026, hoatieu.vn copy to Article 17): processing personal data includes collecting, analyzing, de-identifying and providing it (Article 2). In Click Star's reading, entering personal data into an AI tool falls under this.
• Decree 356/2025/NĐ-CP (effective January 1, 2026, ketoananpha.vn copy): Article 10 requires telling the data subject about automated processing and giving the right not to take part when data is used for AI.
• AI Law 134/2025/QH15 (effective March 1, 2026, luatvietnam.vn copy): a deployer is an organization using AI in professional or commercial activity (Article 3). Article 7, clause 3 bans processing data for AI in breach of personal data law.
• Article 35: systems running before March 1, 2026 have 12 months to comply (18 months for health, education, finance), about March 1, 2027 by Click Star's calculation.

Staged rollout and the conditions to move on

Click Star reference framework, not from an outside source, with no numeric thresholds because no sourced threshold was found.

• Stage 1, pilot: a very small group, public or internal data; enter with a tool list, an owner and the matrix.
• Move to stage 2 when no wrong-data case is unhandled and the logs match the matrix.
• Stage 2, small group: 1 department, role-based permissions; enter once output review levels exist.
• Move to stage 3 when an incident drill has run once and the share of outputs edited or rejected is tracked.
• Stage 3, expansion: whole company, training before access; revisit when provider, model or terms change.

How to measure

No sourced standard threshold exists, so these are trend indicators: tools found outside the inventory; matrix violations in logs; share of outputs edited or rejected; time from detection to shutdown in a drill; share of staff trained.

Click Star's view. The hard part is discipline over data and access, not choosing a model. Models and terms change fast; the 5 gates change little. This is a technical opinion, not a measurement.

Click Star offers an AI integration service (chatbots, data analysis, automation), so it has an interest here. The framework can be applied without it.

A 4-week plan to reach the pilot stage

• Week 1: inventory AI tools, account types and data types per team; name an owner.
• Week 2: classify data into 4 levels, write a short policy and the matrix.
• Week 3: choose approved tools, read terms against the question list, clean up permissions.
• Week 4: run the pilot, train staff, drill 1 incident, set a review date.

Common mistakes

1. Choosing tools first and classifying data later.
2. Banning everything without providing a replacement tool.
3. Treating a provider's certification as a guarantee.
4. Not distinguishing consumer from business accounts.
5. Enabling AI over a document store with broad permissions.
6. Letting AI take consequential actions unapproved.
7. Never drilling the incident process.

What is not known

There is no Vietnam measurement of employees using AI outside company control or of data leaks through AI. IBM figures were read through Varonis. Terms change fast; the Google page has mismatched dates (October 6 at the top, October 20, 2026 in the footer).

OpenAI's business page, the ISO page and thuvienphapluat.vn blocked Click Star's tool and were not read, nor was Decree 142/2026/NĐ-CP (guiding the AI Law). It is unclear how regulators will apply the AI Law to foreign providers' tools, and there is no standard retention period for AI logs.