We do not use AI
What really happensUse often does not disappear. It moves to personal phones and home networks, where the company neither sees nor controls it.
The risk you do not see
While the company decides whether to adopt it, your employees are probably using it already
1 in 3
EU workers already use AI tools in their work: 30%.
Source: JRC, the Joint Research Centre of the European Commission, AIM-WORK survey 2024-2025 of over 70,000 workers, news item of 21/10/2025.78%
of AI users at work use tools their company did not provide.
Source: Microsoft and LinkedIn, Work Trend Index, 08/05/2024, global survey. Microsoft also sells AI tools.39.7%
of interactions with AI tools contain sensitive data.
Data from a security vendor: Cyberhaven, 2026 AI Adoption & Risk Report, 05/02/2026, measured on its customer companies.The timing trap. Management takes months to decide how to protect the company's data. An employee needs one afternoon to open an AI chat the company has neither chosen nor controls, and most people who use AI at work already do so with their own tools. From that moment, part of your function's data can travel on services that do not answer to you.
We have blocked company access
What really happensThe block reduces use on company devices, but does not stop it. It moves it where you no longer have any indicator to measure it.
We have a strict policy
What really happensA rule that nobody verifies protects little. What the law looks at is whether the measures are adequate and applied, and a document in a drawer hardly proves that.
- Your employeepastes a contract, a technical specification, a customer's confidential terms
- A free chatwith a personal account, outside the company tools
- A third-party serverthat does not answer to you: the information has left your control
It has already happened. In May 2023 Samsung banned generative AI on company computers, phones and networks, after some engineers had uploaded confidential code to a chat (Bloomberg, 02/05/2023).
Three sentences that reassure management, but on their own do not protect.The briefing document tells you what really happens beneath each one. 6 pages, free, by email.
Bring the problem into focus in your area The law, not an opinion
What the law says
This summary does not constitute legal advice. Assessing compliance is the task of your company's legal counsel and data protection officer.
The responsibility for preventing the employee's mistake lies with the company.
- The trade secret
It is protected only if subject to measures reasonably adequate to keep it secret.
RISKWithout a rule, confidential information pasted into a chat risks losing its protection.
Trade Secrets Directive (EU) 2016/943, art. 2 → - AI literacy
A company that uses AI in its business must take measures to prepare its staff to use it. It need not guarantee a specific level, but without documented measures it is hard to show that it took them.
OBLIGATIONIn force since 27/07/2026. Any penalties are set by each Member State.
AI Act, art. 4, as amended by Reg. 2026/1744 → - Personal data
Security measures appropriate to the risk, breaches notified within 72 hours where feasible, and processors with «sufficient guarantees» for the tools the company adopts.
RISKFines up to 10 million euros or 2% of worldwide annual turnover, and up to 20 million or 4% for breaches of the principles.
GDPR, arts. 5, 28, 32, 33, 83 →
Every rule asks for concrete measures, and if challenged what counts is being able to prove them.The ten questions of the briefing bring into focus where your function may be exposed.
Bring the problem into focus in your area The briefing
What you find in the briefing
- Ten questions to bring the problem into focusWho uses AI in your function, with which tools, on which data and under which rules. The questions give no ready-made answers: they show you where to start.
- What you risk if nobody actsFor your function and for those you exchange data with: the loss of trade-secret protection (EU Trade Secrets Directive 2016/943), GDPR fines and unmet AI Act obligations.
The briefing document.Ten questions, 3 minutes, and you have brought the problem into focus. Free, it arrives by email immediately after confirmation.
Bring the problem into focus in your area The questions
10 questions to bring the problem into focus
A preview of three of the ten questions you will find in the briefing, one per area.
Management and Legal
Which uses of AI does the AI policy in force in your function allow, which does it prohibit, and where is it published?
Marketing and Sales
Which training paths, methods and tools, meaning licences and internal infrastructure, are you providing to your teams, so that they need not secretly turn to public AI platforms to speed up their work?
Operations and R&D
Which activities in your function have cut their lead times thanks to AI, and with which indicator (KPI: the number by which a function's performance is judged) do you measure it?
How I work
I redesign the marketing and sales processes that AI enters. I update policies and everyday rules of use together with the teams. I choose tools with the right terms on data and train people to use them. I work in concert with the departments and in consultation with the Legal and DPO (Data Protection Officer: the person responsible for data protection) functions, so that the rules are correct on paper and workable in everyday work.
Inside every gap there is a signal. Where an employee has worked around a process, there is a flow to redesign, time to recover, a margin to defend.
Your consultant
Enrico Giubertoni
Performance Systems Architect™
Enrico Giubertoni is a revenue systems designer, management consultant and keynote speaker. He is the author of five publications on digital marketing and more than 310 articles, and since 2006 he has run one of the longest-running strategy blogs in Europe.
Read more
As a Performance Systems Architect™, since 1998 he has been decoding digital signals for revenue governance and Signal Intelligence™ (reading latent buying signals) in B2B companies. His work identifies Analytical Inertia (the data a company owns but does not turn into decisions) within business units and turns it into Financial Velocity, the speed at which a company generates value.
Receive the briefing document and bring the problem into focus in your function
- See where your function may be exposed.
- Know what you risk if nobody acts.
- Free PDF, by email right after confirmation.
Receive the briefing document
Check your inbox
I have sent you an email with a link to click. Until you click it I subscribe you to nothing, and that is deliberate: it is how I can prove that you were the one who asked.
Not there in a few minutes? Look in your spam folder or in the Promotions tab.
If you want to discuss it before reading, an informal ten-minute exploratory conversation: write to me.