Service · Cybersecurity

Safe use of AI

Generative AI walked into most offices through the back door. Across Slovenia, employees are pasting offers, client correspondence and draft agreements into free chat assistants signed in with private accounts. Picture a Kranj architecture practice. One architect pastes a competition brief into a free chatbot for a summary, another uploads the customer list elsewhere to sort it, and the founder knows nothing about either. Free versions often leave unclear whether what you type feeds model training, where they are kept and how long. Prohibition fails too, because use simply moves to personal phones. Whenever personal data is included, GDPR applies, and Informacijski pooblaščenec has issued guidance on artificial intelligence. Companies in the EU must also reckon with the AI Act, which among other things expects people using AI at work to understand the tools in front of them. We are not here to put the brakes on. Our goal is keeping customer and business information where it should be, through an approved assistant, one page of rules and brief training.

Business terms
what you type stays out of model training
Single page
of ground rules anyone can follow
Shadow AI
surfaced instead of overlooked
Attendance log
who completed training, and when

Scope of the service

We want AI to speed your team up, while client and business information stays inside boundaries you control.

Check the scope with an engineer

Discovering actual use

Login data, web traffic statistics and a quick anonymous poll reveal which AI services are really in play, without anyone being blamed.

Selecting an assistant

Microsoft 365 Copilot, Copilot Chat under a work login, or ChatGPT and Gemini on company plans, assessed on contract terms, data residency, training policy and cost, ending in a clear recommendation.

Fixing permissions first

Copilot reveals whatever its user already has permission to see. Salary spreadsheets or management papers accidentally shared company-wide are corrected before switch-on.

Ground rules

One concise page: approved tools, data that must never go in (personal data, customer confidential material, credentials), how to sanity-check answers and where to take questions.

Guardrails

Unapproved AI websites are blocked or show a caution message, and DLP stops classified content going into chat tools.

Training with a record

A short video module on sensible use, typical pitfalls and data protection, with completion logged, which also supports the AI literacy expected under the AI Act.

How the work runs

A few weeks is enough to move from scattered, unofficial use to a managed set-up people actually like.

01

Snapshot

We list which tools are in use and where they really save effort, such as drafting quotes and emails, condensing documents or translating.

02

Choice

One or two sanctioned assistants selected, contract and processing terms reviewed, and material gathered for counsel's GDPR review.

03

Go-live

Licences, configuration, guardrails and ground rules, then training for the whole team.

04

Adjustment

A review a few weeks later, tweaks to the rules and new use cases added where they make sense.

Forbidding AI only makes it invisible. People will not give up something that saves real time; they simply switch to a private device. An approved assistant with clear guidance reduces exposure and still delivers the productivity gains.

Your questions answered

The AI Act is an EU-wide regulation, and what it asks of you depends on how you use AI. GDPR covers any personal data, and the Information Commissioner has published guidance on AI. Your lawyer can advise on your particular circumstances; we handle the technical and organisational work.

On business plans, the provider commits contractually not to train on your prompts, and you gain central administration, user control and usually retention settings. Personal and free accounts offer none of that, or leave it to individual users. With client information in play, that gap is significant.

Permissions. Copilot will happily summarise anything a person can technically open, so a pay spreadsheet shared too widely becomes one prompt away from the whole company. Clean up file sharing, introduce sensitivity labels and start small with pilot users.

No. Guardrails recognise particular content, such as an EMŠO or a file marked confidential, and stop it reaching unsanctioned services; nobody reads conversations. Who sees alerts is agreed beforehand, and staff should be told openly how it all works.

AI at work, minus the data headaches

Tell us what AI your staff already use and which office suite you have; we will suggest where to begin.

When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome

We set essential cookies only: the ones that keep the site running and recall which town you chose. Nothing for ads and nothing that follows you around the web. Details are in our privacy and data protection notice.