A platform or tool can be secure and still be the wrong place for the information you’re about to give it. Annabel Kaye, a specialist in contracts and data privacy for small businesses, explains what to ask before you click ‘Connect’.
Tech platforms and AI tools are creeping into almost everything we use at work. They can summarise meetings, search emails, analyse spreadsheets, draft documents – and connect to calendars, cloud storage and other business systems. For a busy EA, that can save a lot of time.
Before you click another tempting ‘Connect’ button, though, there’s a question worth asking. Not simply “Is this tool secure?” but “Is it appropriate to use this tool with the information I have?” They aren’t the same thing.
Secure doesn’t necessarily mean suitable
Ask a software supplier whether their platform is secure and they’ll probably tell you about encryption, access controls, certifications and where their servers are hosted.
Those things matter, but they can’t tell you why your organisation collected the information you’re about to give their AI, or whether you’re entitled to use it for something different.
Imagine your organisation holds payroll and absence information. There may be perfectly good reasons for collecting it. Someone then has the bright idea of using AI to analyse absence patterns, pay grades or carer’s leave.
The AI platform may be technically secure – but that doesn’t automatically mean you can use the information for that new purpose. Your organisation’s policies, contracts and privacy obligations may all have something to say about it.
Then think about what information you just sent. Health information is generally treated as sensitive information under privacy law. You might also be handling financial information, information about children, board papers, contracts or confidential correspondence.
It was sitting inside your organisation’s approved systems but where is it now? How long will it stay there, who else can access it, has its hosting location changed and does the provider use your information to improve its services? A security badge can’t answer all of those questions.
Think about what you connect, not just what you upload
Tech is moving beyond the information we deliberately type or upload. Connect an AI tool to Outlook, Google Workspace, Slack or cloud storage and it may be able to see considerably more, which makes permissions important too.
Before the shiny new tool becomes part of everybody’s working day, ask:
- Who in your organisation is allowed to connect a new application?
- What access does it inherit?
- Could somebody connect a tool without the people responsible for IT or privacy knowing about it?
In a large organisation, you may have IT, information security, legal and a privacy officer to help answer these queries. So, your job isn’t to become an expert in all of those areas. It’s to recognise when you need to ask.
In a smaller organisation, you may be the EA, PA and office manager rolled into one. You may be the person choosing the software, setting permissions and deciding what gets connected, with nobody down the corridor to ask.
Either way, “the platform is secure” isn’t the end of the conversation. Before you connect your tech to business information or systems, remember three words.
- Check what the tool will see and what information you’re proposing to give it.
- Consider whether this use of this information is appropriate and whether you have the authority to make that decision.
- Connect – but only then.
AI can save you hours, but “it’s secure” is only one part of the answer.
