Artificial intelligence (AI) is already inside your organization, through more paths than leadership has formally discussed, and so the useful question is no longer whether to adopt it, but where it is used, with what data, with how much autonomy, and under what governance. The advantage does not come from using AI, but from using it in the right process and with the right technique; and as AI moves from recommending to acting, what is being delegated stops being merely technology and becomes authority, with risks that grow with its autonomy and with the impact of what it does. Governing those risks first requires having information security in order, because AI frameworks are built on that foundation, and answering with evidence, not promises, the security, confidentiality, and privacy questions that are already arriving from customers, employees, and regulators. In Chile, the broadest obligation is Law 21.719 on personal data, which takes effect on December 1, 2026, although a Government bill seeks to postpone it by one year; the AI bill is still moving through Congress. For the organization that has not yet started, the guide proposes a 90-day plan: in the first month, find out where AI is being used, move sensitive work to enterprise accounts, define which data is never entered, and name an owner; over the following two months, approve a usage policy, adopt a governance framework, implement the controls, and train the organization's people. This guide walks that path from the basics to the specifics, with familiar examples ranging from the first voice dictation programs to ChatGPT and DeepSeek, and closes with four reference annexes: security, confidentiality, and privacy questions (Annex A), a checklist for buying or building (Annex B), how to move from isolated initiatives to a program (Annex C), and a glossary (Annex D).
These three ideas rest on four dimensions that recur throughout the document, not as a sequence, but as cross-cutting questions worth asking again at every stage: Value · Technique · Autonomy · Governance.
The document's reading path is different, and it is explained below.
This guide does not aim to turn an executive or board member into an artificial intelligence specialist. It aims to give them enough judgment to tell a real opportunity from a fad, understand what authority is being delegated, identify the relevant risks, and ask the right questions before approving an initiative. To that end, the document moves through six stages, each building on the previous one. Each concept appears first in simple terms, with an everyday example or a real case, and then with the detail an executive needs in order to decide.
The six blocks are the reading path: they go from understanding what AI is to deciding how to scale it, and each one builds on the previous one. Each block has its own color, which is repeated on its cover page, in the headings, and in the tables of its sections.
Above the title of each section there is a label showing the dimension it answers: Value, Technique, Autonomy, or Governance. These are the four questions worth asking again at every stage of an initiative, and they also work as a thematic index: the executive summary map groups the sections by dimension, for readers who want to read, for example, only what has to do with delegating autonomy to AI.
Quick-reference tools, gathered at the end in the Annexes section: Annex A. Security, confidentiality, and privacy questions, and how to answer them · Annex B. Checklist for buying or building · Annex C. From initiative to program · Annex D. Essential glossary
| If you need to | Read |
|---|---|
| The essentials, in a single sitting | Executive summary; sections 1, 3, 7, 9, 12, and 18; closing |
| Answer a privacy or confidentiality question | Sections 8 and 15; risks 2 and 6 in section 9; Annex A, levels 1 and 3 |
| Answer a security question | Sections 9, 10, and 11; Annex A, level 2 |
| Evaluate whether an initiative is worthwhile | Sections 4, 5, and 6 |
| Approve, buy, or build a solution | Sections 7, 16, and 17; Annex B |
| Organize AI governance | Sections 10 (usage policy and incidents), 12, 13, and 14; Annex C |
| Start putting AI in order across the organization | Section 18; section 12 (what to report to the board) |
| Adopt AI safely: regularize, educate, and demonstrate | Sections 8, 10, and 18; Annex A, levels 4 and 5 |
| Govern AI agents | Section 7; section 9, risks 3 and 4; section 12; Annex A, questions 14 and 15; Annex B |
AI is entering companies through many paths at once: corporate tools; copilots (AI assistants built into software already in use, such as email or the spreadsheet); applications contracted over the internet (SaaS, software as a service) that add AI without anyone explicitly asking for it; in-house developments; vendors that add it to their offering; agents (systems that, besides answering, carry out actions on their own; they are explained in section 2); direct connections between systems (APIs, application programming interfaces); tools that individual employees adopt on their own; voice assistants on phones and in offices; and tools that record and summarize meetings. That is why the board-level discussion has already changed shape:
Put simply, artificial intelligence is any system that does something we normally associate with human intelligence: recognizing a face, recommending a movie, detecting fraud, translating or drafting a text. There are different types, and it helps to arrange them as concentric rings.
These four levels do not compete with one another: they contain one another, and each inner ring is a subset of the ring that surrounds it. None replaces the one before.
The fact that generative AI has been in fashion since the public launch of ChatGPT in late 2022, and that other assistants, such as Claude or Gemini, extended it afterward, does not mean artificial intelligence began there. A good part of what is now called "AI" has been operating inside companies for decades, generally without that name.
Rules engines in insurance and banking, diagnostic systems built from rules written by experts.
Card fraud detection, spam filters, predictive maintenance, e-commerce recommendations, credit risk scoring, optical character recognition (OCR).
Image and speech recognition at scale, modern machine translation, video and music recommendation systems.
Generation of text, images, audio, video, and code from natural-language instructions.
Your organization has probably been using one of the first three categories for years without calling it "artificial intelligence" in its internal language. What was new in 2022 was not AI: it was that, for the first time, a generative AI became available in a conversational interface open to the general public.
The history of AI is best understood through six public milestones, in chronological order. Each one illustrates one of the rings in the diagram above, and each leaves a lesson that is useful to an executive.
In March 1990, Dragon Systems launched DragonDictate, presented as the first "voice typewriter." It cost about USD 9,000, including a special card for the computer, and recognized a vocabulary of 30,000 words, with one condition: you had to pause for at least a quarter of a second between... each... word.
Lesson: what looks clumsy and expensive today can become everyday. Three decades later, dictating to your phone, talking to a voice assistant, or receiving the automatic transcript of a meeting is free and barely noticeable. When evaluating an AI technology, it pays to look at the trend, not just today's snapshot.
IBM's Deep Blue supercomputer defeated world champion Garry Kasparov 3.5 to 2.5. It did not "learn" the way today's AI does: its strength came from calculating some 200 million positions per second, using evaluation criteria that its team of experts tuned by hand.
Lesson: a machine can surpass the best person in the world at a very narrow task without "understanding" anything outside it. Deep Blue only knew how to play chess.
IBM's Watson system won the television quiz show Jeopardy! against two of its most successful champions. It had to understand natural-language questions full of wordplay and answer within seconds. Its most remembered mistake is also the most instructive: in the category "U.S. Cities" it answered "Toronto," which is in Canada. But it did so with question marks, because its confidence was low (around 30%), and it wagered only USD 947.
Lesson: AI can be wrong with fluency. Watson at least showed how sure it was; many of today's assistants use the same tone when they are right and when they make things up. Its later move into medicine left another lesson, told in section 6.
DeepMind's (Google) AlphaGo beat South Korean champion Lee Sedol 4 to 1 at Go, a game with so many possible combinations that it cannot be won by calculation alone. AlphaGo learned from millions of moves from human games and from games against itself. In the second game it played "move 37," which experts considered something no human player would have done.
Lesson: AI that learns from data can find solutions that had occurred to no one, but it also has blind spots: Lee Sedol won the fourth game with a move that AlphaGo considered highly improbable.
On November 30, 2022, OpenAI opened ChatGPT to the public. In about two months it reached nearly 100 million users, according to a UBS estimate cited by Reuters: the fastest adoption recorded until then for a consumer application. For the first time, anyone could converse with an AI that drafts, summarizes, translates, and writes code.
Lesson: unlike the earlier cases, this AI was not bought by the company: it came in on its own, in the hands of each employee. That is where the shadow AI of section 1 comes from, and where most of the confidentiality questions in Annex A come from.
In January 2025, the Chinese company DeepSeek released R1, an open-weights "reasoning" model (its maker publishes the trained model so that anyone can install and run it), comparable to OpenAI's o1. R1 was built on V3, a base model from the same company whose final training run DeepSeek estimated at about USD 5.6 million in computing, a fraction of the usual cost; the additional R1 stage added, according to the company, about USD 294,000. Neither figure includes prior research or experiments, and neither was independently verified. Its app overtook ChatGPT as the most downloaded AI app on Apple's App Store, and on January 27 Nvidia lost nearly USD 589 billion in market value, the largest single-day loss ever recorded by a U.S. company. Three days later, the Italian data protection authority blocked the app, finding insufficient the information on how it handled personal data.
Lesson: the AI frontier no longer belongs to a single country or a few companies, and its cost is falling fast. But a brilliant, cheap tool is not, for that reason, an approved tool: before using it with company data, you need to know where the data is processed and under what law (sections 8 and 15; Annex A, question 6).
Before discussing risks, it is worth noticing that AI is already part of daily life, almost always without being called that:
| Everyday situation | What the AI does | Type (ring) |
|---|---|---|
| Your email separates out spam | It learned to recognize the patterns of unwanted messages | Machine learning |
| Your bank alerts you to a suspicious purchase | It detects a purchase that does not fit your usual behavior | Machine learning |
| Waze or Google Maps estimate how long the trip will take | It projects traffic from historical and real-time data | Machine learning |
| Netflix or Spotify recommend what to watch or listen to | It compares your tastes with those of millions of similar people | Machine learning and deep learning |
| Your phone unlocks with your face | It recognizes faces from images | Deep learning |
| You search "beach" in your photos and they all appear | It recognizes the content of each image | Deep learning |
| You dictate a message to your phone or talk to Siri or Alexa | It converts voice to text and interprets what was asked | Deep learning |
| You ask ChatGPT, Claude, or Gemini to draft an email | It generates new text from an instruction | Generative AI (LLM) |
The practical difference between the rows: in the first seven, the AI does a single narrow task inside a product that someone designed and controls. In the last one, the person hands the AI information and an open-ended instruction. That is where this guide's questions of confidentiality, accuracy, and accountability begin.
Within the generative AI ring in the diagram above, language models (LLMs) are the best-known case, but not the only one. The same generative family includes models specialized in other types of content:
An agent is not a fifth, smaller ring inside generative AI. It is a way of using a model, almost always an LLM, by connecting it to tools, memory, and the ability to carry out steps on its own. That is why it is drawn as a branch extending outward from the circle, not as a more specific level inside it.
Put simply: a language model is like an expert who can only converse. An agent is that same expert with access to your email, your calendar, and the company's systems, and with permission to do things in them.
That a system can respond does not mean it should act on its own. Section 7 develops the different levels of autonomy and why this difference is critical for a board.
Before turning to which technique to use for which problem, it is worth setting an honest starting point on current capabilities.
| AI is usually good at | AI can still be weak at |
|---|---|
| Summarizing large volumes of information | Guaranteeing absolute factual accuracy |
| Finding patterns in data | Demonstrating causality, not just correlation |
| Generating alternatives and drafts | Taking responsibility for a decision |
| Interacting in natural language | Always distinguishing true information from plausible information |
| Automating repetitive tasks | Handling all exceptions correctly |
| Analyzing large amounts of data | Fully understanding the business context |
| Executing defined workflows | Deciding what business risk an organization should accept |
Understanding what AI is does not yet determine where to use it. The next question is which technique truly fits the problem, and whether the value it generates justifies doing it.
This section applies the guide's central idea: first the problem, then the technique.
| Family | What it is | What it is for | Example tools |
|---|---|---|---|
| Rules and business logic | Explicit instructions: if this happens, do that. Deterministic (the same input always gives the same result) and auditable | Validations, transformations with known logic | Excel formulas and macros, Power Automate, Zapier, rules engines such as IBM ODM |
| Classical supervised learning | A model learns from already labeled examples to classify or predict a value | Classification, prioritization, risk scoring | Amazon SageMaker, Azure Machine Learning, Google Vertex AI, DataRobot, scikit-learn |
| Unsupervised learning | Finds patterns, groupings, or deviations in data without previously labeled examples | Fraud or anomaly detection, customer segmentation, clustering | scikit-learn; anomaly detection in Splunk, Datadog, or Microsoft Sentinel |
| Time series | Projects a future value from its history | Forecasting of demand, sales, and indicators | Excel's forecast sheet, forecasting in Power BI, Prophet, SAP IBP |
| Mathematical optimization | Finds the best combination of variables under constraints | Planning, resource allocation | Excel Solver, Gurobi, IBM CPLEX, Google OR-Tools |
| Language models (LLMs) | They interpret and generate natural language. They are not deterministic: the same question can produce different answers | Interpreting open-ended questions, drafting, summarizing | ChatGPT, Claude, Gemini, Microsoft Copilot, Llama, DeepSeek |
| Agents (LLM plus tools) | An LLM that also executes actions and chains steps together on its own | Automating multi-step tasks, with more risk than the previous ones | ChatGPT agent mode, Claude Code, Microsoft Copilot Studio, Salesforce Agentforce, Gemini Enterprise |
| Question | What it may indicate |
|---|---|
| Do I need a deterministic answer? | Rules or optimization |
| Do I have enough historical data? | Classical machine learning |
| Do I need to interpret natural language? | Language model |
| Do I need to execute actions in other systems? | Agent |
| Does an error have a high impact? | More oversight, whatever the technique |
| Do I need to be able to explain the result? | Interpretable models, not necessarily the newest |
| Is the query volume very high? | Cost and architecture begin to matter as much as the technique |
| Can the data leave the organization? | Directly affects the architecture and the choice of vendor |
| Can the action be reversed? | Affects how much autonomy is reasonable to allow |
At ELIAC 2026, the Latin American conference on AI applied to cybersecurity organized by iSecurity, Chile's National Center for Artificial Intelligence (CENIA) presented three projects of its own. Its thesis in the talk: AI is not a synonym for language models; the technique is chosen for the problem, not for fashion.
| Case | Problem | Technique used |
|---|---|---|
| Cámara Chilena de la Construcción (Chilean Chamber of Construction) | Pre-reviewing building permit applications and detecting noncompliance before submitting them to the municipality | Agentic workflow (here generative AI and agents did fit) |
| Fiscalía (Public Prosecutor's Office) | Classifying cases by urgency and course of action | Classical classifier, no language model |
| CMPC | Optimizing production with several chained models | Chain of optimization models (pipeline), also no language model |
The right criterion is not "does the AI work?" It is "does it generate enough value to justify its cost and its risk?" A board should not first ask whether a solution is bought or built. It should first ask why this initiative should exist and what value it should generate; section 16 deals with how to obtain the solution, once the why is settled.
Example key performance indicators (KPIs), to be chosen according to the case: time saved, cost per transaction, automation rate, rate of human intervention required, accuracy, error rate, actual adoption by users, satisfaction, revenue increase, recorded incidents, cost per query, and return on investment.
Frequent causes: a poorly selected problem, a process poorly designed before being automated, technology chosen by fashion and not by fit to the problem, insufficient or poor-quality data, weak integration with existing systems, no clear owner of the process, users who do not adopt the tool, absence of controls, unrealistic expectations about what AI can do, underestimated operating cost, and a return that was never formally measured.
Once a case with value has been identified, the next question is how much decision-making and execution power we are willing to delegate.
As long as a model only responds to a query, the risk is the quality of the answer. An agent starts workflows, calls other systems, chains several steps, and decides what to do next without a person intervening at every step. "Agentic AI" is the term for precisely that capacity to act with autonomy toward a goal, not just answer.
| Autonomy level | What it does | Example | Example tools |
|---|---|---|---|
| Assistant | Responds or suggests. The person decides and executes everything | Drafting an email for someone to review | Microsoft 365 Copilot in Outlook, Gemini in Gmail |
| Supervised agent | Proposes a specific action and waits for approval before executing it | Classifying a tender and proposing a task, which a person approves | ChatGPT agent mode, which asks for confirmation before sensitive actions; Copilot Studio agents with an approval step |
| Autonomous agent | Executes the action without waiting for prior approval, within a margin that was defined for it | Responding to and closing low-value customer claims on its own, without prior review | Service agents such as Salesforce Agentforce or Intercom's Fin |
The autonomy level is not defined by the product's name ("assistant," "copilot," or "agent"), but by what the system can actually do: its capabilities, its permissions, and the approvals it requires. The same tool can operate at more than one level depending on how it is configured. And not every automatic action is AI: a fixed rule that blocks an account when certain patterns appear is traditional automation.
Classifying by autonomy alone is incomplete. A low-impact action executed autonomously is different from a high-impact one executed in the same way.
To understand where information can end up, it helps to separate the components involved: model, inference service (the service that runs the model every time it responds), application, storage, vendor, and logs. During a normal query, the model's weights (the parameters where what was learned in training is stored) are generally not modified by the prompt (the instruction or question that is typed in). But "the model does not retain the data" is not the whole story: the platform or service surrounding the model may retain, depending on the product, the architecture, the configuration, and the contract, the prompts, the outputs, files, logs, metadata, reasoning traces (the intermediate steps the model records), caches (temporary copies to respond faster), and information used for abuse detection.
The document or data as it arrived, before any AI processes it.
Not an AI surfaceWhat the model processes to answer this specific query. It normally does not modify the model's weights.
Does not persist, unless configured otherwiseDocuments converted into vectors (numerical representations that allow searching by meaning), indexed, and queryable in every response. This is where company data usually lives.
What the agent remembers between interactions: previous conversation, preferences, tasks in progress.
A record of every query, reasoning step, and task generated. The surface that almost no one declares clearly.
Persists if not managedThe same AI tool treats data very differently depending on the type of account or contract. It is the distinction that most helps in answering whether the AI "keeps" the information.
| Account type | Contract | What it usually implies for data |
|---|---|---|
| Personal, free or paid | Standard-form terms, non-negotiable | Whether conversations are used to improve the model depends on a setting that the user controls and that may come switched on. There is no data processing agreement with the company, and no one who answers to its customers. |
| Enterprise or team | Standard-form terms with commercial conditions | Normally excluded from training by default, with centralized administration and defined retention periods. Team plans can have different conditions from enterprise ones: it is worth reviewing them case by case. |
| API integration or corporate contract | Partly negotiable | Allows agreeing in writing on retention, data location, and, in some cases, zero retention (the provider does not keep the content). It is the level that gives the most room to commit to something concrete to the company's own customers. |
Conditions vary by provider and over time: what counts is what the current contract says, not the advertising.
The rule above does not apply only to conversational assistants. It also holds for the search engine, the browser, the phone's voice assistant, and the tools that record meetings: in all of them, the same brand treats data differently depending on whether it is used with a personal account or a company account.
| Tool | With a personal account | With a company account |
|---|---|---|
| Conversational assistants | ||
| ChatGPT (OpenAI) | On the Free, Plus, and Pro plans, conversations may be used for training by default. Each user can turn this off under Settings, Data Controls, the "Improve the model for everyone" option. | In ChatGPT Business, Enterprise, Edu, and the API, inputs and outputs are not used for training by default. |
| Claude (Anthropic) | On the Free, Pro, and Max plans, since October 2025 each user chooses whether to allow their conversations to be used for training. If allowed, they are kept for up to five years; if not, the period is 30 days. | On the Team and Enterprise plans, in Claude for Education and for Government, in the API, and in access through Amazon Bedrock or Google Cloud Vertex AI, the commercial terms apply, which do not include that use for training. |
| Gemini (Google) | With Gemini Apps Activity turned on, conversations are used to improve Google's services, including its AI models, and some are reviewed by people. Those reviewed conversations are kept for up to three years. With activity turned off, Google still stores them for 72 hours. | With a qualifying edition of Google Workspace, content is not reviewed by people or used to train models outside the company's domain without its permission. |
| Copilot (Microsoft) | With a personal Microsoft account, conversation activity may be used for training. It is turned off under Privacy, in the training options for text and voice conversations. | With a Microsoft 365 work or school account, the company's prompts, responses, and data are not used to train foundation models, and Microsoft acts as data processor under the contract. The web searches Copilot performs fall outside that regime: there Microsoft acts as an independent controller. |
| AI in the search engine and the browser | ||
| Google Search with AI (AI Overviews and AI Mode) | It uses the same models as Gemini, but it is a different product with different rules: what is typed into the search engine is governed by Google's general privacy policy and is stored in the account's activity if that option is on, not by the Gemini app's settings. Since July 2026, Google by default uses images, files, and audio from Search, Lens, and Gemini Live to improve its models, unless the user turns off the option to save that content. A search engine is not the place for confidential information, with or without AI. | |
| AI browsers (Chrome with Gemini, Edge with Copilot, ChatGPT Atlas, Perplexity's Comet) | They read the content of open pages, including internal applications or email, in order to summarize them or act on them using the user's session. With a personal account, that content falls under each provider's consumer rules. They are also especially vulnerable to instructions hidden in web pages (section 9, risk 3). | Some can be managed or blocked centrally. It is advisable for Technology to define which ones are allowed on company devices and for which sites. |
| Voice assistants | ||
| Siri, Alexa, and Google Assistant | They listen on the device itself to detect the wake word. Once they activate, on purpose or by mistake, what is said is sent to the provider's servers. There have been accidental activations that ended in lawsuits (Annex A, question 3). | On company phones, Technology can limit or disable the assistant. In rooms where confidential matters are discussed, the simple rule is to have no smart speakers. |
| Meeting recording and summarization | ||
| Meeting assistants (Copilot in Teams, Zoom AI Companion, Gemini in Meet, Otter, Fireflies, and similar) | External assistants that join the meeting as one more participant often operate with the personal account of whoever connected them: the recording, transcript, and summary end up in that provider's hands, sometimes without the other participants knowing. | Functions built into the meeting platform the company contracted fall under that contract's conditions. In both cases: prior notice to all participants and review of the summary before it is circulated (Annex A, question 9). |
Conditions as reported by each provider on its official pages, reviewed in October 2026. They change frequently: before making a decision, confirm them against the current contract.
RAG (retrieval-augmented generation) lets a model consult external company information while responding, without that information necessarily having been incorporated into the model's training. It is the difference between what the model "knows" out of the box and what it "looks up" at the moment of answering. Following the consultant example: RAG is handing them a folder of company documents to consult during the meeting; fine-tuning is sending them to a specialization course with those documents, and what they learned there can no longer be easily taken away.
Your organization probably already uses RAG without calling it that: NotebookLM, ChatGPT and Claude Projects, Microsoft 365 Copilot when it answers with SharePoint documents, or Gemini when it searches Google Drive. In all of these cases, the tool consults the documents in order to respond, and what defines the risk is who can see that folder and what type of account it is used with.
| Need | RAG | Fine-tuning |
|---|---|---|
| Consulting current documents | Very suitable | Not necessarily |
| The information changes frequently | Suitable | Less suitable |
| Changing the model's style or behavior | Limited | More suitable |
| Removing a source of information | Relatively manageable | More complex |
| Being able to cite the source of an answer | Generally better | Not necessarily |
Autonomy and data access change the risk surface. The next question is what can go wrong and how it is controlled.
Each risk is presented with what it is, an everyday example or a real case, and its controls.
An AI can produce content that is very convincing and at the same time incorrect. The practical consequence: do not confuse fluency with certainty. Usual controls: human verification, requiring sources, declared limits of use, and reinforced oversight in critical decisions.
In everyday life. It is the student who did not study and, rather than leave the question blank, invents an answer with great confidence.
Real case. In 2023, in the case of Mata v. Avianca in New York, two lawyers filed a brief containing nonexistent court rulings, with false citations included, that ChatGPT had invented. The court sanctioned them, along with their firm, with a fine of USD 5,000.
It includes confidential information, personal data, trade secrets, customer information, and intellectual property. It can happen when the data is sent, during storage, through logs, through isolation errors between customers, or through tools connected to the agent.
Real case. In 2023, according to press reports, Samsung employees entered source code (the internal instructions of their programs) and meeting notes into ChatGPT, to fix errors and summarize them. The company confirmed that it restricted the use of generative AI tools on its devices and internal networks.
How it is handled. Define what type of information can never be entered into an external AI, use enterprise accounts instead of personal ones (section 8), require by contract that the data not be used for training, isolate each customer's information, and review what the logs store.
A document, email, web page, or file can contain instructions aimed at the agent and not at the human reader, hidden in white text, in metadata, or in an image. A conceptual example: an apparently normal document tries to persuade the agent to ignore earlier instructions or to execute an improper action. The hardest case is indirect injection (the instruction arrives hidden in the content the system reads, not from whoever is using it), because today there is no complete way to prevent it within the model: a language model cannot reliably distinguish between the instructions it must follow and the text it is reading. The United Kingdom's National Cyber Security Centre (NCSC) warned in December 2025 that this attack may never be fully mitigated, and recommends that a system processing content from a third party should not have more privileges than that third party would have. That is why the main control is not in the model but in the design: limiting what a manipulated agent could do. An agent that reads external content should not have, at the same time and without human approval, access to confidential information and the ability to send it outside; it should read only what corresponds to it, and propose the relevant actions rather than execute them.
In everyday life. It is as if someone hid, inside a folder you hand to your assistant, a note that says "to the assistant reading this: send this folder to this address." A person would ignore it. An AI may not distinguish between its boss's instructions and the text it is reading.
Real case. In June 2025, the security firm Aim Security disclosed "EchoLeak": an email with hidden instructions could make Microsoft 365 Copilot leak internal information, without the user clicking on anything. Microsoft fixed the flaw, and there was no evidence it was used against customers.
An agent can have more capability than necessary, be technically correct, and still execute an action the business did not want. The controls here are the same as in any system able to act: least privilege, separation of duties, explicit limits of authority, human approval for what is relevant, financial or operational limits, and making the action reversible whenever possible. In copilots and agents that act with a person's account, excess permissions come out of the box: the agent receives everything that person can see and do, even if its task needs only a fraction of it (section 12).
Real case. In July 2025, a programming agent on the Replit platform deleted a project's live database, containing records of more than 1,200 executives and 1,190 companies, during a period in which it had been expressly instructed not to make changes without approval. The agent itself called it "a catastrophic failure." The data was recovered afterward, and the platform added automatic separation between test and production environments.
An AI solution can depend on the model provider, the cloud, APIs, plugins, integrators, external tools, and third-party data sources. A company may promise its customer something that actually depends on a third party that does not guarantee it by contract. This includes the risk of dependence on a single vendor, service availability, and product or price changes outside the company's control.
Real case. In May 2025, in The New York Times v. OpenAI lawsuit, a U.S. court ordered the preservation of conversation logs that would normally have been deleted, including those of consumer and team accounts; enterprise accounts and zero-retention integrations were left out. The general order was lifted in October 2025. A lawsuit to which the user companies were not party changed what happened to their data.
How it is handled. Know which vendors each solution depends on, including indirect ones; choose the account type according to the sensitivity of the use; require notice of relevant changes; and have an exit plan (section 16).
AI can create risk concerning personal data, copyright, use of information, transparency, automated decisions, discrimination, and sector-specific regulation. This guide does not replace legal advice: section 15 returns to the point in more detail.
Real case. In March 2023, the Italian data protection authority temporarily blocked ChatGPT. In December 2024 it fined OpenAI 15 million euros, among other reasons for using personal data for training without an adequate legal basis and for failing to notify a security breach. In March 2026, the Court of Rome annulled that fine on jurisdictional grounds: since OpenAI already had its European headquarters in Ireland, the case belonged to the Irish authority. The court did not rule on the merits.
How it is handled. Before using personal data with AI, confirm the legal basis and the purpose, use only the data that is necessary, review where it is processed, and allow a person to request human review of decisions made solely by an automated system that significantly affect them. In Chile, this gains force with the new personal data law (section 15).
It is common to mix up three conversations that are actually separate, and it is worth distinguishing them explicitly in any discussion with a vendor or an internal team.
The first of this section's three conversations, using AI securely day to day, is resolved in large part with a usage policy that anyone in the organization can read in ten minutes. It does not need fifty pages: it needs to answer four questions clearly, and to match what the company's technology actually allows.
| What it must answer | What it should say | Example |
|---|---|---|
| Which tools can I use? | The list of approved tools, with the type of account allowed for each, and how to request that a new one be evaluated | "For work involving company information, use only the enterprise account of the approved assistant; never a personal account" |
| What data do I never enter? | A short, concrete list, not an abstract definition of "sensitive information" | Personal data of customers or employees, information provided by a customer under confidentiality, passwords and credentials, source code, unpublished financial figures |
| When must a person review? | The cases in which an AI result cannot leave the organization or be used to decide without human review | Before sending it to a customer, publishing it, signing it, or using it in a decision about people or in a legal or financial matter |
| How do I report a mistake? | A single channel, a deadline, and the assurance that reporting on time is not penalized | "If you entered data you should not have, or the AI did something unexpected, notify the AI owner the same day" |
Sooner or later, something will go wrong: an employee enters a customer's information into a public tool, an agent executes the wrong action, an assistant gives a customer a false answer, or a manipulated document alters an analysis. Without a procedure written in advance, the first time is improvised, and improvised badly. The general procedure has five steps:
Annex A, question 10, applies this logic to the most frequent case: an employee who entered confidential information into a personal account.
There is also a kind of AI-specific incident that does not look like an incident: the system starts responding differently without anyone in the company having changed anything, because the provider updated the model. There are four controls for business continuity:
This section aims only to raise executive awareness. It is not a guide to attack techniques. Malicious actors can use AI to improve social engineering, phishing, content generation, translation, message personalization, target research, automation, code generation or modification, and the speed and scale of certain campaigns. There is no evidence that AI has replaced traditional attack techniques: what it mainly does is lower entry barriers, increase scale, and speed up the attacker's operation.
Controlling these risks requires more than technology: it requires authority, accountability, and clear rules.
AI governance does not mean creating bureaucracy. It means defining, by name, who can approve use cases, who owns the process, who owns the risk, what data can be used, which models and providers are permitted, what level of autonomy is authorized, which uses are prohibited, when human oversight is required, how performance is monitored, how incidents are reported, and when a solution must be retired.
| Governance question | Typical owner |
|---|---|
| Why are we doing this? | Business |
| Who owns the outcome? | Process owner |
| What risk do we accept? | Business / Risk |
| What data can it use? | Data / Privacy |
| How is it protected? | Security |
| Does it comply with regulation? | Legal / Compliance |
| How is it operated? | Technology |
| How is it overseen? | Governance / Audit |
The names of the functions are indicative (board, general management, process owner, Technology, Security, Data, Legal or Compliance, Risk, Audit): each company adapts them to its size and industry.
Before governing AI specifically, it is advisable to have general technology and information governance in order. An organization that does not manage its information risks well is unlikely to manage well the newer and less familiar risks of its AI systems.
It helps to distinguish two levels: general risk and security management frameworks, which apply to any organization that uses technology, and AI-specific frameworks, which have only begun to consolidate in recent years.
They are not mutually exclusive: many organizations use the NIST CSF as an internal assessment framework and ISO/IEC 27001 as the certified management system that underpins that assessment.
| Dimension | NIST CSF | ISO/IEC 27001 |
|---|---|---|
| Nature | Voluntary reference framework | Certifiable international standard |
| Approach | Functions and maturity levels against risk | Management system (ISMS) with a continuous improvement cycle |
| Verification | Self-assessment, no formal certification | External audit and formal certification |
| Rigidity | Flexible, adapts to size and sector | More structured and documented |
| Typical use | Assess and prioritize the state of cybersecurity | Demonstrate to third parties that audited risk management exists |
| Everyday analogy | A preventive checkup list that the company itself applies to see how it is doing | A certificate issued by an external auditor, like the audit of financial statements |
With that general foundation in place, it finally makes sense to move on to the frameworks that address AI specifically:
Added to these two, with a different nature, is the European AI law (EU AI Act): it is not a voluntary management framework but a regulation with the force of law that classifies AI systems by level of risk and requires different obligations depending on that classification (section 15). An ISO/IEC 27001 ISMS protects the environment where the AI operates (the data, the access, the infrastructure), but it does not answer the questions specific to AI: what a system can decide on its own, with what level of autonomy, with what bias, or with what explainability. ISO/IEC 42001, the NIST AI RMF, and, as a legal obligation in certain markets, the European AI law are designed for that.
For privacy there is also ISO/IEC 27701, whose 2025 edition became a standalone standard for managing personal data: it no longer requires having ISO/IEC 27001 first.
In Chile, that foundation is already mandatory for some companies: the Ley Marco de Ciberseguridad requires operators of vital importance to have an information security management system (section 15).
In practice, an already mature ISO/IEC 27001 ISMS is not discarded when moving to AI: an important part is reused, and another part must be extended because AI introduces questions the ISMS was not designed to answer.
| ISO/IEC 27001 control or domain | What it covers in AI | What it lacks, and ISO/IEC 42001 or the NIST AI RMF cover |
|---|---|---|
| Asset inventory | Identifies servers, data, and access in the environment where the AI runs | Does not treat models, versions, training datasets, or AI providers as assets in their own right |
| Access management | Controls who gets into AI systems and interfaces | Does not control what an agent can decide or execute once it already has authorized access, nor does it distinguish whether the one acting is a person or an agent using that person's account |
| Risk assessment | Assesses confidentiality, integrity, and availability risks | Does not assess AI-specific risks such as bias, hallucination, gradual loss of accuracy over time (model drift), or loss of explainability |
| Supplier management | Evaluates technology providers in general | Does not ask to evaluate the origin of training data or the traceability of the provider's model (where it comes from and how it has changed) |
| Incident management | Responds to information security incidents | Does not contemplate an incident where the system acted autonomously within its permissions but with an improper outcome |
| Continuous improvement and audit | Audits the ISMS's compliance over time | Does not audit the model's performance over time or its retraining |
The recommended maturity sequence, in general terms, is the following:
An agent is governed with the same logic used to bring on a new employee with access to systems: you know who they are, what they can do, who answers for them, and what they did. The first question, who it is, has an uncomfortable answer today.
In practice, many of the most widely used copilots and agents operate with the account of the person using them. Microsoft 365 Copilot, Gemini in Google Workspace, ChatGPT connected to email or to SharePoint, or an AI browser act on the user's behalf: they see what that person can see and do what that person can do (Annex A, questions 14 and 15). This is called delegated access. The alternative is for the agent to have its own identity, separate from that of any person and with permissions assigned for its task. There is also a third form, less visible and riskier: the agent uses the credentials of the person who created it, regardless of who is using it. All three coexist, sometimes within the same product, and it is worth knowing which one each agent uses, because their risks are different.
| Model | How it works | Main risk | Minimum control |
|---|---|---|---|
| Delegated access On behalf of a person | The agent uses the session or the permissions of whoever invokes it. It is the usual model for personal assistants: summarizing one's own email or searching the documents the person already has access to | It inherits everything the person can see and do, which is almost always much more than the task requires. If a hidden instruction manipulates it (section 9, risk 3), it acts with that person's full authority, and in the logs its action may look as if the person did it | Limit what the agent can use within the person's permissions, and make the log distinguish what the agent did from what the person did |
| Its own identity The agent's account | The agent operates with its own account (a service account), with permissions that an administrator assigns for its task. This applies to agents that work for a team or a process, that run on a schedule with no one logged in, or that execute actions with real effects: paying, approving, modifying records | If the account has broad permissions, the agent sees and does more than any person, and anyone who can invoke it gains access through it to information they are not entitled to | Separate who can invoke the agent from what the agent can do, with an owner, minimum permissions, and credentials that can be rotated and revoked |
| Creator's credentials The connections of whoever built it | The agent uses the connections or credentials of the person who created it, and reuses them with everyone who uses it. It happens when someone builds an agent with their own access and shares it with their team | Anyone who invokes it gains access, through it, to everything the creator can see and do, and in the logs everything appears as done by the creator | Avoid it: have each user sign in with their own identity or have the agent use its own, and block this mode where the platform allows it |
Having an agent inherit the permissions of the person using it solves a practical problem, because it avoids maintaining a second access matrix, but from a security standpoint it is a problem. A person's permissions accumulate over the years, through projects, covering for colleagues, and shared folders that nobody closed, and the agent receives all of them at once. And it keeps inheriting them: every new access the person receives becomes available to the agent, without anyone having assessed whether that agent needs it. An agent that prepares the weekly sales report does not need to read Human Resources emails or be able to delete files, even if the person using it can.
In practice, that translates into four decisions: permissions defined by task and not copied from a person; access only to the data sources the task uses; permissions with an expiration date, renewed after a review and not by default; and an intersection rule, under which the agent's policies can only restrict what the person can do, never expand it. The "no less" also matters: an agent with fewer permissions than its task requires protects no one, because it pushes someone to grant it broad access so that it works, or pushes people to replace it with an unapproved tool.
Around each agent there are four identities, not two: whoever creates and modifies it, whoever answers for it (its owner), whoever invokes it, and the agent itself. The creator's identity is the one most often left out of governance, because today anyone with the right license can build an agent in minutes, in Copilot Studio, in ChatGPT's GPTs, or on similar platforms, connect it to company systems, and share it. Three risks follow from this: that the agent uses its creator's credentials with everyone who uses it (the third row of the table above; Copilot Studio, for example, allows it to be configured that way); that the creator later changes the instructions, tools, or connections of an already approved agent, and with that what it does, without anyone reviewing it; and that, when the creator leaves the organization, their agents keep running with their connections or are left with no one who understands them.
That is why whoever creates an agent is governed as part of the agent, with four rules: creating and publishing agents is a permission that is assigned, not a capability everyone has by default; the creator's personal connections are not shared with the agent; every change to its instructions, tools, connections, or permissions is recorded with its author and, if it expands what the agent can do, is reviewed before being published; and whoever creates a high-impact agent is not the one who approves it. The creator can also be its owner, but they are different roles: the creator builds it and the owner answers for what it does.
Whatever the identity model, each agent should meet eight rules:
Beyond those basic rules, the industry does not yet have a single answer. At ELIAC 2026, three security vendors presented three different ways of controlling an agent, which are best read as complementary rather than alternatives:
| Thesis | Question it answers | What it solves | What it does not solve |
|---|---|---|---|
| Digital authority Steve Riley, Netskope | What authority does this agent have, and is it growing without anyone reviewing it? | The silent accumulation of permissions. It proposes reviewing four dimensions: identity, minimum authority, behavior, and data | An agent with the right permissions deciding badly |
| Intent-based control Ron Bennatan, Varonis | Should it be doing this now, given what it was asked? | The real failure mode of an agent: acting outside what it was tasked with, even though it has permission | It is the most recent proposal and the least proven in real operation |
| Containment Mario Espinoza, Illumio | If something fails, how far can the damage reach? | Limits the blast radius without needing to predict what the model will do | It does not prevent the error: it limits it |
Each thesis matches the product category sold by the company that presented it. That does not invalidate the diagnosis, but it requires separating it from the recipe: none of the three is a complete solution, and agents' own identity remains an open issue, because each vendor builds its own scheme and those schemes still do not talk to one another.
In the delegated model, the person's account is the agent's key: if that account is poorly protected, so is everything the agent can do with it. That is why controlling agents starts with controlling people, with three rules:
The Model Context Protocol (MCP) is an open standard for connecting AI assistants and agents to other applications and data sources: email, the customer relationship management system (CRM), the code repository, or a database. It was created by Anthropic; since December 2025 it has been a project of the Agentic AI Foundation, under the Linux Foundation, and it is supported by ChatGPT, Claude, Gemini, Microsoft Copilot, and Cursor, among others. For an executive, what matters is that each MCP connection gives the agent the ability to read or to act in another system. That is why each MCP server is treated like any other integration: it is inventoried, has an owner, is approved before use, is limited to what the task needs, and is logged. An MCP server that a person connects on their own is shadow AI with the ability to act.
A board does not need a technical report on AI: it needs one page, in the same format every time, that lets it see the trend and decide. Five items are enough to start:
| What to report | What it should show | Suggested frequency |
|---|---|---|
| AI inventory | New uses, retired uses, shadow AI detected, and how many uses fall at each risk level | Quarterly |
| Incidents | What happened, whom it affected, what was corrected, and what was learned, including near misses | Quarterly, and serious ones immediately |
| Compliance | Progress against the policy and the adopted framework, audit results, and new or amended legal obligations | Semiannual |
| Value generated | For each relevant initiative, the committed result versus the achieved one, using the indicators in section 6 | Semiannual |
| Approved high-risk uses | Which ones they are, what autonomy they have, who owns the risk, what controls operate, and what exceptions were authorized | With each new approval, and a full review once a year |
The frequencies are a starting reference: it is advisable to adjust them to the intensity of AI use and to the board's calendar.
Governance answers who decides. Ethics answers what we are willing to allow, even if it can technically be done. Ethics, regulation, and security overlap, but they are not the same: a decision can be legal and technically secure, and still be considered inappropriate by customers, employees, the community, or the board itself. The central themes are transparency, fairness, non-discrimination, privacy, the ability to explain a decision, accountability, human oversight, impact on people, and use proportionate to the problem being solved.
The lesson for a board: an AI that learns from the past can repeat, and amplify, the biases of the past. That is why decisions about people (hiring, credit, insurance, terminations) deserve the strictest oversight.
| Actor | Typical responsibility |
|---|---|
| Model provider | The underlying model or service |
| Application provider | The application built on top of the model |
| Integrator | The specific implementation for the company |
| User company | The governance and the use it makes of the system |
| Process owner | The final outcome of the business process |
| Human user | The decision, when the decision effectively belonged to a person |
The actual distribution of responsibility depends on the specific contract, the applicable regulation, and the concrete architecture: this table is a starting map, not an automatic assignment.
The lesson: in front of the customer, "it was the AI" is not a defense. The company answers for what its AI says and does.
AI already has implications for privacy, copyright, discrimination, transparency, automated decisions, accountability, and industry-specific sector regulation. The voluntary frameworks (NIST, ISO) were described in section 12. This section summarizes the most relevant legal obligations for a company operating in Chile or with customers in Europe, as of October 2026.
| Rule | Status | What it means for the company |
|---|---|---|
| Law 21.719 on personal data protection (Chile) | Published in December 2024. Takes effect on December 1, 2026. A Government bill from September 2026 (bulletin 18.623-07) proposes postponing it to December 1, 2027. On October 19, the Senate Constitution Committee approved it in principle, unanimously; in the article-by-article discussion there are proposals for a shorter period or for postponing only enforcement and sanctions | Creates the Agencia de Protección de Datos Personales, which supervises and sanctions. Maintains the rights of access, rectification, erasure, objection, and blocking, and adds portability and the right to object to decisions based solely on automated processing that produce legal effects or significantly affect the person, and to request review by a human, with the exceptions set by law. Requires reporting to the Agency any security breaches that create a reasonable risk for individuals. It is the rule with the greatest impact on the use of AI with customer and employee data. As of October 2026 the Agency had not yet been set up, because in May the Senate rejected the nominees proposed for its Board of Directors: that delays enforcement, not the obligations. The same bill proposes that, during the first year, the Agency may opt for a written warning instead of a fine with companies of any size, a power that the law today reserves for smaller companies. It is an option for the Agency, not an exemption from fines. |
| Law 21.663, Ley Marco de Ciberseguridad (Chile) | Published in April 2024. The reporting obligations have applied since March 1, 2025 | Creates the Agencia Nacional de Ciberseguridad. Providers of essential services and operators of vital importance must report incidents with significant effects, within the deadlines of the reporting regulation (Decree 295): an early alert within 3 hours, a second report at 72 hours (24 if an essential service is affected), an action plan at 7 days, and a final report at 15. Among the essential services defined by the law are digital infrastructure, digital services, and information technology services managed by third parties, so it can also reach IT and AI providers. The Agency has already published the first lists of operators of vital importance; the second, approved in July 2026, includes 239 institutions. Operators of vital importance must also implement an information security management system. |
| AI bill (Chile, bulletin 16.821-19) | Moving through Congress. Approved by the Chamber of Deputies in October 2025, now in the Senate (status as of August 2026) | The text approved by the Chamber follows the European risk-tier model. In 2026 the Government announced that it will replace it with an "enabling" framework law that, among other points, would recognize international technical standards such as ISO/IEC and NIST as mechanisms of compliance. It is not yet law. It is strategically relevant and worth following, but today it creates no obligations; its orientation favors organizations that have already put their risk management in order. |
| European AI law (EU AI Act) | In force since August 2024, with phased application | It also reaches companies outside Europe when their AI systems are offered, or their outputs are used, in the European Union. The prohibited practices have applied since February 2025, and the obligations for general-purpose models since August 2025. In 2026, the obligations for high-risk systems were postponed: to December 2027 for the high-risk uses in Annex III of that law (for example, personnel selection, education, or credit assessment), and to August 2028 for AI embedded in products already regulated under Annex I (for example, machinery or medical devices), under Regulation (EU) 2026/1744, in force since July 27, 2026. That same adjustment softened the AI literacy obligation and added new prohibitions, such as generating non-consensual sexually explicit content of identifiable people. What already applies to those who use AI: since August 2, 2026, the transparency obligations, for example that a chat assistant serving people in the European Union tell them they are talking to an AI, unless it is obvious, and that deepfakes be identified as artificial content. Marking of content generated by systems that were already on the market is required from December 2, 2026. |
This guide does not replace legal advice: before a compliance decision, it is advisable to review the current text of each rule with a lawyer.
With these conditions defined (authority, ethical limits, accountability, and regulatory obligations), the organization can now decide how to implement the solution and whether it is ready to scale it.
There are at least eight distinct paths, and they are not mutually exclusive within a single organization:
| Alternative | Advantage | Risk or trade-off | When it makes sense |
|---|---|---|---|
| Buy a SaaS with AI | Speed, no in-house development | Less control and customization | A standard problem already solved by the market |
| Use enterprise copilots | Fast adoption on tools already in use | Scope limited to what the copilot allows | Individual or team productivity |
| Build on a provider's APIs | Flexibility without operating model infrastructure | Dependence on the API provider | A proprietary use case, with no need to operate the model |
| Develop your own agents | Precise adaptation to the business process | Requires in-house engineering and governance | Real competitive advantage in a specific process |
| Fine-tuning | A specific, stable behavior or style | Cost, and greater difficulty reversing | Need for consistent, particular behavior |
| Operate open-weight models | Greater control and data residency | In-house infrastructure, security, and talent | Strict requirements for control or data sovereignty |
| Train your own models from scratch | Total control | Very high cost and complexity | Exceptional cases, not the automatic consequence of having an AI strategy |
| Specialized partner / integrator | Speeds up implementation and brings capabilities, experience, or specialization the organization does not have internally | Dependence on the partner, insufficient knowledge transfer, integration costs, and possible operational lock-in that is hard to reverse | When the use case requires speed, integration, specialized capabilities, or experience that the organization cannot efficiently develop on its own |
Neither option is intrinsically more secure: security depends on how each one is implemented and governed, not on the "proprietary" or "open weights" label. The same maker can offer both types of model.
For the buying or development stage, Annex B gathers a practical checklist of questions to ask before signing a contract or starting a development.
The 18 questions, grouped by topic to make them easier to use in a board session.
You do not need to have everything resolved to begin governing AI, and waiting until you do is, in itself, a risky decision. The plan is organized in two stretches.
The timelines are indicative and depend on the size and complexity of the organization.
Before approving an AI initiative, an executive should be able to answer five questions with confidence:
Competitive advantage will not come simply from using AI. It will come from using it in the right processes, under the right level of autonomy, with reliable data, controls proportionate to risk, and accountability clearly defined before starting.
If the organization has not yet started, the plan in section 18 lays out the first 90 days.
And when someone asks whether the company's AI is secure, it is worth remembering the rule from Annex A: you answer with evidence, not promises.
These are the questions most frequently asked by customers, employees, management, auditors, and the board itself, arranged in five levels, from the most basic to the most complex. Each one indicates who usually asks it. For each one, a plain-language answer is proposed, along with what should be verified before giving it and what should not be promised.
The answers are written as model answers: they can only be given if what is listed under "What to verify first" has been resolved. If it has not been resolved yet, the honest answer is to explain what is being done to resolve it.
"What we write or upload can end up in five places: the conversation history, the uploaded files, the assistant's memory, the provider's logs, and, only if the account allows it, the training of future versions. How long it stays and who can see it depends on the type of account, not the brand: with a personal account, it is set by each user's settings and the consumer terms, which may include review of conversations by the provider's staff; with a company account, it is set by the contract. And a search engine, with or without AI, is never given confidential information."
What to verify first"No AI stores our data," without knowing which accounts are being used.
"Something does remain, but the model does not learn on the spot: it reads what we write in order to respond and is not changed by it. What can happen afterward is that the provider uses those conversations to train future versions. In personal accounts, that depends on each user's settings; in our enterprise accounts, the provider commits by contract not to do so and keeps logs for a defined period. What does remain stored are the history, the uploaded documents, and the tool's memory, and we manage those ourselves."
What to verify first"The AI doesn't store anything." It almost always stores something, somewhere.
"They listen continuously only to detect the wake word, and that happens on the device itself. But once they activate, on purpose or by mistake, what is said next is sent to the provider. That is why, in a confidential conversation, there should be no smart speaker switched on, and on work phones we define whether the assistant stays active."
Real case. In January 2025, Apple agreed to pay USD 95 million to settle a class action in the United States that accused it of recording conversations after unintended Siri activations. Apple denied any wrongdoing. That same year, Amazon removed, on some Echo models, the option to process voice only on the device: since March 2025, Alexa requests are processed in the cloud.
What to verify first"Nobody listens to our meetings," if there are devices with an active assistant in the room.
"As a draft, yes. As the final truth, not without review: AI can make things up with complete confidence. In critical uses we require sources and human review."
What to verify firstAbsolute accuracy. The Mata v. Avianca case (section 9) is the reminder.
"Each customer's information is separated from everyone else's, and the provider does not use it to answer anyone else. We can show how that separation is achieved."
What to verify firstAn isolation that has not been tested. It is the most serious security question when the answer is weak.
"It is processed in the region defined by our contract with the provider, which also establishes where it is stored, for how long, and which third parties take part."
What to verify first"The data never leaves Chile," unless the contract and the architecture guarantee it.
"We delete everything that can be deleted and can show the contract and the deadline: files, indexes, memory, and logs. We cannot guarantee deletion of whatever has gone into a model's training, because a model is not a database. That is why our control is at the input: sensitive data is not used for training."
What to verify firstA total deletion if that data was ever used to train or fine-tune a model.
"We have an inventory of approved tools, we measure unauthorized use, and we offer enterprise alternatives so that nobody needs to use personal accounts."
What to verify firstAn answer that describes only the formally contracted AI. It is almost always a fraction of actual use.
"Yes, with an approved tool and with rules: we notify all participants before recording, including external ones; the recording, transcript, and summary are kept in a company account; someone reviews the summary before it is circulated; and some meetings are not recorded."
Real case. In August 2025, a class action was filed in California against Otter.ai, accusing its assistant of joining meetings and recording participants who had not given their consent, and of using those conversations to train its systems. These are allegations, not proven facts, but they show the risk of an assistant that enters the meeting with the account of a single person.
What to verify firstThat the summary is accurate. It may omit nuance or attribute to someone something they did not say: it is a draft, not minutes.
"We treat it for what it is: a disclosure of a third party's information to an outside provider, not a minor slip. We act in this order:"
That "everything has already been deleted." The record is deleted: it cannot be guaranteed that whatever may have gone into training is deleted.
"You can't tell by the face or the voice: today both can be imitated. Any unusual instruction involving money or data is confirmed through a second, known channel, even if it appears to come from the highest authority."
What to verify firstThat training alone is enough. The Arup case (section 11) shows how convincing the deception can be.
"Yes, like any system. The attacks most specific to AI are instructions hidden in documents or emails that the AI reads, and abuse of an agent's permissions. No AI can always tell a hidden instruction apart from the text it reads, so we do not promise that it cannot be fooled: we limit what it could do if it is. Our agents have only minimum permissions, do not combine confidential information, external content, and the ability to send data outside without approval, and relevant actions require approval."
What to verify first"Our AI cannot be manipulated."
"It depends on the provider's terms and on the rights over what we give it. We only upload information we have the right to use for that purpose, and everything published or delivered to a customer goes through human review first. Copyright protection for content generated solely by AI is uncertain and varies by country."
What to verify first"What the AI generates is ours and free of any rights."
"Yes, and that is the point. Microsoft 365 Copilot and Gemini in Google Workspace answer using what each person already has permission to open: emails, documents, shared folders, and meetings. They do not bypass permissions, but they expose them: if a folder with salaries or contracts was left shared with the entire company, now a single question is enough to find it. That is why, before turning them on, we review who has access to what, and we keep reviewing it. The same applies to any AI assistant or search tool that connects to the company's systems while respecting each person's permissions."
What to verify first"Copilot only sees what it should see," if permissions were never reviewed.
"With care. An AI browser, such as ChatGPT Atlas or Perplexity Comet, or an assistant's agent mode, can read pages, fill out forms, and click using the person's logged-in session: their email, their bank, or the company's systems. If a page contains hidden instructions, the agent may follow them (section 9, risk 3). That is why we do not use them with sessions on company systems until they are approved, and sensitive actions always require human confirmation."
What to verify first"The agent only does what we ask it to." It can follow instructions hidden in what it reads.
"Yes, under the same rules as any other use of personal data: a legal basis, a clear purpose, only the necessary data, adequate security, and a contract with the provider that processes it."
What to verify first"Since the model doesn't store personal data, the law doesn't apply." A model trained on personal data cannot be presumed anonymous: it must be assessed case by case, according to the European Data Protection Board.
"Today the legal date is December 1, 2026. In September 2026 the Government introduced a bill to postpone it by one year, to December 1, 2027, which in early October was still in its first legislative stage in the Senate: until it is approved, the date does not change. Law 21.719 creates an Agency that supervises and sanctions, gives individuals more rights, among them to request human review of decisions made solely by an automated system that significantly affect them, and requires reporting security breaches that create risk for them."
What to verify firstCompliance without an inventory. Without knowing what data each AI touches, there is no possible answer. Nor that there is one more year to comply: as long as the bill is not approved, the date is still December 1, 2026.
"It can support the decision, but decisions with significant effects on people have real human oversight, can be explained, and the person can object or request a review."
What to verify first"The AI is objective." It learns from historical data and can repeat its biases.
"It can happen. Conversations with an AI are records like any other, and a court can order them preserved or produced. In 2025, in The New York Times v. OpenAI lawsuit, a U.S. court ordered the preservation of conversations that would normally have been deleted, including those of consumer accounts. The order was lifted in October of that year, but it showed that deletion does not always depend on us. That is why what is written to an AI is treated with the same care as an email."
What to verify first"What is deleted in the AI no longer exists." There may be copies the provider is required to keep.
"First we measure without punishing, then we offer a better alternative, and only then do we set the rule:"
That shadow AI disappears with a ban. If there is no alternative, the use moves to where it cannot be seen.
"We respond proportionately and with a criterion that everyone knows in advance:"
"Zero tolerance" without alternative tools: it pushes use into the shadows and discourages reporting.
"Not everyone needs the same thing. We organize training for four audiences:"
That one annual talk settles the matter. It is a continuous process, like cybersecurity training.
"We do. In front of the customer, the company answers for what its AI says and does, just as it does for what any of its channels says. Internally, each use case has an owner identified by name."
What to verify firstThat the responsibility lies with the provider. The Air Canada case (section 14) makes this clear.
"Six minimum things: that it not train on our data, defined retention periods, data location and a list of subcontractors, isolation between customers, notice of incidents and of relevant changes, and verifiable deletion at the end."
What to verify firstTo our own customers, nothing that the provider does not guarantee to the company by contract.
"With an evidence folder, not with a statement. We can show the AI inventory, the approved policy accepted by our people, the contracts with their data clauses, the usage logs, the training carried out, the incidents and how they were closed, and the reports to the board."
What to verify first"We comply with everything," if the document that backs it up cannot be shown.
"It is not mandatory. It is useful when customers or regulators ask for audited evidence of how we govern AI. Before that, it is advisable to have the information security foundation in order (section 12)."
What to verify firstThat a certification makes the AI secure. It certifies that a management system exists, not that there will never be incidents.
"In three horizons: the first 90 days to put the foundation in order (section 18); the first year to move from isolated initiatives to a program (Annex C); and, in parallel, a portfolio of use cases prioritized by value and by risk, each approved with the 18 questions (sections 6 and 17)."
What to verify firstA complete transformation with AI in 90 days. That timeframe serves to put the foundation in order, not to capture all the value.
The eight alternatives in section 16 boil down, in practice, to two frequent operating decisions: buying a product that already includes AI, or building something of your own that incorporates it. These questions do not replace the 18 questions in section 17 or the 7 questions before using a language model in section 4: they complement them at the next stage, as a final filter before signing a contract or starting a development.
The earlier sections help in deciding on a specific initiative. But an organization that approves initiatives one by one, without building capacity behind them, tends to accumulate pilots that do not scale. Gartner proposes an AI roadmap organized into seven workstreams, each with initial and more advanced activities. This roadmap does not replace this guide's framework (Value, Technique, Autonomy, Governance): it works as an external benchmark, a completeness check to verify that the organization is building the capabilities needed to scale.
| Workstream | Initial activities | Advanced activities | Where it is covered in this guide |
|---|---|---|---|
| AI strategy | Define the AI vision; measure AI maturity | Establish a process to refine the AI strategy | Executive summary and section 17 |
| AI value | Prioritize the first use cases; define their value | Value monitoring system; AI product portfolio | Sections 4 and 6 |
| Organization | AI resource plan; community of practice | No advanced activities in the source | This annex |
| People and culture | Initial workforce plan; role review process and job redesign | No advanced activities in the source | This annex and section 17 |
| AI governance | Identify the main risks and their mitigations; define initial policies | AI literacy programs for governance; pilot governance tools | Sections 9, 10, 12, 13, and 15 |
| AI engineering | Build vs. buy decision framework; select providers for the first cases | User experience best practices for AI; AI platform engineering | Section 16 |
| Data for AI | Assess data readiness; implement a readiness plan | Data observability for AI | Sections 8 and 17 |
Source: Gartner, "AI Roadmap: How to Build and Scale AI" (gartner.com), also distributed on LinkedIn. Translation and adaptation are our own, without reproducing the original chart (© Gartner, Inc.). The last column is a mapping prepared for this guide and is not part of Gartner's material.
AI changes tasks, not just tools. When a process incorporates AI, it changes what each person does, what skills they need, and how their work is evaluated. If this is not planned, three effects tend to appear: resistance to change, informal use outside governance (the shadow AI of section 1), and loss of knowledge when staff is reduced before understanding what each role really did.
Gartner places AI literacy programs within the governance workstream. The logic is that a team that understands what AI does and does not do is, in itself, a control: it catches sooner a doubtful result, an improper use, or a vendor promise that does not hold up.
Two decisions tend to remain implicit. The first is with what resources AI will be developed: an in-house team, a provider, an integrator, or a combination, in line with section 16. The second is how learning is shared across areas. A community of practice, that is, a cross-functional group that brings together those who use AI in different areas, keeps each team from repeating the same mistakes and helps identify reusable use cases.
Gartner places two activities at the start of the journey: measuring the organization's AI maturity and assessing whether the data is ready for the first use cases. Both are questions in section 17 (questions 4 and 8).
Terms that appear in this guide or in any conversation about AI, explained in one line.
Diego Macor is a technology and cybersecurity executive with more than 25 years building technology businesses in Latin America: 22 years at IBM and, afterward, country manager in Chile for a regional cybersecurity company. He has served as chair of the Cybersecurity Working Group (Mesa de Ciberseguridad) of the Asociación Chilena de Empresas de Tecnologías de Información (ACTI, the Chilean Association of Information Technology Companies) and is a regular voice for the sector in the Chilean media. He holds an MBA and the CISM and CCSK certifications.
Contact and updated documents: diegomacor.com · linkedin.com/in/diegomacor
Project documents used: Guia_Educativa_Tipos_de_IA_y_Preguntas_Frecuentes_v2.00_20260924.html, Guia_Educativa_Arquitectura_3_Capas_v2.10_20260922.html, Marco_Conceptual_Preguntas_Clientes_Seguridad_IA_v1.00_20260922.html, Casos_de_Uso_IA_por_Tamano_de_Empresa_v1.00_20260916.html, ELIAC2026_Sintesis_Charlas_v1.10_20260824.html (CENIA talk at ELIAC 2026), Respuesta_Clientes_Seguridad_IA_v1.10_20260915.html (includes the log-preservation case in The New York Times v. OpenAI and Opinion 28/2024 of the European Data Protection Board), Seguridad_IA_Guia_Ejecutiva_Gobernanza_v1.00_20260916.html, Seguridad_Agentes_IA_Lado_Proveedor_v1.04_20260916.html (continuity in the face of model version changes), ELIAC2026_Resumen_Ejecutivo_Consolidado_v1.00_20260916.html (the three agent-control theses presented at ELIAC 2026), version 5.21 of this guide, and AI with Judgment, its edition for FQ4 (fq4tech.com/ai-guide). The everyday analogies, the model answers in Annex A, the 90-day plan, the usage policy, the incident procedure, the identity and permission rules for agents and people, and the board report are original work developed with AI support from those sources.
External sources: