Commercial Data Protection

Commercial data protection in AI safeguards against five primary risks…

AI tools are genuinely useful, and we want people to use them. Most of the problems below come down to a single habit: being thoughtful about what you type in. This guide walks through five ways things can go wrong — and, just as important, what to do instead.

A quick note on one term you’ll see a lot: sensitive data. For us, that means things like student records, unpublished research, grant-protected data, medical information, financial details, and anything with names, ID numbers, or other details that identify a real person.

1. Data Ingestion for Public AI Training

• The Risk: Employees unknowingly paste confidential, personal or financial information into unprotected AI tools.
• The Fallout: The AI vendor uses that data to train its public models, meaning the sensitive or private information could later be generated as an answer for a competitor.

2. Intellectual Property (IP) Theft

• The Risk: Cybercriminals hack into the AI systems or the databases connected to them.
• The Fallout: Unauthorized actors steal research data, intellectual property or other protected information.

3. Data Privacy Violations

• The Risk: AI systems accidentally expose or mishandle Personally Identifiable Information (PII) belonging to students or employees, such as social security numbers, medical records, or credit card details.
• The Fallout: Heavy regulatory fines under laws like GDPR, CCPA, FERPA or HIPAA, alongside severe reputational damage can occur.

4. Prompt and Data Leakage

• The Risk: In shared (multi-tenant) cloud environments, a flaw in the system allows data from one company’s AI session to bleed over into another company’s session.
• The Fallout: Competitors using the same AI tool could gain real-time visibility into the University’s current strategic questions and operations.

5. Vendor Lock-in & Data Loss

• The Risk: An AI vendor claims ownership or permanent rights over the data uploaded or the unique outputs generated by the tool.
• The Fallout: Loss of asset control or legal issues can occur if one tries to switch to a different AI provider.

What To Do Instead

You don’t need to memorize the five risks. These habits cover almost all of them:

• Use University-approved AI tools for anything involving University data.
• Don’t paste sensitive data into free or personal AI accounts — no student records, no unpublished research, no personal or medical information.
• When you’re unsure whether something is sensitive, assume it is and check first.
• Read the terms of service before adopting a new tool, and loop in IS before connecting AI to any University system.
• Ask for help. Email if you have any questions.

Used thoughtfully, AI is a great asset. A few good habits let us get the benefit without putting our community’s data at risk.