How do I stop employees leaking company data to AI?

Write a short policy, then add a check on each device that blocks or redacts sensitive data in prompts, files and screenshots before they are sent, and log every event.

Why does banning AI not work?

In a Wakefield Research survey 66% used AI tools despite believing policy prohibited it, and Deloitte UK found 31% of workers use GenAI without their employer's knowledge.

What data should never go into an AI tool?

Customer data, financial information, credentials such as API keys, personal identifiers like SSNs and card numbers, and anything covered by an NDA.

Do I need an enterprise security product?

Not necessarily. A small team can use one small background app per machine instead of a gateway or enterprise platform.

How to stop employees leaking company data to AI: a practical guide

Banning AI does not work and a policy alone does not either. This is the short list of what does, in the order to do it.

By Inveil · 15 October 2026

Summary

Employees leak company data to AI by typing, pasting, attaching files and sharing screenshots, mostly without meaning to. Surveys show 31% of UK workers use GenAI without their employer's knowledge and 66% used AI despite believing policy prohibited it. The fix is a short policy, a check on each device that blocks or redacts sensitive data before it is sent, and one place to see what happens.

Deloitte UK survey of 25,000 workers and Wakefield Research survey for PagerDuty

Each dot is 1%

31%

of UK workers use GenAI at work without their employer's knowledge.

01

66%

used AI despite believing policy prohibited it.
02

34%

entered customer data into public AI tools.
03

~50%

have had no formal training on safe use.

Figures are as reported by the sources linked below.

How company data actually leaks to AI

It is rarely deliberate. Data reaches AI tools in four ways: text typed or pasted into a prompt, files attached to a chat, screenshots, and code or credentials copied into a coding assistant. Each needs a different check, which is why one rule in a handbook does not cover it.

Step 1: say which tools and which data

Write a one-page policy naming approved tools and the data that never goes in: customer data, financial details, credentials and anything under NDA. Keep it short enough that people read it.

Step 2: check on the device, before it is sent

A check on each machine sees prompts, files and screenshots before they leave, whichever AI tool the person uses. Checking on the device also means the data is not sent somewhere else to be inspected.

Step 3: block or redact, rule by rule

Block the data that must never leave, such as card numbers and SSNs. Redact the data the request can do without, such as an email address, so the person still gets their answer. Tell them what was removed.

Step 4: see what happens

Log every block and redaction against the person it belongs to, and report usage per person and per provider. Without that you are guessing.

Where Inveil fits

Inveil does steps 2 to 4. Install one small background app on each machine, set block or redact for each rule, and read the metrics in one dashboard. It is built for small teams, with no gateway to host.

Inveil is data loss prevention (DLP) for AI. It checks prompts, files and screenshots on each employee's machine before they reach an AI tool, blocks or redacts sensitive data by your rules, and logs every event.

Common questions

How do I stop employees leaking company data to AI?: Write a short policy, then add a check on each device that blocks or redacts sensitive data in prompts, files and screenshots before they are sent, and log every event.
Why does banning AI not work?: In a Wakefield Research survey 66% used AI tools despite believing policy prohibited it, and Deloitte UK found 31% of workers use GenAI without their employer's knowledge.
What data should never go into an AI tool?: Customer data, financial information, credentials such as API keys, personal identifiers like SSNs and card numbers, and anything covered by an NDA.
Do I need an enterprise security product?: Not necessarily. A small team can use one small background app per machine instead of a gateway or enterprise platform.

Sources: