AI almost never arrives through a governance committee. Sales wants a tool that summarizes customer comments. Legal wants faster contract review. IT wants a chatbot on the intranet. A clinical group wants help with a pile of notes. The first question is whether it saves time. The second question, usually asked too late, is what employees will paste into the box.
Those are privacy questions. The switches that answer them live in the CISO’s stack: identity, DLP, cloud and endpoint controls, logging, encryption, API gates, and incident response. The CISO still owns cyber defense. Enterprise AI also makes that office the place where a privacy rule either becomes a control or stays a paragraph in a policy.
Data no longer sits still in one application
In the systems most companies already mapped, information is collected, stored, and shared through known apps. In an AI setup the same record can be chunked into a vector store, pulled into a prompt, mixed with another source, turned into a summary, written to a log, or handed to an agent that opens a ticket or sends a message. Nobody has to “share” the file for it to leave the purpose it was collected for.
Minimization used to mean: do we need this field? Now it also means: which shares is the retrieval layer allowed to search, are health or HR fields masked, and can the model return a document the logged-in user was never entitled to open? Privacy can write the rule. Security and platform teams decide whether the index, the ACL, and the tenant boundary actually enforce it.
Purpose limitation works the same way. Approving a tool for internal drafting is not the same as approving it for complaints, medical text, or performance reviews. If that line exists only in a use-case register, someone will connect the model to a second corpus because it is useful. Access groups, data zones, monitoring rules, and a blocked-tool list are what keep the first approval from becoming a quiet second product.
The chat itself is a record
Prompts, completions, retrieved snippets, plug-in calls, and agent memory get filed under “telemetry.” They often contain customer problems, employee names, deal terms, or inferences about a person. An output can create a new fact the company never collected. If those threads are retained, searchable, and open to admins, they are a processing activity. Retention, admin access, encryption, and who may query them belong in the same conversation as email archives.
Vendor questionnaires still need SOC reports, region, encryption, and subprocessors. They also need answers that older SaaS reviews skipped: training on customer content, prompt and output retention, whether the customer can shorten that clock, whether embeddings die when the source file is deleted, tenant isolation, and what the vendor does when a completion recites another customer’s data. Legal owns the contract. Privacy owns the rights analysis. Security owns whether the claimed control exists in the console.
Inventory before the next pilot
List the tools, the data they touch, the vendor, where records sit, how long they last, and who can see outputs. A use case should not go live without acceptance criteria: who can access it, what is logged, what is excluded from the corpus, retention, training off by default, and who gets the page when something leaks.
Incident playbooks written for stolen laptops miss the common AI cases. Someone pastes a spreadsheet into a consumer model. Retrieval surfaces a restricted folder. An agent calls an internal API with the user’s token. The vendor changes a training toggle. Detection, containment, and notice paths for those events need owners before the first ticket.
None of this means the CISO absorbs the privacy office. Privacy still sets obligations, risk appetite, and what “fair” means for a given use. AI just makes those choices depend on configuration. A policy that employees must not upload sensitive files is true and insufficient if DLP cannot see the browser session and the approved tenant has training left on.
In healthcare, life sciences, finance, and critical infrastructure the same miss can become a safety or licensing problem, not only a notice letter. Start with the inventory and the controls that can be tested. Leave the ownership chart alone. Make the privacy rule something the SOC can alert on.