AI and privacy — where do you draw the line?

Privacy is the issue I think most organizations are underestimating. When you feed customer data into an LLM API, that data is part of the training pipeline for most providers. The enterprise versions of OpenAI and Anthropic promise not to train on your data, but you have to trust those promises. Our legal team has been strict: we use self-hosted models for anything involving personally identifiable information, and we keep commercial APIs only for content that is already public. It costs more and takes more engineering, but the liability reduction is worth it.

I have been thinking about the employee side of this. If my company uses AI to monitor my emails, analyze my calendar, and review my Slack messages, where is the line? The technology makes it easy to do all of that, and the productivity argument is compelling. But the trust argument matters too. We have seen a backlash in our team when people discovered that AI was being used to analyze meeting sentiment. The lesson: transparency about what AI is doing is not optional. Employees need to know, and they need to have a say.

The regulatory side is catching up, but slowly. The EU AI Act is the most comprehensive so far, and it specifically categorizes AI used for workplace surveillance as high-risk. Companies in the EU will need to document the use case, conduct risk assessments, and provide human oversight. For anyone building AI products: the privacy and compliance requirements are going to be a major part of the roadmap, not a side concern. The organizations that take this seriously now will have a real advantage in 2026 and beyond.