The quiet problem: personal accounts
When a staff member signs up to an AI tool with a personal email, your firm has no visibility of what goes into it, no control over its data settings, and no way to remove access when they leave. Depending on the product and plan, what they type may be retained or used to improve the service. For a firm holding client files, that is a real exposure, even when everyone means well.
What good foundations look like
- Business AI accounts tied to your existing Microsoft 365 or Google Workspace sign-in
- Multi-factor authentication and sensible admin privileges
- Access granted deliberately, and removed when someone leaves
- Data settings reviewed rather than left on defaults
- Short, clear rules for staff on what information can go into which tool
- AI that respects the permissions already on your documents
Why it is rarely a DIY job
Each of those steps touches identity, licensing, device management and document permissions. Settings are spread across admin consoles, change often, and interact with each other. A tool that respects permissions can also surface files that were shared too widely years ago. Getting it right usually means understanding the whole environment, which is everyday IT work rather than an AI specialty.
Where Essential Eight fits
Essential Eight is the Australian Cyber Security Centre's set of baseline mitigation strategies. It is a strong foundation for any firm adopting AI, but it is not a certification and does not cover every AI-specific question. Data handling rules and governance sit alongside it.
This is what the AI Account Set-up and Audit program is built for.
See how the three stages work