Untangling Security & Privacy Risks Across Today's AI Tools

The session opens by framing business adoption of generative AI as a fast-moving space where vendor promises and the details in contracts, compliance documents and data flows can diverge. It separates two paths, buying a licensed AI service or building and hosting a model, and notes that building requires far more time, data work and ongoing upkeep than most organizations expect.

The core of the talk compares Microsoft Copilot, ChatGPT, Google Gemini, Claude, Perplexity and DeepSeek, plus the OpenClaw agent tool. For each, the speaker reviews compliance documentation, whether customer data is used for model training, residency and retention options, audit logging, and how the licensing tier changes the answer. A recurring point is that enterprise plans usually bring controls that consumer plans lack. Copilot inherits each user's existing Microsoft 365 permissions, so overshared files become easy to find. DeepSeek is advised against for business use because of its terms, and OpenClaw is described as not ready for enterprise use.

The closing takeaway is a reusable prompt for asking an AI vendor to summarize its privacy and security documentation, built around three questions: is the tool safe for a regulated business, can the vendor be trusted with data, and why choose it over alternatives. The speaker stresses that these answers change quickly, so reviews should be repeated, and that access reviews and ongoing user training matter as much as vendor choice.