Can artificial intelligence be used with confidential data?

Peut-on utiliser l’intelligence artificielle avec des données confidentielles.png

Efficiency question :

Yes, artificial intelligence can be used with confidential data, provided a secure environment is chosen and appropriate information protection measures are implemented.

Confidential data must be stored in controlled locations and should not be submitted to public AI services without sufficient privacy and data protection safeguards.

Private conversational agents can use this information while preserving control over access and usage.

Key issues:

Protecting personal information, maintaining the confidentiality of business information and complying with Quebec’s Law 25 are important considerations.

The organization must ensure that data is not used or disclosed without authorization and that its processing complies with applicable legal and contractual obligations.

Challenges:

Protecting confidential data is not limited to external users. Employee access must also be restricted according to their responsibilities.

The main challenge is structuring storage locations, managing permissions and ensuring that AI agents do not expose information that users should not be able to access.

Technology:

Microsoft SharePoint: storage of confidential documents in secure libraries with controlled permissions.

Microsoft Entra ID: management of identities, groups and access.

Microsoft Copilot and Copilot Studio: creation and use of conversational agents working with internal data in an appropriately configured enterprise environment.

Microsoft Purview: information classification, sensitivity labels and data protection policies.

Developer's advice:

Consistently apply the principle of least privilege: each user should have only the access required to perform their duties.

For confidential data, designate an information owner responsible for overseeing classification, retention and access permissions.

Before deploying an AI agent, verify permissions on document sources and test responses using different user profiles to confirm that confidentiality restrictions are respected.