Why “We’ll Just Use ChatGPT” Quietly Becomes a Security Risk

Somewhere in your firm right now, someone is pasting something into a public AI tool that they shouldn’t be. A client’s contract terms. A set of drawings. Pricing from a live pursuit. A spreadsheet with staff information in it. They’re not being reckless — they’re being efficient. The tool is right there, it’s fast, and it makes their day easier. That’s exactly why this is so hard to see coming.

The instinct to reach for ChatGPT is a good one. AI genuinely can cut the administrative weight off your team. But there’s a difference between using AI and using it safely, and most firms have never drawn that line. The tool gets adopted informally, one person at a time, with no rules about what goes into it — and by the time leadership thinks about it, sensitive information has already been flowing into a public system for months.

This isn’t a fringe worry anymore. Business leaders now rank it near the top of their concerns about AI. In one recent survey, 69% of leaders cited concerns about AI data privacy, a significant increase from the 43% who cited it a few quarters earlier. It’s not that AI got more dangerous. It’s that more people started using it without a plan. Here are three reasons that should give any AEC firm pause.

1. Data you put into public AI tools can leave your control permanently

This is the most common harm and the easiest to cause — one employee and no policy is all it takes. Anything pasted into a public AI tool can be retained by the vendor, used to train future models, reviewed by people you’ll never know about, or exposed if that vendor is breached. Unlike a document you email, you can’t recall it, you can’t confirm it was ever deleted, and you can’t prove to a client that it stayed contained.

For a firm handling contracts, proprietary designs, and client data under confidentiality obligations, that’s not a hypothetical — it’s a breach of the trust your clients placed in you. Confidentiality consistently ranks among the top generative-AI risks; in one survey of IT and security professionals, it landed among the leading concerns, cited by 45% of respondents. Once your information is out, you can’t pull it back.

2. It’s happening invisibly, across your whole team, with no one tracking it

A single leak is an incident. Dozens of employees each quietly making their own choices with no oversight is something worse — an unbounded liability you can’t see. This is “shadow AI”: adoption spreads informally, one person to five to everyone, long before leadership sets any rules. The result is that no one can say which tools are actually in use or what’s already been exposed, which means you can’t limit the risk, audit it, or even measure it.

And this is the part leaders most consistently underestimate. Even the executives paying attention are pulling back as they realize what’s slipping through: the share of leaders who said they weren’t allowing AI to access sensitive data without human oversight actually dropped from 52% to 45%, while the share who admit they’re not yet comfortable fully handing tasks to AI rose from 28% to 45%. Comfort is falling as understanding rises — which tells you the risk is bigger than most firms assumed.

3. The bigger firms are already spending to close this gap — and you’re not

While your team is quietly using free tools with no guardrails, the organizations you compete against are treating AI security as a line item. In one survey, 67% of leaders said they plan to spend on cyber and data security protections for their AI, and 52% cited risk and compliance as a budgeting priority. In another, 73% of respondents said they’re investing in AI-specific security tools with new or existing budgets.

The message is clear: serious firms are building safe AI into how they operate. Firms that don’t are carrying a risk their competitors have already paid down.

Use AI the right way, not less

The point isn’t to scare your team off AI. It’s to use it the right way. That means a firm-specific setup with clear rules: what information is safe to use, what tools are approved, where sensitive data is allowed to go, and who’s accountable for keeping it that way. Done right, your team gets all the speed and relief AI offers — without turning your confidential work into someone else’s training data.

This is exactly why Arvaya is built the way it is. We don’t just hand you an AI tool and wish you luck. We have our own data security professionals on the team, so the systems we build are designed to be safe from the start — protecting your client data, your compliance standing, and your reputation while your team gets the efficiency they’re after.

AI should give your firm an edge, not a liability. The difference is entirely in how it’s set up — and that’s a problem worth solving before it becomes a headline.

Source: Cybersecurity Dive, reporting on recent AI security and spending surveys.