Artificial intelligence has become established as one of the most significant drivers of innovation for companies. From virtual assistants that improve productivity to predictive systems capable of anticipating market trends, AI is changing how organisations work and decide. But that progress comes with a real challenge: the secure and responsible management of data, which in the age of AI are not just the input for algorithms, but one of the most sensitive assets of any company.
The data confirm that this risk is concrete and measurable. According to the Cost of a Data Breach 2025 report by IBM and the Ponemon Institute (IBM, 2025), 13% of the organisations surveyed have already suffered a breach in AI models or applications, and in 97% of those cases the organisation lacked AI-specific access controls. The same report notes that employees' use of unauthorised AI tools (so-called shadow AI) increased the average cost of a breach by an additional 670,000 dollars.
The risks of deploying AI without a security strategy
Although every company has its own particularities, there are common threats when implementing AI solutions.
Unintentional exposure of sensitive data is the most common: if there are no clear controls, an AI assistant can access confidential information (contracts, customer data, internal strategies) and expose it outside the security perimeter. Added to this is the loss of control over information when data are stored on external platforms without adequate governance, and insufficient regulatory compliance: the GDPR requires transparency and traceability in the processing of personal data, and the EU AI Act (Regulation (EU) 2024/1689) adds specific obligations depending on the risk level of the system. One point that changes frequently is worth qualifying: the high-risk obligations of the EU AI Act have 2 August 2026 as their legally applicable date, although in May 2026 the European institutions reached a provisional agreement, within the Digital Omnibus package, to postpone them until December 2027 (European Commission). Until that postponement is definitively approved, the prudent course is to prepare as if the 2026 date were going to be kept.
Insider threats (misuse by employees, sometimes out of simple lack of awareness) are one of the main sources of information leaks, something the Spanish Data Protection Agency (AEPD) itself has underlined in its ten recommendations for the responsible use of AI, where it insists on not entering customer or employee data into AI tools without respecting internal confidentiality policies. Finally, AI systems can be the direct target of cyberattacks designed to manipulate their outputs or extract confidential information, a risk that grows as agentic AI systems capable of acting autonomously are adopted, as set out in the AEPD's recent guidance on agentic AI from a data protection perspective (AEPD, February 2026).
Best practices for protecting business data with AI
To innovate with confidence, organisations must combine technology, processes and corporate culture.
Keep data within the corporate perimeter
The essential principle is that critical information must reside in environments under the company's control. Protocols such as the Model Context Protocol (MCP), an open standard created by Anthropic to connect AI systems to external data sources (Anthropic), allow AI to consult data in real time without having to duplicate them or export them to external repositories. It is worth noting that MCP is, above all, an integration protocol: it reduces the need to move data away from their source, but real security depends on how the permissions and access scope of each connection are configured, not on the protocol itself.
Establish clear AI governance
It is not just about technology, but about processes: defining AI roles and responsibilities within the organisation, establishing differentiated access policies according to user profiles, and creating ethics and compliance committees to oversee the deployment of systems.
Commit to traceability and transparency
An AI system must be able to record which sources it consults and how it generates its answers. This traceability is essential to audit critical decisions, comply with the GDPR and the EU AI Act, and build trust among employees, customers and partners. The AEPD itself recommends maintaining human oversight of the actions of AI systems and documenting the decisions they make, especially when they act with a certain degree of autonomy.
Minimise the exposure of sensitive data
By applying techniques such as anonymisation (removing data that directly identify people), masking (hiding critical information without losing usefulness) and segmentation (limiting which parts of the information are accessible to each AI system).
Design with security from the outset
Cybersecurity should not be added at the end, but built in from the design stage of any AI project: robustness testing, end-to-end encryption and continuous vulnerability review.
Evaluate and audit continuously
Security is not static. It is advisable to carry out periodic audits, penetration tests and compliance reviews to ensure that systems remain robust against changing threats.
Train employees in the responsible use of AI
The human factor is the first line of defence. Training teams on what data they can enter into an AI tool, how to interact with it and which risks to avoid is as important as the technology itself, and it aligns directly with the recommendations the AEPD addresses to both citizens and companies.
Security and privacy: from obligation to competitive advantage
Although it may be perceived as a brake, AI security should be understood as a strategic accelerator. Companies that build it into their culture and processes obtain clear benefits: greater customer trust, regulatory compliance without surprises (being aligned with the GDPR and the EU AI Act avoids penalties which, in the case of prohibited practices, can reach 35 million euros or 7% of annual worldwide turnover), more efficient processes thanks to traceability and governance, and responsible innovation that makes AI projects sustainable over time. In a context where trust is a competitive asset, security stops being a cost and becomes a differentiating advantage.
At LurNova we help you innovate with confidence
At LurNova we design and implement AI consultancy solutions that build in security, privacy and regulatory compliance from the ground up. Our approach combines our own AI models on private infrastructure, protocols such as MCP and RAG to keep data under control, traceability and explainability systems, and audit and governance frameworks that make regulatory compliance easier, both in AI agent projects and in private AI models.
In this way, your company can harness the full potential of AI without compromising what is most valuable: your customers' trust and the security of your data. Because the future of corporate artificial intelligence will be measured not only by the power of its models, but by the responsibility, security and transparency with which those models are deployed.
Co-founder and CTO of LurNova, with more than 20 years' experience in developing digital technologies. Specialised in designing secure, private and governed artificial intelligence architectures and solutions for organisations.
