Combine approved AI tools, staff training, and technical controls for the workflows you support. NeutralAI can mask detected identifiers before model submission on supported sites and integrations. Coverage depends on configuration, and detection can miss sensitive content; review the remaining text and define which documents are permitted.
Why bans and training keep failing
Samsung’s experience is the canonical example: within roughly twenty days of allowing ChatGPT, engineers had pasted proprietary source code and meeting notes into it three times — not sabotage, just people trying to work faster. The company banned generative AI outright, trading the leak risk for a permanent productivity tax and zero visibility into what still happens on personal devices.
Training suffers a quieter failure: it depends on a busy person remembering the rule at the exact moment they paste. Data from DLP vendor Cyberhaven suggests a small fraction of employees account for the large majority of sensitive pastes — and they are usually the heaviest, most productive AI users.
What a point-of-use control looks like
A browser extension sits on the AI sites staff already use. When someone types or uploads content containing PII — names, emails, phone numbers, NI or NHS numbers, account references — the identifiers are detected and replaced with placeholders before submission. The person keeps working; the model still gets a coherent prompt; detected identifiers are replaced on supported inputs. Local mode processes on the device; remote mode processes at the configured gateway.
Coverage depends on the supported site or integration and the configured processing mode. Where telemetry is enabled, category-level events can help reviewers understand which controls ran; they do not establish that every sensitive value was detected.
The short version
- Bans push usage to personal devices — the risk goes invisible, not away.
- Training fails at the moment of deadline pressure; the heaviest AI users paste the most.
- Enterprise contracts cover one tool; staff use many.
- Masking applies to supported tools; available audit evidence depends on the configured telemetry.
Related questions
Does blocking AI sites at the firewall work?
Partially, on managed networks — and not at all on phones or home connections. The tribunal case and the Samsung leaks both happened around policies, not in their absence. Blocking also removes the productivity benefit rather than making it safe.
Will masking break the usefulness of the AI answer?
Rarely. Most legal, financial, and operational questions do not depend on real names — a structurally faithful placeholder preserves the reasoning task. Where the real values matter for reading the answer, reversible tokenisation can restore them through the configured local or gateway path after the response returns.
How fast can this be deployed?
A browser extension installs in minutes per user, and enterprise policy tooling can force-install it across managed browsers. No network changes and no security team required.
This page is general information, not legal advice. Where third-party guidance or law is summarised, read the originals via the source links before relying on them. Last reviewed: 17 July 2026.
This is the control in action
Identifiable data is masked in the browser before the prompt ever leaves — try it yourself with a sample prompt, or bring one low-risk workflow to a 20-minute review.
Advise Sarah Thompson, NI AB123456C, on the settlement offer.
Advise <PERSON_7K9X>, NI <NI_8W1R>, on the settlement offer.