What information do we share with generative artificial intelligence tools? And what risks do companies face?
As part of Cyber Security Month 2026, on 5 October, the National Cyber Security Centre (NCSC) published an in-depth analysis of the phenomenon of oversharing, namely the excessive sharing of information.
This initiative is part of a campaign that also involves collaboration with the Federal Data Protection and Information Commissioner (FDPIC) on the appropriate use of artificial intelligence in the workplace.
The risk does not concern personal data alone.
Apparently harmless information, when combined, can make it possible to reconstruct
detailed profiles of individuals, facilitating targeted phishing, identity theft and fraud.
With the use of chatbots, AI assistants and document summarisation tools, the risk also extends to confidential business information, internal documents and trade secrets.
What information do we share with generative artificial intelligence tools? And what risks do companies face?
We are not dealing with new obligations introduced by the FADP or new binding guidelines, but rather with an institutional reminder that confirms the importance of AI governance based on practical risk management.
What should we do?
Organisations should adopt or update a Policy on the Use of GenAI Tools, providing for:
- A classification of information that may be entered into AI tools.
- The identification of authorised tools and the related restrictions.
- Measures for data minimisation, anonymisation and information protection.
- Training and accountability of employees.
The challenge is not to prohibit generative AI, but to govern its use in an informed and secure manner.
For Privacy Desk Suisse, this represents a concrete example of the integration of FADP Compliance, AI Governance and Cybersecurity.
