Blog Post
How Regulated Data Leaks Through AI, One Paste at a Time
August 9, 2026
A support coordinator has a difficult letter to write. The customer record is open in one tab, a consumer AI assistant in another, and the deadline is this afternoon. She selects the record, copies it, pastes it into the prompt box, and asks for a polite draft. Thirty seconds later she has a good letter and a regulatory problem, and nobody in the organization knows about either.
The sequence below traces that single action through to its consequences. It is a constructed example rather than a specific incident, assembled from how the controls, the contracts and the regulations behave in practice. Nothing in it requires anyone to act maliciously or break a stated rule.
Second Zero: The Paste
Copying happens inside the browser and never touches the network. Pasting sends the content outbound as text inside an encrypted session to a domain the organization has not blocked, since blocking it would stop a tool half the company finds useful. No file moves, no attachment uploads, no email leaves. The action resembles typing.
What travels is more than the question. Reformatting a record means pasting the whole record, so the account number, the date of birth and the case notes accompany the two sentences that needed rewriting. Minimization is a discipline nobody applies to a clipboard. Reviewing what personal information a routine record contains usually surprises the team that handles it daily.
What Left the Building
Content submitted to a consumer tier enters the provider's infrastructure under consumer terms. Retention windows apply for abuse monitoring even where training on inputs is disabled, and the organization holds no contractual right to inspect, retrieve or delete what was submitted. The data now exists in a system the organization cannot audit. Establishing what a vendor may receive is ordinarily a procurement question, and third-party AI vendor assessment never happened because nobody bought anything.
The Threshold Is Lower Than People Assume
Protected health information covers eighteen identifiers when linked to health information, so a first name alongside a diagnosis already qualifies. Payment card data carries its own scope consequences, and personal data under European rules needs only to render a person identifiable. Reviewing which sensitive data categories apply usually reveals that the threshold sits well below what employees picture when they hear regulated data.
Why Nothing Fired
Every control in a typical stack was working correctly and watching something else. The failure is architectural rather than operational, which is why the paste generates no alert anywhere.
Network filtering resolved a permitted domain and stopped there, since inspecting content inside an authorized encrypted session is not what it does. Endpoint tooling watched files and processes while the sensitive act was text in a page. Data loss prevention rules tuned for email attachments and file transfers never evaluated a clipboard operation. Identity logs recorded a successful login hours earlier and nothing since. Each layer performed its function, and AI data leakage occurred in the space between them.
The Tool Was Never Assessed
The assistant in question sits in the category most organizations discover late. Employees adopted it individually, it never entered procurement, and no assessment established what data it may receive. Shadow AI of this kind rarely announces itself, and the coordinator had no reason to believe she was using anything unapproved.
What the Law Says Happened
Several regimes engage at once, and none of them care that the intent was efficiency. Where health information is involved, disclosure to a vendor requires an executed business associate agreement before the disclosure occurs, and consumer tiers generally do not offer one. Absent that agreement, the disclosure is impermissible regardless of how secure the provider's infrastructure happens to be.
European rules add a processor relationship nobody established and a lawful basis nobody identified. Card data leaving its controlled environment carries scope consequences of its own. Contractual confidentiality owed to the customer sits underneath all of it, independent of any regulator. Reading these together is what emerging AI regulation means in practice for an ordinary support workflow.
Impermissible Disclosure Is Not Automatically a Reportable Breach
The distinction gets collapsed constantly and it matters. An impermissible disclosure occurred at the moment of the paste. Whether it constitutes a reportable breach depends on a documented risk assessment weighing the nature of the data, who received it, whether it was acquired or viewed, and the extent to which exposure was mitigated. Skipping that assessment is its own failure, and performing it requires facts the organization does not have.
Opting Out Afterward Does Not Cure It
Disabling training or deleting the conversation addresses the future rather than the event. The disclosure completed when the data left the organization's control, and subsequent settings changes do not retract it. Treating a deletion as remediation produces a record that looks like a cover rather than a response.
The Investigation You Cannot Run
Suppose the organization learns about this six weeks later, through a colleague mentioning the shortcut in a meeting. The questions that follow are the ones an investigation always asks, and most of them have no available answer.
How many records were involved, across how many sessions, by how many people. Which fields were included. Whether any of it reached a human reviewer. Whether it persists. The organization holds no log of the paste, no copy of the submission and no contractual right to ask the provider. An incident process that depends on evidence nobody captured cannot reach a defensible conclusion, which leaves the notification decision resting on assumption.
Where It Could Have Stopped
Six intervention points existed before the paste completed, and they differ in cost rather than in kind.
- Sanctioning: An approved assistant under enterprise terms would have made the same action lawful.
- Detection at the Keystroke: Inspecting content leaving the browser catches the pattern the network layer cannot see.
- Redaction: Stripping the identifier while allowing the request through preserves the work and removes the exposure.
Three softer interventions sit alongside those. Policy naming the specific action rather than describing responsible use gives an employee something to follow, and enforcing an acceptable use policy depends on that specificity. Discovery would have surfaced the assistant before it carried regulated data, and an AI asset inventory is what makes that possible. Ownership would have given someone the job of noticing. None of the six requires blocking the tool, which matters because blocking moves the same activity to a personal device where none of the six applies.
Warning Beats Blocking for Judgment Calls
Hard blocks suit categories with no legitimate use, and credentials are the obvious case. Most regulated data does have legitimate uses, so a warning that names the category and offers the sanctioned alternative preserves the work while creating the record a later investigation needs. Enforcement at that layer is the argument for treating the browser as the perimeter.
What Reduces This
Reducing exposure here is a sequencing problem rather than a tooling problem. Discovery comes first, because nothing can be governed while the estate is unknown, and tracking AI use across business units establishes which assistants people already rely on. Sanctioning follows, since the fastest route away from consumer tiers is providing something better with the right agreement behind it.
Enforcement comes third and should be graduated rather than binary. Evidence comes fourth, and it is the part organizations skip. Records tying each detection to a person, an application and a timestamp are what convert a future incident from an unanswerable question into a bounded one. Maintaining that alongside AI asset visibility keeps the two halves on one record.
The Employee Is Not the Control
Training helps and it does not scale to every deadline. The coordinator in this trace behaved reasonably given what she knew, and a program depending on every employee correctly classifying data under time pressure has chosen the weakest available control. Designing for the paste that will happen produces better outcomes than designing for the one that should not.
The Exposure That Generates No Alert
Regulated data leaves most organizations in small quantities through ordinary actions by competent people, and the aggregate is larger than any single incident would suggest. Nothing in this trace involved an attacker, a vulnerability or a policy violation anyone recognized at the time. Kovrr's AI Security and Governance Platform surfaces which assistants are in use, what categories of data reach them, and which interactions warrant a warning rather than a block.
To see which regulated data categories are reaching AI tools in your environment today, book a demo mapped to your own estate.
