AI tools: Language models

General-purpose chat assistants and language models. This is the category that receives the highest volume of corporate data pasted into a text box, and the one that shows up most often in Shadow AI leak incidents.

Critical exposure:

Direct harm is possible: identity fraud, biometric data, or autonomous action without oversight.

High exposure:

Naturally receives sensitive corporate data: source code, contracts, customer records.

Moderate exposure:

Risk depends on what goes in. Requires an explicit classification in your policy.

Low exposure:

Narrow scope and clear vendor governance. A candidate for the allowed list.