In almost every organization of twenty-five to a hundred people we meet, the same situation: Copilot is switched on, someone connected an assistant to the shared drive, the CRM vendor added a model last quarter. And nobody can say where the data goes, or what these tools can do in the company’s name.
A language model — ChatGPT, Copilot, Claude — predicts the probable continuation of a text; we defined it in the previous piece. What matters here is that it no longer just answers: connected to your systems, it reads your files, writes into your tools, sends messages. So the question is not “are we using AI?” — it is already being used. The question is: what is connected to what?
Here is the method we use to answer, in four layers. Each layer is a question, and each question has a way of finding its answer.
Which models and tools are in use, approved or not? Found through interviews, the admin consoles — the interface where an administrator manages accounts and permissions — and the expense lines. The third one is often the surprise: the tools IT has never heard of, paid for with a credit card by a department that only wanted to move.
What goes in: pasted text, uploaded files, connected mailboxes and shared drives, and content from outside — inbound email, web pages? We walk each tool with the person who uses it. Not their manager: the user. That is where you see what is actually being pasted into a chat window.
What can it do: write text only, or also change files, send messages, run code, call other systems? The answer is in the permissions and the connector settings — the connections between a tool and your mailboxes, drives and databases. A model that only writes text is a leak risk; a model that can act is an action risk. They are not the same.
Where is it processed and stored, by whom, kept how long, used for training or not? The answer is in the vendor’s terms and the account settings. This is the layer management wants to see first, because it is the one the law looks at.
Once the four layers are mapped, one test is enough to rank. Any place where three things meet goes first: private data, content from outside the organization, and a way to send something out.
Why that trio? Because of prompt injection: text written by an attacker, hidden in an email, a web page or a document, that steers the model in place of the user. It is the number-one risk in the OWASP ranking for language models, and Simon Willison gave its clearest formulation: the worst that can happen is the model doing something harmful with your permissions. A model that reads untrusted content while holding private data and having an outbound channel can be steered by that content. Not in theory: it is documented, and connectors are multiplying faster than the guardrails.
A model with only one of the three is an ordinary risk. All three together is an incident waiting for a date.
Two weeks, fixed price, and you receive: the map — one page, every tool, what enters it, what leaves it, what it can act on; the ranked risks, each with what could happen and what to do; three lists — what to stop, fix and allow; and a one-page usage policy.
It is not a penetration test — a simulated attack against your systems — not a compliance certification, not a legal opinion. It is architecture and exposure mapping by people who build these systems.
One last thing, specific to Quebec: Law 25, the province’s private-sector privacy law, requires an impact assessment — in French, an ÉFVP — for any project that touches personal information. The map supplies the facts such an assessment asks for; it does not replace it, and it is not legal advice (Blakes, the Canadian law firm, on the law).
The opening question was: what is connected to what? Two weeks later, the answer fits on one page — and you decide with facts.