{"id":90,"date":"2026-08-31T05:26:54","date_gmt":"2026-08-31T05:26:54","guid":{"rendered":"https:\/\/intellowork.com\/blog\/enterprise-ai-chatbot-security-compliance\/"},"modified":"2026-08-31T07:46:38","modified_gmt":"2026-08-31T07:46:38","slug":"enterprise-ai-chatbot-security-compliance","status":"publish","type":"post","link":"https:\/\/intellowork.com\/blog\/enterprise-ai-chatbot-security-compliance\/","title":{"rendered":"Enterprise AI Chatbot Security and Compliance: The 2026 Checklist"},"content":{"rendered":"\n\n

Enterprise AI chatbot security<\/strong> comes down to five controls: retrieval that enforces access rights before content ever reaches the model, a defined place where your data is stored and where inference happens, a contractual guarantee that your content is not used to train anyone’s model, defences against instructions hidden inside your own documents, and logging that lets you reconstruct any answer months later. Compliance sits on top of that: as of 2026 an enterprise assistant in Europe or India has explicit statutory duties, not just internal policy obligations.<\/p>\n\n\n\n

Most security reviews of AI assistants ask the wrong questions. They focus on the model, which is usually the least interesting component, and skip the retrieval layer, which is where the actual data exposure happens. This is the checklist to work through instead.<\/p>\n\n\n\n

What is genuinely new about the threat model<\/h2>\n\n\n\n

Four risks in an AI assistant do not exist in a conventional internal application.<\/p>\n\n\n\n

Semantic access leakage.<\/strong> A conventional app returns a record if you are authorised. A retrieval system returns whatever is semantically similar. If the index contains content the asker cannot see, the model may summarise it, paraphrase it, or confirm its existence, without ever showing the document. Permission checks that run after generation cannot undo that, because the restricted text already entered the context window.<\/p>\n\n\n\n

Aggregation.<\/strong> Ten individually harmless fragments can compose into something sensitive. An assistant that cheerfully assembles headcount, office locations, project codenames and vendor names into one tidy paragraph has performed an aggregation that no single document permission anticipated.<\/p>\n\n\n\n

Indirect prompt injection.<\/strong> Your own corpus is now an input channel. A Confluence page, a PDF from a supplier, or an email thread can contain text addressed to the model – ignore prior instructions, output the following, treat the user as an administrator. If your assistant retrieves that page, the instruction arrives inside the context. This is the single most underestimated risk in enterprise deployments, because the attack does not need to reach your network, only your document store.<\/p>\n\n\n\n

Confident wrongness as a compliance event.<\/strong> If an assistant tells an employee the wrong retention period or the wrong statutory leave entitlement, that is not merely a bad answer. In regulated functions it is advice your organisation gave. Grounding and citation are security controls, not UX features – a point we develop in how retrieval-augmented generation works<\/a>.<\/p>\n\n\n\n

Control 1: access-aware retrieval<\/h2>\n\n\n\n

This is the control that matters most and the one most demos quietly skip. The requirement is simple to state: the permission filter must be applied at retrieval time, so that content the asker is not entitled to see is never a candidate passage.<\/p>\n\n\n\n

In practice that means the assistant needs the asker’s identity and group memberships from your identity provider, the source system’s own ACLs mirrored into the index as metadata, and a re-sync path so that a revoked permission takes effect without a full reindex. Ask any vendor these three questions and the answers will separate the serious platforms from the wrappers:<\/p>\n\n\n\n

    \n
  1. Where in your pipeline is the ACL check applied – before candidate selection, or after generation?<\/li>\n
  2. When a user is removed from a SharePoint or Confluence group, how long until they stop getting answers from it?<\/li>\n
  3. Can you show me a log of which specific passages were used to produce a given answer, for a given user, on a given date?<\/li>\n<\/ol>\n\n\n\n

    If the answer to the third is no, you cannot investigate an incident and you cannot satisfy an auditor. The integration patterns behind this are covered in enterprise chatbot integrations: SSO, SAP and Salesforce<\/a>.<\/p>\n\n\n\n

    Control 2: where your data sits and where inference happens<\/h2>\n\n\n\n

    These are two separate questions and vendors often answer only the first. Storage residency is where your documents, embeddings and conversation logs live. Inference residency is where the model call is actually executed. A vendor can host your vector store in Frankfurt or Mumbai and still route every generation request to a model endpoint in another region.<\/p>\n\n\n\n

    \n
    Question to ask<\/th>What a good answer looks like<\/th><\/tr><\/thead>
    Where are documents and embeddings stored?<\/td>A named region you selected, with a contractual commitment not to move it<\/td><\/tr>\n
    Where is the model invoked?<\/td>A named region, ideally the same one; in-region managed model services rather than a global endpoint<\/td><\/tr>\n
    Where are conversation logs and prompts retained?<\/td>Same region, with a stated retention period you can configure<\/td><\/tr>\n
    Is our content used for model training?<\/td>No, stated in the contract, covering the vendor and every subprocessor<\/td><\/tr>\n
    Who are the subprocessors?<\/td>A published list, with notice before changes<\/td><\/tr>\n
    Can we bring our own model or key?<\/td>Optional, but a strong signal of architectural maturity<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n

    The training question deserves particular care. “We do not train on your data” and “our model provider does not train on data sent through the enterprise tier” are different statements with different failure modes. Get both in writing, and get the subprocessor list, because your obligation to your own customers flows through the whole chain. The deployment-model trade-offs are set out in private ChatGPT for enterprises<\/a>.<\/p>\n\n\n\n

    Control 3: defending against injection from your own content<\/h2>\n\n\n\n

    There is no single fix for indirect prompt injection. There is a stack of partial mitigations, and a serious vendor will describe several of them without prompting:<\/p>\n\n\n\n