Security, trust, legislation
Security, trust, legislation
Hallucinations
The model optimises plausibility, not truth. Types: invented sources, wrong numbers, outdated information, a true fact from the wrong source, an “over-eager” answer. What helps: citations and checking them, grounding, calculations by tool.
Review ladder
| Level | Output | Check |
|---|---|---|
| 1 | Internal drafts | the author checks it |
| 2 | Decision support | verify numbers and sources, disclose AI use |
| 3 | External outputs | second person + approval |
| 4 | Legal, financial, safety | AI only prepares, a human decides |
| STOP | Automated decisions about people, emotions | prohibited |
Grounding
Answer quality ≤ document quality. Watch for oversharing – Copilot sees everything the user can access.
Which data in which tool
| Data | Public AI chat | Copilot Chat | M365 Copilot / Cowork | Foundry (EU) |
|---|---|---|---|---|
| Public | ✓ | ✓ | ✓ | ✓ |
| Internal | ✕ | ✓ | ✓ | ✓ |
| Confidential | ✕ | ! | ✓ | ✓ |
| Personal data | ✕ | ! | ! | ! |
| Special-category, safety-critical | ✕ | ✕ | ! | ! |
Agent risks
- Prompt injection – EchoLeak (2025): an e-mail with hidden instructions could make M365 Copilot leak data.
- Excessive permissions – PocketOS, OpenClaw (2026).
- Runaway costs – pay-per-use.
Controls outside the agent: least privilege, approval of irreversible steps, audit, spending limits, kill switch and registry (Agent 365).
GDPR
Legal basis · transparency · DPIA · Art. 22 (a human decides) · minimisation · processor agreement. Supervisor in Slovakia: the Office for Personal Data Protection.
AI Act after the Digital Omnibus
| Date | What applies |
|---|---|
| 2/2025 | prohibitions (e.g. emotion recognition at work) + AI literacy |
| 8/2025 | general-purpose models |
| 8/2026 | transparency (Art. 50) – chatbots, deepfakes |
| 12/2027 | high risk – Annex III (hiring, rating people, road-traffic safety) |
| 8/2028 | high risk – products (Annex I) |
You are mostly a deployer; with AI in your own products, a provider. Not a legal interpretation.
An AI policy template is in the cheat sheets.