Skip to content
NL Plan a start sprint

Compliance and security

AI and information security: the risks and what to do about them

David Homan · 3 min read

The short answer

AI applications bring a few risks that classic software does not have: data that ends up with a model through prompts, manipulation through text the model reads (prompt injection) and agents that are allowed to do more than they need. You control them with the same approach as the rest of your information security: knowing which data goes where, limiting rights, logging and testing.

What is different about AI security?

An AI application is software, so everything you already do for security still applies. AI adds a few risks of its own:

  • Data leaking through prompts. Staff paste contracts, customer files or source code into an AI tool. Depending on the terms, that information may stay with the provider.
  • Prompt injection. A model reads text from outside, such as an email or web page, and carries out the instructions hidden in it. An assistant that summarises email can be tricked into forwarding information this way. It tops the OWASP list for applications built on language models.
  • Agents with too many rights. An agent that operates systems itself can do everything its account can do. A mistake or manipulation then has immediate consequences.
  • Dependence on one provider. If the provider changes its model, terms or price, your application changes with it.
  • Hosting and jurisdiction. Where the model runs and where the data sits decides which law applies.

What to do about each risk

RiskMeasureWho arranges it
Data through promptsBusiness tools with agreements, data classes, trainingIT and compliance, through the AI policy
Prompt injectionKeep outside input apart from instructions, check output, have sensitive actions confirmedDevelopers
Agents with too many rightsLeast privilege, a person approves sensitive actions, log everythingDevelopers and operations
One providerA model-agnostic build, documentation, an exit planArchitect and procurement
Hosting and jurisdictionChoose deliberately where the model and the data sit, data processing agreementsIT, privacy and procurement

AI within ISO 27001

AI applications belong in your existing information security. What you add to your management system:

  1. Inventory: AI applications and AI features in existing software in your asset register.
  2. Risk assessment: the risks above, per application.
  3. Supplier management: the terms of model providers, where they store data and whether they use it for training.
  4. Logging and monitoring: what the application does, who uses it and what goes wrong.
  5. Testing: on top of your usual tests, tests aimed at prompt injection and misuse.

If your organisation falls under NIS2, your AI applications fall under the same duty of care as your other systems. In the Netherlands NIS2 is implemented in the Cyberbeveiligingswet (Cybersecurity Act), in force since 15 August 2026.

Hosting and jurisdiction

Three questions decide much of your risk: where the model runs, where the data sits, and which law the provider falls under. The US CLOUD Act can oblige American companies to hand over data they control, even when it is stored in a European data centre. So for sensitive data, choose deliberately: a European provider, or your own servers. Read more in AI on your own servers and self-hosted AI.

What AI Heroes does here

  • We carry out security reviews and penetration tests of AI applications, including ones we did not build ourselves.
  • In every build logging, least privilege, human oversight and documentation are part of the design. We build model-agnostic, with European hosting as an option.
  • We are working towards ISO 27001 certification ourselves.

The assistant on this site is an example: it runs in Frankfurt with a database in the EU, keeps conversations pseudonymised for at most 30 days and is described on the transparency page.

Sources

Frequently asked questions

Is it safe to put company data into ChatGPT or Copilot?

With a business version, sound contractual agreements and clear rules about which data may go in, it can be done responsibly. With free consumer accounts you have little control over what happens to your data. Record it in your AI policy.

What is prompt injection?

An attack in which someone hides instructions in text the model reads, such as an email, document or web page. The model then carries out those instructions as if they came from the user. It is the best‑known risk on the OWASP list for applications built on language models.

Should AI be in our ISO 27001 scope?

If AI applications work with your information, they belong in your risk assessment and your supplier management. Usually you extend what you already do. If you want to go further, look at ISO 42001.

Does NIS2 cover AI?

NIS2 is about the organisation, not about a technology. If you fall under NIS2 (in the Netherlands the Cyberbeveiligingswet, in force since 15 August 2026), your AI applications fall under the same duty of care as your other systems.

Where does an AI model actually run?

With the model provider, in a cloud you choose, or on your own servers. That decides where your data goes and under which law. Read AI on your own servers.

Want to know how secure your AI application is? We carry out security reviews and penetration tests of AI applications, and build security in from the first version.

Have your AI application tested

Further reading