Before AI touches client data, a business should know what data is sensitive, where it is stored, who can access it, and which tools can retain or train on inputs. Clear rules, approved tools, and a review process matter more than broad permission to experiment.