UK businesses are being warned that the rapid adoption of AI tools in the workplace is outpacing the frameworks needed to use them safely, as many organisations experiment with GPTs without clear governance, controls or accountability.
Experts working with organisations implementing AI say the risk is not the technology itself, but how it is being deployed – often informally, inconsistently and without agreed rules around data access, usage or oversight.
According to Karim Salama, founder of E-Innovate – who helps businesses to create and implement custom GPTs – this lack of structure is leading to growing exposure around data protection, accuracy and reputational risk.
AI without guardrails
In many workplaces, employees are turning to public GPT tools to draft content, summarise bulky documents or answer their day-to-day questions. While these tools can be useful, experts warn they are often being used without clear guidance on what information can be shared or how outputs should be checked.
“Public GPTs are not designed for uncontrolled workplace use,” Karim explains. “When employees paste sensitive or confidential information into open tools, businesses may be exposing data in ways they don’t fully understand.” Unrestricted prompts and inconsistent usage also increase the likelihood of misleading or unverified outputs being relied upon in day-to-day work.
In many cases, custom GPTs are being introduced to support everyday knowledge work such as drafting content, answering internal questions or summarising information. However, the same problems can emerge when a custom tool is launched without a clearly defined role.
“Before you even think about prompts or data, you should be able to describe what the GPT is there to do in a single sentence,” Karim says. “If you can’t do that, it’s unlikely the tool will deliver meaningful value, and more likely it will create confusion or inconsistency.”
Why governance matters more than speed
The issue, experts say, is that many organisations are adopting AI reactively, responding to pressure to ‘do something with AI’ rather than putting a solid framework in place first.
Karim points to recent high-profile incidents in the technology sector as a reminder of what can happen when AI systems are deployed without sufficient safeguards. In recent weeks, an AI chatbot developed for a major social media platform was criticised after being used to generate harmful and inappropriate content, prompting regulatory scrutiny in Europe and responses from UK authorities.
“AI needs the same governance thinking as any other business system,” Karim notes. “That means clearly defining who owns it, what it’s allowed to do, what data it can access and where human oversight is required. All of this should be in place before usage is rolled out.”
Custom GPTs as part of the solution
When built correctly, custom GPTs can reduce risk rather than increase it. Purpose-built tools, owned by the organisation and designed with guardrails in place, offer a much safer alternative to unmanaged public AI use.
“Custom GPTs allow businesses to control prompts and restrict data access within clear boundaries,” Karim explains. “That ownership is critical: it turns AI from a liability into a controlled business asset.”
A well-designed custom GPT is built for a specific task, given only the information it genuinely needs and used within agreed rules, rather than acting as a general-purpose assistant with unlimited reach.
The danger of ‘more data’
A common misconception is that giving AI access to more data automatically improves results. In practice, Karim explains that this often increases risk without adding value.
“In reality, the more data a GPT can see, the higher the risk,” Karim warns. “If sensitive information is included unnecessarily, you increase the chance of accidental exposure, misuse or outputs that shouldn’t exist in the first place.”
He therefore recommends a “minimum necessary” approach, where GPTs are only given access to the information they genuinely need, and sensitive data is excluded wherever possible. Limiting access this way reduces the risk of sensitive information being surfaced unintentionally or used inappropriately.
Why human oversight still matters
Even with guardrails in place, Karim stresses that AI should support decision-making, not replace it.
“AI is a powerful assistant, but it doesn’t understand context, nuance or consequence in the way people do,” he says. “Where outputs affect customers, finances or reputation, there must always be a human in the loop. Clear escalation paths and review processes are essential parts of responsible AI governance.”
Launch is just the beginning
Karim also cautions against treating AI deployment as a one-off project: once in place, system usage evolves, information changes and edge cases emerge over time.
“Governance doesn’t stop at launch,” he adds. “Without ongoing monitoring and review, even well-designed tools can drift away from their original purpose.”
A more responsible path forward
Rather than slowing innovation, Karim argues that governance enables it, allowing for a more measured, outcome-led approach.
“When these tools are built with clear purpose, limited access and proper oversight, they can genuinely improve speed and consistency,” he adds. “The risk comes from treating them as plug-and-play solutions, rather than systems that need thought, testing and ownership.”
As more businesses explore custom GPTs, Karim concludes that the organisations that will benefit most will be those that prioritise governance and guardrails.
