AI Data Exposure: What Samsung’s ChatGPT Incident Teaches Us About AI Governance
Updated: Oct 5
AI did not arrive in the workplace on a neat implementation schedule. Employees began finding useful ways to apply it almost as soon as the tools became available: debugging code, summarizing documents, analyzing information, drafting communications, and cutting down repetitive work.
That created real productivity gains. It also created a problem many organizations were not ready for.
Samsung Electronics provided one of the earliest widely reported examples. In 2023, shortly after ChatGPT became available for use within Samsung's semiconductor operations, employees reportedly entered sensitive company information into the service while trying to solve legitimate work problems.
One employee submitted source code from a semiconductor database program while looking for help fixing an error. Another entered code used to identify defective equipment and asked for optimization help. A third converted an internal meeting recording into text and used ChatGPT to generate meeting minutes.
None of those examples involved someone trying to steal company information. They were trying to do their jobs.
That is what makes the Samsung case more useful than a simple warning about careless employees. It shows what can happen when access to a powerful new technology develops faster than the rules, technical safeguards, and business processes surrounding its use.
What Actually Happened at Samsung
The Samsung incidents are sometimes described as an example of Shadow AI, but that label does not quite fit what happened.
Shadow AI generally involves AI tools or use cases that develop outside an organization's established approval or governance processes. An employee may start using a public chatbot without telling anyone. A department may adopt an AI-enabled service before security or procurement evaluates it. An approved product may gain new AI capabilities that no one has reviewed.
Samsung's situation was different. Contemporary reporting indicates that the company had previously restricted ChatGPT and then permitted engineers in its semiconductor division to use it. The reported incidents followed soon afterward.
The employees were not necessarily sneaking around a ban. The technology itself had been permitted.
The governance around its use had not caught up.
Approving an AI tool
is not the same as governing it.
Without those answers, employees are left to work out the boundaries themselves.
The Data Exposure Problem Is More Complicated Than “Don't Use AI”
AI-related data exposure can begin with a completely ordinary task.
A developer wants help debugging code. A manager has a long document to summarize. An analyst wants assistance with a spreadsheet. Someone wants meeting notes converted into action items.
To get a useful result, the employee gives the system context.
That context may contain source code, customer information, internal reports, financial data, strategic plans, employee records, confidential meeting notes, trade secrets, or other information the organization would not normally send to an unknown third party.
The employee is thinking about the task.
The organization also has to think about what happens to the information used to complete it.
The answer is not the same for every AI service. Data handling can differ by provider, product, account type, configuration, contractual terms, retention settings, integrations, and whether an organization is using a consumer service, business product, enterprise deployment, or API.
That makes blanket guidance such as "never put company data into AI" easy to understand but too crude to serve as a complete governance model.
A better question is:
Which system are we using, for which purpose, with what information, and under what protections?
Employees should not have to research vendor contracts, retention rules, training settings, privacy terms, and intellectual-property implications every time they want help with a spreadsheet.
Those decisions belong at the organizational level.
The Employee Is Only One Part of the Control Environment
Samsung's engineers were technical professionals using a new technology to solve real work problems.
That should change the analysis.
Human behavior still matters. Someone ultimately decides what to paste into an AI system, whether to rely on an answer, or how to use the output.
But that decision is made inside an environment created by the organization.
Employees respond to deadlines, productivity expectations, available tools, leadership behavior, policies, technical restrictions, incentives, training, and the way work is actually performed. They are routinely rewarded for solving problems faster and finding more efficient ways to work.
Generative AI is very good at appealing to exactly those incentives.
If an organization permits AI but gives employees little practical guidance about data or acceptable use cases, it should expect inconsistent decisions.
A complete response cannot stop at telling employees to be more careful.
Restriction Can Be Useful. It Is Not a Strategy.
After the incidents, Samsung reportedly restricted employee use of external generative-AI services on company devices. Bloomberg reported that the company was concerned about data being stored on external servers and the difficulty of retrieving or deleting information once submitted. Samsung was also reportedly working on internal AI capabilities.
Restricting a technology can be a perfectly reasonable short-term response.
An organization may need time to understand how a service handles information, review contractual protections, identify acceptable use cases, configure controls, or determine whether a safer deployment option exists.
But removing the tool does not remove the problem employees were trying to solve.
The developer still needs to debug code. The analyst still has work to analyze. The manager still has a forty-page document and a deadline.
If the organization removes one path without addressing the business need behind it, employees are left with the original problem.
That creates a practical question:
If we restrict this tool, what are we giving employees instead?
Restriction can create breathing room.
Governance has to decide what comes next.
Visibility Has to Go Beyond a List of AI Products
The Samsung incident was not a textbook Shadow AI case, but Shadow AI is part of the same governance problem.
Employees can find new tools before formal review processes catch up. AI capabilities can also appear inside software that was already approved. A meeting platform adds an AI assistant. A browser introduces summarization. A CRM adds content generation. A coding environment adds a copilot.
A tool inventory is useful, but knowing that employees have access to ChatGPT, Copilot, Gemini, Claude, or another platform does not tell leadership what is actually happening.
Useful visibility goes further:
The same tool can represent very different levels of risk depending on the use case.
Using AI to improve the wording of a routine email is not the same as submitting proprietary source code. Brainstorming presentation ideas is not the same as uploading customer records. Generating a draft for review is not the same as allowing an AI output to drive a consequential decision with no human check.
Governance needs to see the work, not just the software.
Existing Data Governance Still Applies
Most organizations already have rules for information.
They classify data. Restrict access. Set confidentiality requirements. Review vendors. Establish retention schedules. Define privacy obligations. Control how sensitive information can be shared.
AI should not exist outside that structure.
Instead, organizations need to work out how those existing rules apply when information is supplied to an AI system.
Can employees enter public information? Routine internal material? Customer information? Source code? Personal data? Regulated information? Trade secrets? Confidential client documents?
There may not be one answer that applies to every system.
And that is precisely why a policy that says only "AI is approved" or "AI is prohibited" does not get very far.
NIST's AI Risk Management Framework takes a broader approach. Its Govern function addresses organizational policies, roles, accountability, risk-management processes, and the relationship between AI risk and existing organizational practices. The accompanying Playbook provides suggested actions organizations can adapt to their own context.
Product and Account Type Matter
The Samsung incident also points to a distinction that becomes more important as AI products mature: the name on the tool is not enough to determine the risk.
Data practices can differ substantially between products offered by the same provider.
OpenAI, for example, introduced additional ChatGPT data controls in April 2023 and stated at the time that its planned business offering would follow its API data policies, under which business data would not be used to train models by default.
Current OpenAI business documentation states that data from its business products and API platform is not used to train its models by default and describes additional security, retention, encryption, and administrative controls.
That does not mean an organization should automatically approve any particular product. It demonstrates why governance needs more precision than a rule based only on a company or product name.
The same analysis applies to other AI providers.
Security Culture Affects What the Organization Can See
Policies and technical controls can create visibility.
Employees create another kind.
Suppose someone discovers an AI tool that cuts a frustrating four-hour task down to twenty minutes. What happens if they tell the organization?
If employees expect every question about AI to end with a ban, some will stop asking questions.
The organization may feel more controlled while actually becoming less informed.
Employees often know where useful AI applications are emerging before leadership does. They know which workflows are slow, where existing software falls short, and which tasks are being held together by manual work.
A useful culture makes room for someone to say:
"I found a tool that helps me do this. Can we figure out whether I can use it safely?"
That is not a governance failure. It is useful information.
The same principle matters after a mistake. If an employee realizes that something sensitive may have been submitted to an inappropriate system, the organization needs to know quickly enough to assess what happened and respond.
Punishing every disclosure creates an obvious incentive: don't disclose.
Then the organization has two problems; the original exposure and the fact that it may not know about it.
What Organizations Should Learn From Samsung
The lesson from Samsung is not that employees cannot be trusted with AI. It is that useful technology needs usable rules.
Employees should be able to answer basic questions without becoming experts in AI contracts or data architecture. Which systems are approved? What can each one be used for? What types of information are allowed? Which activities need additional review? Who can approve a new tool or use case? Where should someone go when the existing guidance does not fit the situation?
Organizations also need an answer for accidents.
If someone enters information they should not have, who should they tell? What happens next? Can the organization determine what information was involved, which service received it, what contractual or technical conditions applied, and whether further action is needed?
Those are operational questions.
A policy matters, but it is only one part of the answer.
Practical AI governance also requires approved options, clear responsibility, understandable data rules, vendor review, escalation paths, appropriate technical controls, and a culture in which employees can ask questions beforehand and report problems afterward.
Comments