Talk about connecting AI to enterprise systems and people think of Microsoft, of connectors, of gateways. The data travels a different way today. Somebody exports a list to CSV, uploads it to ChatGPT, and asks. That is not the exception. It is the default, and it is the only integration that is already running in every company.
A Tuesday
A clerk in accounts receivable needs the overdue invoices for Germany, Austria and Switzerland, grouped by account manager, for a call at two. The report does not exist in that shape. The ticket for a new report has a three-week lead time. So he opens the ERP, filters the open items, exports to CSV, drags the file into ChatGPT and types the question. Twenty seconds later he has the table, with totals, sorted the way the call needs it.
It is the third time he has done this since Monday. The file has the customer name, the address, the contact person's email, the payment terms and the outstanding amount. He did not think about the file. He thought about the call at two.
Why this is the rational thing to do
He is not careless. He has one tool that answers his question and another that takes three weeks. The compliance rule loses to that comparison, every time, in every department, and no reminder changes the arithmetic. The person in this scene is not the problem. The missing alternative is.
This matters for how you read the rest. If you go looking for the employee who did it, you will find one in every team, and you will have found nothing. If you go looking for the reason he had no better option, you are looking at the actual gap.
What actually leaves
Four things happen in the twenty seconds between export and answer, and none of them shows up anywhere.
- Complete records leave. The export carries every column the screen had, including the ones that had no business in the question. The model needed the amount and the account manager. It received the contact's email and the payment terms too.
- There is no log. No who, no when, no what. The ERP logged an export by an authorized user. The AI provider logged an upload by an account holder. Nobody logged that these two events were the same thing.
- Permissions end at the export. The source system knew exactly which rows this person may see. The file does not. Whoever may pull the list may upload it, and from that point the system's access model is a memory.
- The file sits with a provider under someone else's law. In most cases that is US law. Microsoft's own legal counsel in France told the French Senate in June 2025 that he could not guarantee data would stay out of US authorities' hands. That was under oath, about EU data centres, from the vendor most European companies trust most.
Now multiply. It is not one clerk. Sales pulls the pipeline before the forecast call, HR pastes the headcount list before the budget round, the service desk uploads last month's tickets to find the pattern. Each of them is answering a real question with the only tool that answers it in time, and each of them produces the same four gaps.
The rules that apply are not new. The EU AI Act puts obligations on deployers in Article 26, including human oversight and using the system as instructed. GDPR wants a processor contract under Article 28 and a legal basis for third-country transfers under Articles 44 and following. For financial institutions, DORA adds ICT third-party risk management. All of it applies to the Tuesday above. None of it is being applied, because nobody can see the Tuesday.
Why bans do not work
Blocking ChatGPT on the corporate network moves the upload to the personal phone, where the file goes through a photo of the screen or a private email. Upload filters do not recognise a spreadsheet with customer names as sensitive, because a spreadsheet with customer names looks like every other spreadsheet. Training works for about two weeks, then the next call at two arrives.
One lever has ever worked, in security and everywhere else: the permitted path has to be faster than the forbidden one. Not equally fast. Faster.
What the permitted path has to look like
Take the same Tuesday and remove the export. The clerk asks his question in the assistant he already has open. The answer comes from the ERP itself, through a connection that signed him in with his company account, so the system applies his permissions, not the permissions of whoever set up the connection. Personal fields are masked before the request leaves the network: the model groups by account manager, it never receives the contact's email. Every call is written to a log with his name, the time, and the tool that was used.
For him this is less work, not more. No export, no upload, no file on the desktop that he will forget to delete. For compliance it is the first time the Tuesday is visible. For IT it is one connection to govern instead of a habit to chase.
The question is not whether
The question to ask yourself is not whether to connect AI to your systems. That happened, some time ago, in every department, through the export button. The question is whether you can see the connection. Today it runs without you. Loopthink is one way to make it run with you: the same assistant, the system's own permissions, personal fields masked before anything leaves, and one audit log across every assistant your people use.
If your architect now asks how that is done technically, and why the obvious Microsoft route does not get there on its own, the answer is in the companion article: Can you use the Microsoft SQL MCP Server with SSO in Claude? The longer version, for the security review, is the whitepaper.