You don't need a new AI law. The duties already apply.
Many companies are waiting for artificial intelligence regulation before dealing with the subject. It is a comfortable wait and a poorly founded one: the two duties that weigh most already apply, and neither of them mentions AI.
They do not mention it because they do not need to. One is about personal data, wherever it sits. The other is about confidential information, whatever the route by which it leaked.
A new tool does not create an exception. It only creates one more route.
The first: personal data
Data protection law applies to any processing of personal data — including in the tool someone opened on their own, with no contract, on a free account.
The specific statute depends on where your company operates, and this text does not name yours. But the shape is the same nearly everywhere, and one part of it is worth reading closely.
In Brazil, the law lists security among the principles that govern the activity: the use of technical and administrative measures able to protect personal data from unauthorised access and from accidental or unlawful situations of destruction, loss, alteration, communication or dissemination.
Note two words: technical and administrative. Not only configuration — also what is written down and agreed.
The second, and it is the one that usually catches people
The same article carries a principle that changes the game, and almost nobody quotes it:
Accountability. In the Brazilian text: demonstration, by the agent, of the adoption of effective measures capable of proving compliance with personal data protection rules and, moreover, the effectiveness of those measures.
Read it slowly. Having been careful is not enough — you have to demonstrate it. And demonstrating that measures exist is not enough either: you have to show they are effective.
A company that does everything right and wrote nothing down is in a worse position than it thinks. Good faith cannot be demonstrated. Paper can.
★ If you are in Europe, the equivalent principle is in the GDPR and carries the same name. Check the exact wording with whoever answers for your legal side — this text is not the place to quote your statute.
And the trade secret
This one is not data protection law. In Brazil, industrial property law treats as unfair competition to disclose, exploit or make use of, without authorisation, confidential knowledge, information or data usable in industry, commerce or the provision of services.
The word that matters is confidential. Information is not confidential because someone thinks it is — it is confidential because the company treated it as such. If nobody named what is secret, and nobody was told, the protection is hard to sustain afterwards.
What that asks for in practice
No project. Three things written down:
- The list of what is confidential in your company — named, not assumed.
- The rule of use, saying what is allowed and what is not, by type of information.
- The acknowledgement of whoever works there — the record that the person read it, understood it and committed to it.
Together they turn "we were careful" into something you can present. And the third is the one that is almost always missing: without it, the policy exists and nobody can prove anyone knew about it.
The deadline that does not exist
There is no marked date here. That is the deceptive part.
A duty with no deadline demands nothing — until the day someone asks. It may be a client at contract renewal, an audit, or an incident. In all three the question is the same: what did you do to prevent this?
And at that moment, the answer is either written down or it does not exist.
This text describes general duties and is not legal advice. The Brazilian passages were checked against the official texts of Law 13.709/2018 and Law 9.279/1996 on the Planalto website; the translations are ours. For your company's specific case, and for the statute that applies where you operate, consult a lawyer.