AI Without Risk: Data Protection and Responsible AI in Jersey
Jovana Lazarevska
Almost every conversation we have with local businesses about AI ends up in the same place.
“That all sounds great. But is our data actually safe?”
It is a fair question and one that deserves a proper answer. So for our 9th webinar we brought in Jersey’s data protection regulator JOIC and Paul Bryan from Propel Forward to work through it honestly. No sales pitch. No scaremongering. Just a straightforward conversation about what businesses actually need to do before they start rolling out AI tools.
Watch the full recording here:
Where most businesses start (and why it goes wrong)
The most common mistake we see is businesses adopting AI because someone at a networking event mentioned it, not because they have thought through what problem they are trying to solve.
Paul’s advice was simple: start with a use case. Understand what the AI is going to do for you, what data it will touch, and what is already happening inside your business. Because more often than not, your staff are already using AI tools you do not know about. That is your starting point.
The Microsoft Copilot assumption
One of the most useful parts of the session was unpicking something we hear constantly: “we use Microsoft, so we are fine.”
Using Copilot inside your tenant is genuinely lower risk than pasting data into ChatGPT. But it is not the same as storing something in SharePoint. As soon as you plug an enterprise AI tool into your systems, it will surface everything it can find. If your file permissions are not set up correctly, if you have got 16 versions of the same employee contract floating around, or if sensitive folders have never been properly restricted, AI will find all of it.
Get your data house in order before you turn Copilot on.
Shadow AI is already happening in your business
Shadow AI does not start on the shop floor. It starts in the boardroom. Directors summarising board packs. Managers pasting performance reviews into free AI tools to tighten up the wording. All of it involving personal data, none of it sanctioned.
The answer is not to go in heavy-handed. That just drives it underground. Audit what is actually being used, build a sanctioned tools list, and create a culture where people can be honest about what they are doing.
What actually happens if something goes wrong
This is where the conversation got really useful.
If personal data leaves your organisation through an AI tool, that is likely a data breach. You have 72 hours to report it to JOIC once you become aware. But the first thing to do is not to panic and file a report. Stop the breach, understand what happened, contain it, and then report with what you know. You can add more information as you gather it.
Paul made a good point: the consequences that should worry you most are not the regulatory ones. On a small island, reputation is everything. That is what keeps you up at night.
What is the Jersey AI Playbook actually good for?
Anne put it well: it is the highway code, not the Haynes manual.
It sets out seven guiding principles and five strategic objectives. It gives Jersey a shared vocabulary and aligns the island with international direction of travel. But it does not tell you how to do a DPIA, how to train your staff, or how to actually implement any of it. Think of it as the floor, not the ceiling.
What to do next
If you are a business owner or ops lead thinking about rolling out AI, start here:
Work out what you are trying to fix. Do a proper audit of what data you hold and how it is structured. Get your data protection lead involved before you sign anything. And if you are using Microsoft tools, clean up your file permissions before you add AI on top.
JOIC are approachable and have templates on their website. Propel Forward can help with the detail. And if you want support identifying the right AI opportunities for your business, that is exactly what we do at Blue Llama.