Using AI safely in your business starts with access, not technology. Who can use it? Which data can the agent see? Which actions need approval? This AI safety checklist covers nine checks: the tools in use, usage rules, access, permissions, network, model choice, approval, backups, and logging. Work through them before you connect business data.
Think of this as an AI security checklist for the moment an agent gets access to real business data. The points follow two principles: give AI only the access a task needs, and keep a person in control of what matters. The OWASP Top 10 for LLM Applications names the same risks, such as prompt injection and excessive agency. The Dutch Data Protection Authority also warned about AI agents like OpenClaw in February 2026 and advises strict access controls and caution with external plug-ins. For each point, you get one question to check your own setup.
Start with what is already there. According to Eurostat, almost 20% of EU businesses with ten or more employees used AI technology in 2025. On top of that, employees often use free chatbots, browser extensions, or AI features inside existing software without anyone keeping track. That is shadow AI: business data ends up in tools nobody chose or checked. Make a short list of every tool, who uses it, and which data goes in. Check: can you name every AI tool that touches company data?
Write down in a few lines which data never goes into an AI tool: customer details, passwords, contracts, and unpublished figures. Agree that people use business accounts, not personal ones, so you keep control when someone leaves. Together, those rules form your AI policy. Name one owner who keeps the policy up to date and answers questions. Explain the rules in a short team meeting; a rule nobody knows does not protect anything. The EU AI Act asks for that knowledge too. According to the Dutch Data Protection Authority, organizations that use AI systems must make sure, since February 2, 2025, that their people have "sufficient knowledge and skills to use AI responsibly." That is called AI literacy. Since a 2026 amendment (the Digital Omnibus), the Act no longer prescribes a specific level of knowledge, but the obligation to support AI literacy remains; see the European Commission’s Q&A on AI literacy. Check: could a new employee find these rules on their first day, and do they know who the owner is?
Only the employees you designate get access to the agent. There is no public endpoint where anyone on the internet can reach it. Give each person their own access, so you can revoke it the day they leave or change roles. Shared logins hide who did what. Check: who has access today, and can you remove one person without affecting the rest?
Give each integration only the permissions the task needs, and start read-only where you can. An agent that can only read your analytics cannot change your website by mistake. OWASP calls this risk excessive agency: a model with more functions, permissions, or autonomy than it needs can do damage when its output goes wrong. Check: for each connection, which action does the agent actually need?
Run the agent inside your network, not on the open internet. People reach it through the business network or a VPN, so there is less for attackers to find and fewer ways in. Your projects and settings stay on your own system; read what stays local in a hybrid AI setup for the full split. If the agent runs on a separate computer, read when you need a Linux computer for an AI agent. Check: can anyone outside your network reach the agent?
Decide which model the agent uses and which data may go to an external provider. Use your own API accounts and read the provider terms. On consumer ChatGPT plans, chats can be used to train models. To stop that, turn off "Improve the model for everyone" in the data controls. Our comparison of local AI vs cloud AI helps you weigh the options. If you want to run a model yourself, read what computer you really need to run AI locally. Check: do you know where each type of data is processed?
High-impact actions, such as sending emails to customers, deleting files, or paying invoices, need approval before the agent carries them out. For routine work, a person reviews the result afterward and corrects it where needed. That is human oversight in practice, and OWASP recommends this kind of human approval for actions with a high impact. Check: which actions can the agent take without anyone looking first?
Make regular encrypted backups of the environment and test a restore from time to time. How often depends on how much changes. Store backups in a separate location in your network, never on the node itself, so one hardware failure cannot take both. A backup you have never restored is a hope, not a plan. Read what happens to your AI environment if hardware fails. Check: when did you last test a restore?
Record what the agent does, so you can see afterward which action happened when and why. Agree in advance who decides when something goes wrong and how you revoke the agent's access. Also agree who informs customers, and the data protection authority if personal data is affected. Put these arrangements in writing, for example in a data processing agreement. Check: who do you call first?
At Voltti, these checks are the starting point of every setup, including our own. Our own Hermes installation reads Search Console data through a read-only account and runs in its own environment with separate credentials. The agent makes edits in our CMS, and a person reviews the work afterward and steers where needed. At home, we apply the same rules to our Raspberry Pi build with Hermes and Home Assistant: read-only access first, then one targeted action.
When we set up Hermes for you, every installation follows the same rules. Each employee gets their own access, each connection gets minimal permissions, and encrypted backups go to a separate location in your network, never on the node. You agree with us on how often that happens. We do not monitor how you use Hermes; our role is installation and support. Read more on our page about security and privacy.
Skills, the add-ons that teach an agent new tasks, also need attention. A January 2026 study (a preprint) analyzed 31,132 skills from two large public marketplaces and found at least one vulnerability in 26.1% of them. For teams, we therefore recommend a GitHub repo owned by your company for skills, plug-ins, and MCPs. From there, they reach every Hermes setup, so your team works together and keeps control over what the agent can do.
Even if you only use standard AI tools, these measures make a difference:
| Measure | What it does | Why it matters |
|---|---|---|
Keep business data out of public chatbots | Do not put confidential data into public tools such as ChatGPT | Depending on the plan and settings, your input can be used to train models |
Your own model provider accounts | Use your own API accounts, not free public versions | You retain control over what happens to your data |
Filter data sent to external models | Decide which data may go to an external model | Prevent sensitive information from leaving your network |
Backups in your network | Back up data you store locally to a separate location in your network | A backup lets you restore saved data after a failure or mistake |
Want a secure AI environment? Read more about local AI for businesses or see how a pilot works.
Use this AI safety checklist again whenever you connect a new system or give the agent a new task. Nine questions take less time than repairing one data leak.
It can be, if you limit who has access, which permissions the agent gets, and which data goes to a model provider. Without those measures, you take risks you do not need to take. The nine checks in this article show what to arrange before you connect business data, from shadow AI to backups.
No. We do not monitor how you use Hermes and do not have permanent access to your daily work. Our role is installation and support, and remote support happens when you ask for it. Your conversations, projects, and settings stay in your own environment, under your control.
Encrypted backups to a separate location in your network limit the damage, and we help with recovery and analysis. If personal data is involved, you usually have to report the breach to the data protection authority within 72 hours. The exception is a breach that is unlikely to pose a risk. Set out the procedure in advance in a data processing agreement.
Yes. If your AI setup processes personal data, the GDPR applies, just as it does to your other systems. The data protection authorities in Belgium and the Netherlands publish guidance on AI: see the Belgian brochure on AI and the GDPR and the Dutch authority page on AI. We help with practical security measures and can document arrangements in a data processing agreement. This is not legal advice.
Only for data you would also share publicly. Free versions often have weaker data controls, and your input may be used to improve the model. Use business accounts for work, turn off model training where the tool allows it, and keep customer details, passwords, and contracts out of free tools.
