AI Safety & Data Privacy
Privacy, data hygiene, security failure modes, governance, and safe AI connections.
40 stories (29 articles · 11 videos)
Start here
A few good first pieces before you browse the full feed.
6 min readPrivacy 101: what ChatGPT remembers, sees, and shares
An honest look at what AI assistants actually do with your data — what is stored, what is used for training, what the privacy settings really mean, and the three changes worth making today.
New to AI
8 min readPrivacy and data hygiene when using AI at work
A practical guide to using AI at work without accidentally exposing customer data, breaching your company's policy, or violating GDPR. The lines, the tools, and the habits to build.
Beginner
14 min readPrompt injection and LLM security: threat models and defense-in-depth
Prompt injection is a permanent LLM security class, not a prompt-writing mistake. A production guide to threat models, data boundaries, tool permissions, regression tests, monitoring, and incident response.
AdvancedMore in this topic
6 min readDo Not Paste Bank Statements Into AI
Account numbers, balances, counterparties, and payroll lines are paste bans for consumer AI. How to get literacy help from a model using typed, redacted fields - without uploading full statements, screenshots, or PDF exports.
New to AI
6 min readHome Photos and Floorplans: Privacy Before You Upload
Uploading interiors and floorplans to consumer AI can leak layout, valuables, kids' rooms, and security cues. A privacy-first checklist for what to redact, what to keep offline, and how to still get planning help without broadcasting your house.
New to AI
5 min readSolo AI Rules for Client Work
Before you put a client's brief, draft, or data near a consumer AI tool, write a one-page personal policy card: what you will never paste, what needs client consent, what you still price and scope yourself, and when you escalate to a human specialist. Freelancers do not inherit an employer AI policy - you need your own.
New to AI
7 min readCoordinating an Ageing Parent's Care Without Losing Their Voice
When siblings start coordinating a parent's care, information sprawls across group chats, and the person it's about gets talked over. A consent-aware record — what to share, with whom, and a strict line between emergency and administrative information — keeps the coordination practical and keeps your parent's voice in the decisions.
Beginner
7 min readA Caregiving Handoff That Preserves Dignity and Context
When care shifts between family members, shifts, or a new paid caregiver, what usually transfers is a list of tasks and a rushed verbal summary. A handoff template carries the cared-for person's own preferences forward too - without AI turning them into behavioural labels.
Beginner
7 min readIs This AI Product Safe for My Child's Data? A Privacy Checklist
A seven-point checklist — age rules, collection, retention, training use, sharing, controls, and deletion — for deciding whether an AI product gets allow, allow-with-controls, or do-not-use for your child.
Beginner
8 min readChronic-Condition Administration: Build a Care Calendar, Not a Treatment Plan
Managing a chronic condition, your own or a family member's, is mostly logistics: appointments, refills, forms, transport, and follow-ups, each with an owner and a deadline. A care-operations board handles that coordination - and stops firmly at the edge of anything clinical.
Intermediate
7 min readArchiving Family Photos and Stories Without Inventing History
AI makes it fast to caption, transcribe, and organize decades of family photos and recordings — and just as fast to quietly invent a date, a name, or a detail nobody actually confirmed. A metadata schema for consent, provenance, and uncertainty keeps the archive honest, restricts children's images by default, and keeps them out of unreviewed AI tools.
Intermediate
9 min readA personal knowledge system that helps you retrieve, not hoard
Highlights, clippings, and AI summaries pile up without making you smarter. A small capture-to-retrieval system built around three real decisions — plus what to do about sensitive notes, other people's data, and the false privacy of a personal account.
Intermediate
7 min readGet Consent Before You AI-Edit or Share Someone's Photo
Uploading a friend's photo to an AI tool to remove a background, swap a smile, or turn it into an illustration feels like a small, personal edit. For the person in the photo, it can be a much bigger decision they never got to make.
Beginner
6 min readFinding Subscription Drift Without Exposing Your Bank History
Review a locally redacted transaction export for recurring charges and drift, without ever connecting an AI tool to your bank account. A confidence-flagged merchant list, and a cancellation checklist a human actually executes.
Beginner
7 min readUnderstand a Medical Document Without Turning It Into Medical Advice
A discharge note or test report arrives full of clinical shorthand you were never taught to read. A four-column method - exact text, plain paraphrase, uncertainty, clinician question - lets AI translate the language without ever telling you what your results mean.
Beginner
7 min readVoice-cloning fraud: the SME controls that actually work
Three procedural controls that protect SME payments and sensitive changes when a caller or video participant can convincingly imitate a director, colleague, or supplier.
Intermediate
7 min readProving what is real: provenance, watermarking, and Content Credentials
What C2PA Content Credentials and watermarks can actually prove, what disappears after screenshots and re-uploads, and how an SME can publish media with an honest provenance policy.
Intermediate
6 min readThe voice on the phone sounds familiar: recognising AI-enabled scams
A calm, practical guide to voice-clone emergencies, impersonation messages, fake media, and AI-polished scams — with a family verification plan that works even when the fake looks or sounds convincing.
New to AI
7 min readWhat not to delegate to AI: draw your personal line
Use a practical boundary test to keep accountability, relationships, and important skills in human hands while still getting useful AI assistance.
Beginner
20 minutesPermissions & Access Control for RAG - a Deep Dive Tutorial
Paragon. Walks through the production RAG permission problem and compares tool-calling, namespaces, ACL tables and relationship-based permissions. That directly supports the article's core rule: retrieval must only return sources the current user is allowed to see, and source-system permissions cannot be treated as an afterthought.
Advanced
30 minutesEU AI Act Explained: Turning Compliance into Competitive Advantage | Carme Artigas
MSP GLOBAL. Carme Artigas chaired the Council negotiations that produced the AI Act, and here she explains it to managed service providers — the companies SMEs actually buy AI through. She walks the phased timeline, from the August 2025 GPAI code of practice to the August 2026 conformity-assessment deadline, and the concrete obligations that follow, such as requiring compliance documentation from vendors. That is the same inventory, vendor-evidence and ownership work the article turns into an operating plan.
Advanced
69 minutesThe Agent Landscape - Lessons Learned Putting Agents Into Production
MLOps.community. Prosus's VP of AI and an AI engineer report what actually broke when they deployed agents across the group's portfolio companies: prompt-injection pen-testing before launch, an unsafe write when a Jira agent choked on human shorthand, stale context handled by making agents surface their assumptions, and fallback design that merged or killed agents once they added cognitive load. It reads like the article's failure-mode register replayed as a live postmortem.
Advanced
7 minutesUnlock Better RAG & AI Agents with Docling
IBM Technology. Explains the ingestion side of RAG and agents: preparing PDFs and other files so document structure, tables and layout survive into downstream retrieval. That supports the article's warning that RAG quality and safety begin before embedding, especially when parsing complex business documents.
Advanced
9 min readAI ROI and maturity: how to measure adoption that actually works
AI adoption should not be measured by how many people tried ChatGPT. A practical framework for measuring workflow ROI, quality, risk, maturity, and scale-readiness.
Advanced
10 min readCompany knowledge RAG: permissions, leakage, and source boundaries
A company knowledge assistant is only safe if retrieval respects permissions. How to design RAG source boundaries, ACL filtering, document ownership, logging, stale-source handling, and refusal behavior.
Advanced
9 min readEU AI Act for SMEs: a practical governance plan
The EU AI Act is not just a legal problem for large vendors. A practical SME plan for inventory, risk classification, human oversight, transparency, vendor records, and rollout discipline.
Advanced
9 min readHuman-in-the-loop design patterns for AI workflows
Human review is not a vague safety blanket. A practical guide to deciding what humans approve, sample, audit, escalate, or never delegate in AI workflows.
Intermediate
10 min readPrivate AI deployment patterns: local, VPC, self-hosted, and hybrid
Private AI is not one architecture. A practical comparison of local models, enterprise SaaS, VPC deployments, self-hosted inference, and hybrid patterns for SMEs that care about privacy and control.
Advanced
10 min readProduction AI failure modes: what breaks after the demo
AI systems usually fail in predictable ways: hallucination, stale context, sycophancy, prompt injection, unsafe tool use, schema drift, and weak fallbacks. A production failure-mode register for teams shipping real workflows.
Advanced
11 min readSecure document ingestion for RAG: PDFs, OCR, metadata, and retention
RAG quality starts before retrieval. A secure ingestion guide for PDFs, OCR, metadata, permissions, source freshness, deletion, malware risk, and operational ownership.
Advanced
10 min readConnecting AI to your email, calendar, and CRM safely
Connecting AI to your real tools — email, calendar, CRM — is the productivity unlock and the risk. A practical guide to the integrations that work in 2026, the patterns that are safe, and the lines you should not cross.
Intermediate
10 min readLocal AI on your Mac: Ollama, LM Studio, and what 7B models can really do
Running AI locally has matured. With Ollama or LM Studio and a modern Mac, you can run capable models offline, free, and private. What works, what doesn't, and the use cases that actually benefit.
Intermediate
6 min readSharing images with AI: what you can (and shouldn't) upload
Modern AI can read photos, charts, screenshots, and handwriting almost as easily as text. A practical guide to what works, what doesn't, and the thirty-second privacy checklist before you upload anything.
New to AI
25 minutesOWASP's Top 10 Ways to Attack LLMs: AI Vulnerabilities Exposed
IBM Technology. Zooms out from prompt injection to the wider OWASP Top 10 for LLMs — insecure output handling, sensitive information disclosure, excessive agency — which is exactly the failure-mode catalogue you want in mind before you grant Gmail or HubSpot scopes to anything.
Intermediate
11 minutesWhat Is a Prompt Injection Attack?
IBM Technology. Jeff Crume's "buy an SUV for $1" example is the cleanest 10-minute explanation of why direct and indirect prompt injection are different problems, and why filtering can't fully solve either. It pairs directly with the article's argument that you need least-privilege scopes, a dedicated agent account, and a human in the loop on anything irreversible — not a cleverer system prompt.
Intermediate
93 minutesSam Altman | This Past Weekend w/ Theo Von #599
Theo Von. The section roughly twelve minutes in, where Altman admits there is no legal privilege for ChatGPT conversations and that OpenAI can be ordered to hand them over in a lawsuit, is the single most-quoted piece of footage on this topic — and worth hearing in his own voice rather than via a news clip. The rest of the conversation is wide-ranging, but that one exchange is the honest answer to the question the article asks: "what does the company actually do with what I type?"
New to AI
13 minutesHow to Secure AI Business Models
IBM Technology. Jeff Crume's lightboard explainer of the three places generative AI introduces risk — the data, the model, and the usage — and what good controls look like for each. Useful for the article's argument that "be careful" isn't enough; you need to think about which category of risk you're actually exposed to as an employee.
Beginner
11 minutesWhat is Shadow AI? The Dark Horse of Cybersecurity Threats
IBM Technology. Sits below our usual 100K bar but earns the slot because it's the single best short explanation of why an employee using a personal ChatGPT account on work problems is the actual risk most companies face. Crume's "don't say no, say how" framing is the same posture the article takes — you're not trying to ban AI, you're trying to make safe use the easy default.
Beginner
13 minutesAttacking LLM - Prompt Injection
LiveOverflow. Frames prompt injection as a classic injection attack against systems that mix instructions and untrusted data — with a concrete content-moderation example where an attacker frames an innocent user. The mental shift from "the model is the target" to "the application is the target" is exactly the move the article opens with.
Advanced
17 minutesDefending LLM - Prompt Injection
LiveOverflow. Walks through the actual defence-in-depth playbook — taint analysis on LLM output, restricting expected output shapes, user isolation, few-shot scaffolds, fine-tuning, temperature 0 for determinism, redundancy for critical paths. It matches the article's defence-stack section almost item for item.
Advanced