Access control, encryption and vendor due diligence still apply and are covered well elsewhere. Three risks are genuinely specific to AI deployments, and they are the ones most often missed.
Prompt injection
A system that reads untrusted content — an email, a document, a web page — can encounter instructions embedded in that content. If it acts on them, an attacker has issued a command through your data rather than your interface. The mitigation is architectural: the system should be structurally unable to take consequential action from retrieved content, not merely told not to.
Data leakage through context
Retrieval systems assemble context from whatever they can reach. If permissions are broader than intended, a user can receive information they should not see — and the system will present it fluently, with no indication anything is wrong. The system inherits the permission model beneath it, which is why that model has to be audited before deployment rather than after an incident.
Over-permissioned action
An agent that can act can be made to act. Scope permissions to the specific operations the process requires, and require confirmation for anything irreversible. This is ordinary least-privilege discipline applied to a component people forget to treat as an actor in the system.
Why conventional security reviews miss this
Security review typically examines infrastructure and vendor posture — real work, and orthogonal to these risks. Prompt injection and context leakage live in application behaviour, which means they are only caught if someone tests the system as an adversary would use it rather than as a user would.
Knowing these categories exist is straightforward. Building constraints the system cannot circumvent, auditing an inherited permission model, and testing adversarially is engineering work — and it belongs in the build, alongside the governance decisions in our guide to AI governance.
What this means for your business
Before any AI system touching internal data goes live, answer three questions: what can it read, what can it change, and what happens if the content it reads contains instructions? If any answer is unclear, that is the work to do first.