Roel van der Valk: Without an AI policy, you’ll lose control of your data

“The biggest cyber risk when using AI tools is that organizations lose control over the information they process in such an environment,” Roel begins the conversation: “It’s often unclear what happens to the data that’s entered. Is that data used to train algorithms? Where is the information stored, how long does it remain available, and who might have access to it? Suppose an employee wants to use an AI tool to create a report or dashboard showing maintenance costs per home or building. That report could contain sensitive company or tenant information, yet you don’t always know what happens to that data afterward. It is precisely that lack of control that makes the risk so great.”

According to Roel, if you don’t have a policy in place regarding the use of AI tools, the risk of data breaches is high: “You see that in these kinds of cases, employees often use the free versions of tools like ChatGPT or Gemini. This increases the risk of losing control over your data and having it fall into the hands of third parties. Security officers and information managers are generally well aware of the risks, but this awareness is much lower at the executive level. AI has evolved at an incredibly rapid pace, with the focus primarily on its possibilities and benefits. The associated risks, however, have been overlooked.”

When an AI policy is in place, the major challenge is to systematically monitor it and keep it up to date on an ongoing basis. Roel: “Technical measures can help limit the use of AI tools, but due to the rapid growth of AI, it is difficult to fully enforce this in practice. That is why raising employee awareness about the risks of AI is just as important. Both require ongoing attention.”

When asked about the CISO’s role in this matter, Roel explains: “On the one hand, the CISO identifies the risks associated with AI tools and incorporates them into the cybersecurity policy; on the other hand, he raises awareness among employees. In addition, the CISO plays a clear role vis-à-vis the board. He must ensure that AI remains a regular item on the agenda, monitor progress, and advise on necessary investments.”

According to Roel, in order to use AI responsibly and safely, housing associations must first clearly identify the risks involved and weigh them against the benefits: “For each AI tooling provider, you need to assess what access is granted, what information is shared, and what the provider does with that information afterward. Where is the data stored, how long is it retained, and who has access to it? It’s also important not to look only at the current situation. Suppliers’ claims can change—for example, if a supplier is acquired by another party. In that case, terms and conditions can suddenly change. A sound AI policy therefore requires ongoing review, clear agreements, and continuous monitoring of control over data.”

“At OneXillium, we help housing associations develop cybersecurity policies that also give AI the attention it deserves. We serve as a ‘trusted advisor’ in this process. In other words, we use our knowledge and experience to ensure that a housing association has an appropriate cybersecurity policy that it can then implement and maintain on its own.”

For housing associations that do not yet have a policy on cybersecurity and AI, Roel’s advice is clear: start today. “AI is evolving at breakneck speed, and its adoption is only increasing,” Roel concludes. “Those who don’t get a handle on this now will fall further and further behind in the coming years. The five basic principles of the National Cyber Security Center are a good starting point.” I also expect AI to influence the cyber risk landscape itself in the coming years. We’ll see AI expose more known vulnerabilities in the software that housing associations use today. As a result, patches will become available more frequently, and a solid patching policy will become even more important. So make sure you optimize that policy. And if this is the responsibility of your IT provider, be sure to actively discuss it with them.” Source: Corporatiegids