A browser used to be a window. You opened a page, the page loaded, and nothing else happened. AI browsers change that arrangement: to summarize a document, draft a reply, or complete a task, the assistant has to read what is on the screen — and often send it somewhere else to be processed.
That is a genuinely useful capability. It is also a different data-handling arrangement than the one your policies were written for, and most businesses have not noticed the switch.
What is different
When an employee uses an AI browser to summarize a page, the contents of that page may leave your environment. If the page is a news article, nobody cares. If it is a client record in your practice management system, an unfiled contract, or a payroll report, the calculus changes completely.
Three questions decide whether that matters:
- What gets sent? Only the text selected, the whole page, or everything in the session?
- Where does it go, and who can see it? Processed in your tenancy, or on a consumer service where staff may review content?
- Is it used to train models? Consumer tiers frequently say yes by default; business tiers usually say no.
The answers vary by product and by subscription tier, and they change. What does not vary is that the person deciding is usually an employee installing something helpful, not anyone weighing the disclosure.
The agentic part deserves separate thought
Newer AI browsers do not only read — they act. Filling forms, clicking through workflows, sending messages. That is a real productivity gain and a new category of risk, because instructions can arrive from the page itself. A crafted web page can contain text aimed at the assistant rather than the reader, attempting to make it reveal session data or take an action the user never asked for.
You do not need to follow the research to draw the practical conclusion: an assistant that can act on your behalf should not be logged into your banking, your payroll, or your client systems while browsing the open web.
Regulated data raises the stakes
If you handle health records, financial data, or legal files, sending page contents to a third-party service may be a disclosure under your obligations, regardless of intent. It may also breach client agreements that name approved subprocessors. Those obligations do not care that the tool was convenient.
A workable position
Banning the category outright tends to fail — staff use these tools on personal devices instead, which is worse, because you lose visibility entirely. A more durable approach:
Decide which tools are approved, on business tiers with contractual terms about training and retention, and say so plainly.
Name the systems that are off limits for AI assistance — client records, HR, finance — in language people can actually apply.
Separate the browsing. If an agentic assistant is in use, keep it out of the browser profile that is signed into your business systems.
Say it out loud in training. Most staff have never considered that summarizing a page might send it somewhere. Once told, they behave sensibly. Our awareness training covers exactly this kind of everyday judgment.
Write it down. An acceptable-use position on AI tools is quickly becoming a standard question on client questionnaires and insurance forms.
If you want help deciding where the lines should sit for your business, our IT compliance and fractional CIO work covers it — start here.