A security officer at a housing association has her DLP rules in good order: citizen service numbers (BSN) and IBANs in outgoing mail trigger a warning, labelled documents cannot go to a private address. When the board asks which AI tools are used in the organisation, she opens the DLP overview. There is nothing in it about AI tools. There are only events, and most of them are about Outlook.
That is not a fault in the setup. DLP answers a different question from the one the board asked.
DLP looks at content: when a rule recognises something sensitive in a file, an email or a network stream, a log entry, a warning or a block follows. AI governance looks at the tool: which AI services are opened, what has been decided about them, does the employee see that decision when opening the tool, and does the use run through what is allowed. The first layer reads data. The second knows tools. For everyday AI use you usually need both, and it helps to know which does what.
What do we mean by classic DLP?
Data loss prevention is a set of rules that recognise sensitive information at the places where data can leave the organisation: email, file storage, chat, USB ports, network traffic and managed devices. A rule describes what is sensitive (a BSN pattern, a credit card number, a document labelled "confidential") and what should happen when it passes by.
Its strength is its reach within a managed environment. Whoever lives in Microsoft 365 can apply the same rules with Purview to Exchange, SharePoint, OneDrive, Teams and enrolled Windows devices, and those rules produce an audit trail per event, with the file and the person attached. That is exactly what you need when you have to investigate a data breach or show an auditor that confidential files cannot get out.
Two properties define where DLP stops. A DLP event only arises when a rule fires, so a stream without recognisable sensitive content is, to DLP, an empty stream. And DLP works where the organisation manages the infrastructure: the mail server, the storage, the enrolled device. Outside that environment it sees nothing.
What do we mean by governance of AI use?
Governance of AI use starts from a different observation: not "what is in this stream" but "which AI tool is this, and what do we think of it". Per tool the organisation takes one decision from four statuses: allowed, limited use, no decision yet, not allowed. That decision appears at the moment someone opens the tool, and what happens next counts at organisation level.
The difference from DLP is the starting point. A policy officer who pastes public memos into a summarising tool triggers no DLP rule: there is nothing sensitive in them. Yet that tool is interesting for the organisation, because it is being used and nobody has looked at it. "No decision yet" is a status DLP does not have. A rule either exists or it does not.
The second difference is the person. DLP ties an event to a sender, because you have to be able to investigate an incident. The governance question does not need that: "this tool was opened four hundred times this month and has no decision" is a complete answer without a name. Why that saves one field in a database, and a processing of personal data, is in AI monitoring versus employee monitoring.
How do the two layers relate?
| Classic DLP | Governance of AI use | |
|---|---|---|
| Unit of assessment | The content of a file, email or stream | The tool and the decision about it |
| When something happens | When a rule fires on sensitive content | When someone opens an AI tool |
| What it does | Log, warn or block | Show the decision, with the alternative; continuing is always possible |
| What it does not see | A tool without sensitive content, unmanaged devices, home working outside the environment | The content of files, mail outside the browser, storage |
| Knows "no decision yet" | No | Yes, it is the default status |
| Tied to a person | Usually yes, for investigation | Not needed; only the domain and the day |
| Question it answers | Does sensitive data leave the organisation? | Which tools do we use, what have we decided, and does it work? |
The rows overlap in one place: the moment someone pastes sensitive text into an AI tool. There DLP can warn, under the conditions the vendor sets for browser, device and licence, and there a browser extension can mark the data while someone types. That is the subject of the comparison with Purview. This article is about the rest of the table, and there they do not overlap.
When is DLP enough?
When your question is whether sensitive data goes out through files, mail and managed devices, and when AI use in your organisation runs through one managed environment that falls under the same rules. An organisation where everyone works on a managed device in the corporate browser, with Copilot as the only AI tool and the DLP rules on that path too, has a closed story about the content.
What such an organisation does not yet know is whether that picture is right. DLP does not say there are no other tools; it says no rule has fired. The difference between those two sentences is exactly the space in which shadow AI grows.
When do you need both?
A municipality has allowed Copilot and DLP is on for mail and SharePoint. A first stocktake of what is opened from the browser shows that, besides Copilot, Perplexity and ChatGPT are also in use, plus three specialised tools: a transcription tool for meetings, a translation tool and a service that summarises policy memos. Two of the three appear in no register.
DLP missed nothing here. The texts that went into the summarising tool were public, no rule fired, and rightly so. But nobody could answer, on the basis of DLP, which tools were in use, let alone whether anything had been decided about them. That is not an incident. It shows that a one-off stocktake falls behind quickly and that DLP does not notice it falling behind, because it does not look at tools.
As soon as employees open AI tools in Chrome, at home, on a laptop that is not enrolled, or with their own account, two things fall outside the DLP layer at once: the use and the content. For the content, the addition is a marking at the moment of typing. For the use, it is a current picture of which tools are opened, a decision per tool, and that decision at the moment someone opens the tool.
