A security officer at a housing association has her DLP rules in good order: citizen service numbers (BSN) and IBANs in outgoing mail trigger a warning, labelled documents cannot be sent to a personal address. When the board asks which AI tools are in use across the organisation, she opens the DLP overview. It says nothing about AI tools. It lists events, and most of those concern Outlook.
That is not a flaw in the set-up. DLP answers a different question from the one the board asked.
DLP looks at content: when a rule recognises something sensitive in a file, an email or a network stream, what follows is a log entry, a warning or a block. AI governance looks at the tool: which AI services people open, what has been decided about them, whether employees see that decision when they open the tool and whether use stays within what is allowed. The first layer reads data. The second identifies tools. For everyday AI use you usually need both, and it helps to know which does what.
What do we mean by classic DLP?
Data loss prevention is a set of rules that recognise sensitive information at the places where data can leave the organisation: email, file storage, chat, USB ports, network traffic and managed devices. A rule describes what is sensitive (a BSN pattern, a credit card number, a document labelled "confidential") and what should happen when it passes through.
Its strength is its reach within a managed environment. An organisation that runs on Microsoft 365 can use Purview to apply the same rules to Exchange, SharePoint, OneDrive, Teams and enrolled Windows devices, and those rules produce an audit trail for each event, with the file and the person attached. That is exactly what you need when you have to investigate a data breach or show an auditor that confidential files cannot get out.
Two properties mark where DLP stops. It only records an event when a rule fires, so to DLP a stream without recognisable sensitive content is an empty stream. And it works where the organisation manages the infrastructure: the mail server, the storage, the enrolled device. Outside that environment it sees nothing.
What do we mean by governance of AI use?
Governance of AI use starts from a different question: not "what is in this stream" but "which AI tool is this, and what do we think of it". For each tool, the organisation chooses one of four statuses: allowed, limited use, no decision yet or not allowed. That decision appears when someone opens the tool, and what happens next is counted at organisation level.
The difference from DLP is the starting point. A policy officer who pastes public memos into a summarising tool triggers no DLP rule: there is nothing sensitive in them. Yet the organisation should be interested in that tool, because it is being used and nobody has looked at it. "No decision yet" is a status DLP does not have. A rule either exists or it does not.
The second difference is the person. DLP ties an event to a sender, because you have to be able to investigate an incident. The governance question does not need that: "this tool was opened four hundred times this month and has no decision" is a complete answer without a name. AI monitoring versus employee monitoring explains why leaving out that one database field also spares you a processing operation involving personal data.
How do the two layers relate?
| Classic DLP | Governance of AI use | |
|---|---|---|
| Unit of assessment | The content of a file, email or stream | The tool and the decision about it |
| When something happens | When a rule fires on sensitive content | When someone opens an AI tool |
| What it does | Log, warn or block | Show the decision and the alternative; the employee can continue unless the organisation has switched that off |
| What it does not see | A tool without sensitive content, unmanaged devices, working from home outside the managed environment | The content of files, mail outside the browser, storage |
| Knows "No decision yet" | No | Yes, it is the default status |
| Tied to a person | Usually, for investigations | Not needed; only the domain and the day |
| Question it answers | Does sensitive data leave the organisation? | Which tools do we use, what have we decided and does it work? |
The two layers overlap in one place: the moment someone pastes sensitive text into an AI tool. At that point DLP can warn, within the vendor's conditions for browser, device and licence, and a browser extension can highlight the data as someone types. That is the subject of the comparison with Purview. This article covers the rest of the table, where they do not overlap.
When is DLP enough?
When your question is whether sensitive data goes out through files, mail and managed devices, and when AI use in your organisation goes through one managed environment covered by the same rules. An organisation where everyone works on a managed device in the corporate browser, with Copilot as the only AI tool and DLP rules covering that channel as well, has the content side covered.
What such an organisation does not yet know is whether that picture is accurate. DLP does not say there are no other tools; it says no rule has fired. The gap between those two statements is exactly where shadow AI grows.
When do you need both?
A municipality has allowed Copilot and has DLP switched on for mail and SharePoint. A first inventory of what people open in the browser shows that Perplexity and ChatGPT are in use alongside Copilot, plus three specialist tools: a transcription tool for meetings, a translation tool and a service that summarises policy memos. Two of the three are not in any register.
DLP missed nothing here. The texts that went into the summarising tool were public, so no rule fired, and rightly so. But nobody could use DLP to say which tools were in use, let alone whether anything had been decided about them. That is not an incident. It shows that a one-off inventory goes out of date quickly, and that DLP does not notice because it does not look at tools.
As soon as employees open AI tools in Chrome, at home, on a laptop that is not enrolled or with their own account, two things fall outside the DLP layer at once: the use and the content. For the content, what you add is a highlight as someone types. For the use, it is an up-to-date view of which tools are opened, a decision for each tool and that decision shown when someone opens the tool.
