The Doubt That Costs More Than the Risk

A while ago I stopped hearing “the model doesn’t work.” In conversations with managers and directors about artificial intelligence, the objection I hear most today isn’t technical or budgetary. It’s a different one: I don’t know what happens to my data. Where it ends up, who sees it, whether the vendor uses it for training, what liability I take on if something leaks. And behind that question, almost always, there’s a stalled project.

A legitimate doubt, with a date

I want to say something clearly: that doubt is legitimate. It isn’t fear of change or resistance in disguise. There are real confidentiality, compliance and reputational risks, and in Chile they have a date. Law 21.719 on personal data protection comes into force on December 1 this year, with a new supervisory agency and fines that, for the first time, hurt. The government introduced a bill to postpone it by a year, but until it’s approved, that date stands. And even if it’s postponed, the framework is coming. The doubt about data isn’t a lawyers’ whim. It’s the right question.

The problem isn’t the question. It’s how we’re answering it.

Why waiting doesn’t resolve the doubt

The most common answer is to wait. Form a committee, ask for a policy, wait for the vendor to sign something, wait for the law to clarify. The logic sounds prudent, but it hides a false assumption: that certainty about data can be obtained without using the data.

What the Cisco study shows

Organizations are already finding this out. Cisco’s 2026 data and privacy study, with more than 5,200 professionals surveyed across twelve markets including Brazil and Mexico, records the most important shift of the year on this topic: between 2025 and 2026, organizations with total bans on generative AI or rigid limits on what data can be entered fell from 28% to 7%. The report itself explains why: blanket bans proved hard to enforce and out of step with how people use these tools day to day.

In other words, the company that was waiting behind a ban didn’t have the risk under control. It had it invisible. The same study indicates that 70% of organizations acknowledge exposure from using proprietary or customer data in AI training, and that 29% use customer data without redacting or anonymizing it. The doubt didn’t stop the use. It stopped the governance. That’s why the title of this column is literal: the company that waits is already running the risk, just without rules, without records and without anyone in charge. What waiting buys isn’t safety. It’s orderly ignorance.

And uncertainty isn’t resolved in a committee. Cisco found that three out of four organizations already have an AI governance committee, and only 12% describe it as mature and proactive. A committee without a concrete case in front of it produces abstract policies, which don’t answer the question that matters: can this data, in this process, with this vendor, go in or not?

How it gets answered: one bounded case

That question is answered in a bounded case. You choose a process, define what information goes in and what stays out, who reviews the result before it has consequences, and what you require of the vendor by contract. And you do it. It’s the only way to turn a vague concern into three or four rules that someone can follow and someone can audit.

I’ve seen this pattern repeat in very different organizations. They start with a process where sensitive data is scarce and mistakes are cheap. Within a few weeks they discover that a good part of what they feared doesn’t apply, that another part is solved with a vendor setting, and that what remains is a business decision nobody had made because nobody had had to make it. That decision, once made, serves for the next case.

What those who move forward gain: judgment

That’s what those who move forward really gain: judgment. They know what to ask a vendor for in writing, something that according to Cisco only 55% of organizations require today. They know where to put a human check and where it’s unnecessary. And when the law comes into force, postponed or not, they’ll have a real inventory instead of a policy in a PDF.

That judgment can’t be bought or delegated. It’s built by doing, and it compounds. That’s why the gap between companies that moved forward and those that wait doesn’t stay stable: it grows every month, because one is learning and the other is waiting for a certainty that, on this topic, doesn’t exist without use.

I’m not pretending this is simple. Choosing the wrong first case can be costly, and a badly thought-out rule is worse than none. But between an imperfect rule that can be corrected and a ban nobody respects, the first at least tells you where you stand.

So, a concrete question for this week. If you asked three people on your team today what data they’ve pasted into an AI tool in the last month, would you know the answer before asking? And if you don’t, what certainty exactly are you waiting for?