AI arrived before the policy

60 % of Chilean workers say their company has already deployed AI. Only 5 % say it has a policy for using it.

This document is about the distance between those two figures. It is not a technical distance. It is the difference between a technology that came in through the back door and an organisation that has not yet decided what to do with it.

Five findings

1. 01

   Undeclared use is the majority

   57 % of those who use AI at work hide that use. 48 % admit having broken their company's policies.

2. 02

   Paying for the subscription does not protect your data

   The line does not separate free from paid, it separates consumer products from enterprise products. Three of the four most used vendors train by default on personal paid plans.

3. 03

   On 1 December a regulator arrives, not a ban

   The substantive obligations have been in force since 1999. What changes is who can enforce them and with what consequences.

4. 04

   The decisive article is not the one about fines

   It is article 15 bis: if the AI vendor processes the data for a purpose other than the one instructed, it is jointly liable with the company that handed the data over. Which plan you contract weighs more than any internal policy.

5. 05

   Banning backfires

   Rule breaking is more frequent in organisations that banned generative AI (67 %) than in those with no policy at all (33 %).

The central finding: the line is not between free and paid

The most widespread belief on this subject is that paying for the subscription is enough to stop the vendor training on what you write. We reviewed the current terms of the four services Chilean companies use, and that belief does not hold. Microsoft is the clearest case: the paid licence does not buy data protection, the work account does.

What to do: five moves for the next 90 days

1. 01

   Inventory without punishing

   Map which AI tools are used today in each area, with which data and for which task, with explicit amnesty. Every unofficial tool that appears is proven demand for a use case, not an offence.

2. 02

   Enable the alternative the same day as the restriction

   A named tool, contracted on a reviewed plan, at least as good as the personal alternative and available from day one. Never the restriction on its own.

3. 03

   Write the policy and take it to the internal rules

   One page is enough to start. For the rule to be enforceable on an employee, it has to enter the internal regulations and the contracts.

4. 04

   Train by role, on real data and real tasks

   The policy sets the frame. Training is what produces the return on licences already paid for. A licence assigned and never opened yields the same as not having it.

5. 05

   Review the terms you contracted

   The exercise is not reviewing a contract, it is determining which plan each AI service the company pays for is on, and whether it should migrate.

None of these moves requires waiting for the Agency to be constituted. All of them keep their value even if enforcement takes time.

So far in 2026 I have held more than fifty meetings with Chilean companies of different sizes and sectors, and the pattern repeats with a regularity that stopped looking anecdotal to me: the teams already use these tools, management half knows it, and almost nobody has written down what is allowed. Sorting this out with time costs a fraction of what it costs to sort it out with an incident on top of you.

This report reflects the documentation in force on the date shown. These conditions change often: check the current version before making a decision.