Thursday, 6:40 p.m. A procurement analyst has to deliver a comparison of three supplier contracts first thing tomorrow. That's 120 pages in total. She searches for "summarize PDF with AI free", opens the first site that comes up, uploads all three files and two minutes later has a pretty decent summary. IT never hears about it. Nobody knows where those contracts ended up either, names, tax IDs and commercial terms included.
Summarizing documents with free AI tools is one of the most common searches among people who deal with contracts, reports and minutes. The need is real and the tools work. The trouble starts when the file you upload isn't yours but belongs to the company or its customers. This article covers the risks behind free AI summarizers, what to check in their terms of use, how this connects to Chile's Law 21.719, and the alternative with enterprise data protection that you most likely already have in Microsoft 365.
Why people end up using tools on their own
It's rarely bad intent. The person has a deadline, the tool is one click away and nobody told them what was allowed. This is called shadow AI: using artificial intelligence tools that IT hasn't approved or doesn't know about.
It's not a fringe thing. In the 2024 Work Trend Index from Microsoft and LinkedIn, 78% of people using AI at work said they brought their own tools. And IBM's 2025 Cost of a Data Breach report found that 20% of the organizations studied had a breach involving shadow AI, while 63% had no AI governance policies.
Banning things without offering another option rarely works. If the company doesn't provide a safe way to summarize a document, people will keep looking for one on Google.
What happens to a file when you upload it to a free service
Free tools aren't all the same, and we won't single out any of them here. What's worth knowing is that when you don't pay with money, the provider sets the terms and can change them. Before uploading anything from work, check at least these points in the terms of service and privacy policy:
| What to check | Why it matters |
|---|---|
| Whether content is used to train or improve models | A contract or customer list could end up in training data |
| How long files and conversations are kept | Some services keep history until you delete it by hand, or longer |
| Who can review the content | Some services allow human review for quality or abuse control |
| Which country the data is processed in | It affects international transfer rules |
| Which account you sign in with | A personal account sits outside company control: when the person leaves, the history leaves with them |
| Whether there's a data processing agreement | Without one, the company can't hold the provider to anything |
That last point carries the most weight. When someone uploads a document with their personal email, the company never signed anything with that provider. It can't audit, can't ask for deletion, and often doesn't even know it happened.
Where Law 21.719 comes in
Law 21.719, published in Chile's Official Gazette on December 13, 2024, takes full effect on December 1, 2026. That's a few weeks away. From that date, any company processing personal data needs a lawful basis for doing so, has to apply security measures that match the risk, and must report to the Personal Data Protection Agency any breach that puts people's rights at risk.
Apply that to summarizing: if someone uploads a customer spreadsheet, a medical leave certificate or a payslip to a service with no contract in place, the company is handing personal data to a third party without the safeguards the law expects. If that service processes data outside Chile, the international transfer rules kick in as well. Fines go up to 5,000 UTM for minor violations, 10,000 for serious ones and 20,000 for very serious ones.
We covered this in more depth in GDPR and data protection in Chile: what applies to your company. For this topic one idea is enough: the risk lies in not knowing where the data went.
The alternative you're probably already paying for: Copilot Chat with your work account
If your company has Microsoft 365, it has Microsoft Copilot Chat included. According to the Copilot Chat FAQ on Microsoft Learn, it comes with the subscription and applies enterprise data protection to users who sign in with their Microsoft Entra account (their work account), with no action needed from IT.
In practice, that protection means:
- Prompts and responses aren't used to train foundation models.
- Files you upload to the chat are stored in the user's work OneDrive, where they can delete them at any time, and they aren't used for training either.
- The same contractual terms (Data Protection Addendum and Product Terms) that cover email in Exchange and files in SharePoint apply, according to the enterprise data protection documentation.
- Copilot respects the sensitivity labels and retention policies the company already has in place, and its interactions are available for audit.
Watch out for the names, because Microsoft changed them recently. What used to be called Microsoft 365 Copilot Chat now shows up as Microsoft Copilot Chat. The protection is the same, but the rename trips people up. The practical rule is simple: sign in with your company email, not a personal account.
For the summary itself, Copilot Chat accepts PDF, Word, Excel and PowerPoint files. We walk through it step by step, including what changes with the paid license, in Automatic AI document summaries: a guide with Copilot.
How to rein in shadow AI without fighting your users
A policy nobody reads doesn't change habits. What does work is pairing clear rules with an easy option:
- Decide which tools are approved and say so on one page, not in a 30-page manual.
- Classify information into two or three levels (public, internal, confidential) and say what can be uploaded where.
- Make sure everyone knows how to sign in to Copilot Chat with their work account. A short half-hour session does more than ten emails.
- Check in the Microsoft 365 admin center whether you already have sensitivity labels and retention policies. If you don't, Copilot has nothing to respect.
- Bring the topic up again every so often. The tools change fast, and so do their terms.
If you want to look at the technical side (permissions, oversharing, labels), Copilot data security: enterprise AI without risking your data lists what to tidy up before you expand usage.
Frequently asked questions
Is it illegal to use a free tool to summarize documents?
Not in itself. The issue is what you upload. A public article carries no risk; a contract with customer data or employee information does, because it means processing personal data without the safeguards Law 21.719 requires.
Is Copilot Chat free?
It's included in Microsoft 365 business subscriptions at no extra cost per user. Enterprise data protection applies when you sign in with your Microsoft Entra work account. More advanced features, such as automatically searching your files, require the paid Microsoft Copilot license.
How do I know I'm using the version with enterprise protection?
Check which account you signed in with. If it's your company email, you're on the version with enterprise data protection. If it's a personal email, you're not. When in doubt, ask your IT team.
Getting AI use in order before December
If people at your company are already summarizing contracts with tools nobody approved, a ban sent by email won't be enough. You need an alternative that's just as fast and a few rules everyone understands. At Disrupsoft we assess current usage, activate and configure Copilot in your Microsoft 365 environment, and train teams to use it well. Learn about our Copilot and Microsoft 365 service.
