How to build secure and user-friendly AI: ‘If data sits in a silo, it only sees part of the picture’

Michael Pietsch has a blunt message for companies obsessing over which AI model to buy: stop. The VP of DACH at Box thinks the real obstacle to AI success isn't the technology at all. It's the data sitting underneath it, often scattered across file servers, SharePoint and Teams in ways that make even the smartest model useless.

Most small and medium businesses assume they have to pick a lane — either lock everything down for compliance or give employees tools that actually feel good to use. Pietsch says that's a false choice. IT teams gravitate toward locked-down systems that satisfy governance rules, but employees want something as frictionless as the apps they use at home. His fix is to let a content management platform handle security automatically in the background, so users never have to think about it. He points to sales teams as the classic failure case: when sharing a confidential proposal requires VPNs, password-protected zip files and IT sign-off, salespeople eventually just email an unsecured attachment to get the deal done. Automate the permissions and revocation instead, and the friction disappears along with the workaround.

The deeper problem, though, is what Pietsch calls data silos. An engineering drawing lives on a file server, the contract sits in SharePoint, the project notes are buried in Teams — and when a service technician asks an AI tool for the latest maintenance manual, it might confidently serve up an outdated version because the current one lives somewhere else entirely. Consolidating that content is necessary, but it creates its own risk: dump everything into one system and you might expose sensitive records to people who shouldn't see them. Pietsch's answer is that AI has to inherit a company's existing user permissions rather than operate as some separate, bolted-on governance layer.

In Germany, Austria and Switzerland particularly, this isn't just an IT headache — it's a board-level one. Rules like GDPR and the EU's NIS2 directive require companies to prove exactly where data is processed and who touched it, and Pietsch says data residency, the actual physical location of the servers, matters as much as any policy document. His warning to companies that respond by simply banning consumer AI tools: employees won't stop using AI, they'll just do it quietly. That's Shadow AI — staff feeding sensitive company information into public chatbots because the sanctioned option was too slow or too locked down. Pietsch argues the only real defense is offering a secure alternative people actually want to use, not fighting a battle you're bound to lose.

His closing advice circles back to where he started. Models will keep changing, new ones will keep launching, and chasing the best one is a moving target. Get the underlying content properly organized and governed instead, he says, and you'll be able to plug in whichever AI comes next without starting from scratch.