AI data loss prevention (AI DLP) is the practice of stopping sensitive information, customer data, credentials, financial records, and source code from being exposed through interactions with AI tools and models. It covers content typed into a chatbot prompt, uploaded as a document, or passed through an AI-powered application, with controls that detect, redact, or block exposure before it happens.
Why It Matters
Most data loss prevention tools were built for email attachments and file transfers, not prompts. That gap shows up fast: an employee pastes a client's financial details into ChatGPT to draft a summary, or an internal copilot pulls a customer's medical record into a response without review. Neither looks like a "breach" in the traditional sense; no file was downloaded, no perimeter crossed, but the data now sits inside a third-party model. A common misconception is that this is primarily a browser problem, solvable by blocking a few chatbot domains; the same exposure happens inside internal applications, agentic workflows, and document pipelines that never touch a browser at all.
How It Relates to AI Governance
AI DLP is one piece of a broader governance problem: knowing not just that sensitive data was exposed, but which policy it violated, why the system allowed or blocked it, and whether that decision can be reconstructed for an auditor. Detection and redaction alone don't answer whether an interaction complied with GDPR, HIPAA, or internal risk thresholds. Mature approaches treat data protection as one policy check inside a larger evaluation, enforced consistently across both employee AI usage and production applications.