Picture a sales manager who copies 200 customer names out of Excel, pastes them into a chatbot and asks for follow-up emails. The drafts arrive in minutes. Then legal asks where that data went, who can see it, how long it is kept, and whether customers were ever told their details would be used this way.
None of this means AI is dangerous. It means the company is using AI before deciding how data should flow. This article separates frontier generative AI from an enterprise AI agent, explains why the two are not an either/or choice, and maps each layer of control to what it does for privacy and security.
What frontier generative AI is
Frontier here means the most capable general-purpose models at any given time, built by labs such as OpenAI, Anthropic and Google. Most people use them through chat apps like ChatGPT, Claude or Gemini. Developers call them through an API.
These models write, summarise, translate and reason through complex problems well. On their own, though, they do not know which customer is overdue, which payroll records an employee may see, or who must approve a purchase order above 500,000 baht. What a model knows about your company is whatever a user types or attaches in that conversation.
That is exactly why people copy and paste data into chat. It is the only way to get the model working on real information.
What an enterprise AI agent is
An enterprise AI agent is a system built around a model, and in many cases the model inside is a frontier model. What it adds are the layers that let the model work with company data and systems under company rules.
The common layers are:
- Connectors or APIs to ERP, CRM, HR, email and document stores
- Retrieval that pulls only the parts relevant to a question and cites the source so users can check it
- Tools or actions the agent may call, such as looking up an invoice, drafting an email or creating a draft quotation
- Role-based permissions, so the agent never sees more than the person who asked
- A personal data filter that removes or masks unnecessary details before anything reaches the model
- Human approval before actions that change something real
- An audit log of who asked for what, which data the agent read and which tools it called
In Building effective agents, Anthropic describes workflows as systems where LLMs and tools are orchestrated through predefined code paths, and agents as systems where LLMs dynamically direct their own processes and tool use. For a business this distinction matters. The more freedom the system has, the tighter the controls around it need to be, and many company tasks are better served by a fixed workflow than by an agent that plans its own route.
Side by side
| Area |
Generative AI used directly through chat |
Enterprise AI agent |
| Data access |
Whatever the user copies or attaches |
Pulled from source systems through connectors, limited to what the task needs |
| Permissions |
Unaware of the user's rights in company systems |
Tied to the requesting user's role |
| Actions |
Returns text; a person does the rest |
Calls approved tools such as search, draft or create |
| Audit trail |
Depends on the service plan and settings |
Designed to record requests, data read and tools called |
| Data location and retention |
Depends on the provider's terms and the plan in use |
Provider, contract and what stays in company systems can be chosen |
| Human approval |
Not built in, because there are no actions |
Defined per step |
| Cost and predictability |
Fast to start, clear per-seat cost, hard to control usage |
Design and integration cost up front, but scoped and measurable |
| Failure modes |
Wrong or invented answers; leaks from pasting data in the wrong place |
Wrong answers, plus wrong actions or manipulation through content the agent reads |
The last row matters most. An agent is not automatically safer. It removes some risks and adds others that chat does not have.
Privacy and security gains from a well-designed agent
The privacy benefit does not come from the word agent. It comes from the controls in each layer.
Least privilege for tools. Each tool should be narrow. An agent that answers order status questions for sales does not need a tool that edits prices, and should not run on an administrator account. OWASP's Top 10 for Agentic Applications for 2026 calls this Least-Agency: give an agent only as much autonomy as the task requires.
Data stays in source systems. Rather than copying the whole customer database somewhere new, a good design reads from the source when needed and keeps references. Data then has one owner, and when a record is changed or deleted at the source, no stale copy remains elsewhere.
Remove personal data before it reaches the model. Summarising complaints rarely requires a national ID number or a phone number, so those can be masked or replaced before anything leaves.
Pick provider terms that fit the job. Major providers separate business and API terms from consumer terms. Examples checked on official pages at the time of writing:
- OpenAI's API documentation states that since March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer explicitly opts in. It also describes abuse monitoring logs that may contain prompts and responses.
- Anthropic states that by default it will not use inputs or outputs from its commercial products, such as Claude for Work and the Anthropic API, to train its models, unless the customer reports feedback or otherwise chooses to allow it.
- Google's Gemini API terms state that for Paid Services, Google does not use prompts or responses to improve its products. For Unpaid Services, content may be used to improve products and human reviewers may read it, and Google tells users not to submit sensitive, confidential or personal information to the Unpaid Services.
So a free personal account and a business account from the same provider can carry very different terms, and terms change. Procurement and legal should read the current version before every signature.
Logs you can trace. If someone asks who let AI read a given contract, the system should answer who, when, through which tool, and where the output went.
A person approves actions with consequences. Let the agent draft an email, but stop for confirmation before it sends anything outside the company, changes customer data or creates a transaction tied to money. That stop must be enforced by the system, not requested in a prompt.
Defences against prompt injection and tool abuse. Content the agent reads, such as external email or attachments, can hide instructions. The system should keep data separate from instructions, validate tool inputs, and never let outside text change permissions or the task goal.
New risks that agents add
Several items in the OWASP Top 10 for LLM Applications 2025 apply directly. LLM01:2025 Prompt Injection covers inputs that alter a model's behaviour or output in unintended ways. LLM02:2025 Sensitive Information Disclosure covers sensitive data exposed through output. LLM06:2025 Excessive Agency names three root causes: excessive functionality, excessive permissions and excessive autonomy.
The OWASP Top 10 for Agentic Applications for 2026, published on December 9, 2025, goes further on agents. Examples include ASI01 Agent Goal Hijack, where an agent's goal is redirected through content it processes, ASI02 Tool Misuse and Exploitation, where legitimate tools are used in unintended ways, ASI03 Identity and Privilege Abuse, and ASI09 Human-Agent Trust Exploitation, where people's trust in the agent becomes the weak point.
That last one deserves executive attention. Human approval helps only if the approver sees enough to decide. If the approval screen just says the agent recommends confirming, people click out of habit.
The PDPA and Thai guidance
Thailand's Personal Data Protection Act B.E. 2562 (2019) does not mention AI, but several sections apply directly.
- Section 21 requires collection, use or disclosure to follow the purpose notified to the data subject. Using customer data with AI for a new purpose means checking whether it was notified or has another lawful basis.
- Section 22 limits collection to what is necessary for the controller's lawful purpose, which matches the idea of trimming data before it reaches a model.
- Section 28 sets the rule for sending or transferring data abroad: the destination must have adequate protection standards under criteria set by the PDPC, unless an exception applies. When a model runs on servers outside Thailand, this question needs an answer.
- Section 37(1) requires the controller to put appropriate security measures in place and review them when technology changes. Section 37(2) requires steps to stop anyone who receives the data from using or disclosing it without authority.
- Section 40 sets the duties of a data processor, including acting only on the controller's instructions and maintaining appropriate security. This bears on contracts with AI providers.
On AI governance, ETDA's AIGC centre has published Thailand's AI Governance Guideline for Executive, organised around three pillars: AI governance structure, AI strategy and AI operation, with Security & Privacy among its AI ethics principles. Internationally, NIST released the AI Risk Management Framework on January 26, 2023 for voluntary use, and published the Generative AI Profile (NIST AI 600-1) on July 26, 2024 as a companion resource for generative AI risks.
Which to use when
- Writing, summarising, translating or brainstorming with no customer, employee or trade-secret data: business-grade AI chat is fine, under a usage policy.
- Answering from internal documents such as policies, manuals or contracts: use retrieval that checks permissions and shows sources, rather than uploading files into chat one at a time.
- Reading data from ERP, CRM or HR: go through a scoped connector tied to role-based permissions.
- Changing data, emailing outside the company or touching money: an agent can do the work, with human approval and an audit log.
- If the process already has fixed steps, start with a predefined workflow and give the agent more freedom only once results show it is worth it.
Questions to answer before connecting AI to company data
- Does the task need real personal data? If so, which fields?
- Is this purpose covered by what data subjects were told, or by another lawful basis?
- Where does the model provider process data, how long is it kept, and what does the contract say about training?
- Whose account does the agent use, and are its permissions wider than the task?
- Which tools can the agent call, and which must wait for human approval?
- When the agent reads outside content, how does the system stop that text from becoming instructions?
- If something goes wrong, are the logs good enough to trace it, and who reviews them?
- At which step is a wrong output caught, and is that before it reaches a customer?
For the architecture side, see Building production AI agents. For scoping actions, see where approval should stop an AI browser agent. Teams unsure about data readiness can start with AI infrastructure and data foundations.
Frequently asked questions
What is an AI agent, and how is it different from a chatbot?
A chatbot replies with text based on what the user typed. An AI agent calls tools, reads data from systems and works through several steps until the task is done. An enterprise version adds role-based permissions, approval points and audit logs.
What is the difference between generative AI and an AI agent? Do I have to choose?
No. Generative AI is the model that produces content. An AI agent is a system that uses that model at its core and adds data connections, tools and controls.
Is it safe to use ChatGPT at work?
It depends on the plan, the settings and the data you put in. Business and API offerings from major providers usually have different training terms from personal accounts. Companies should define which data must never be entered, use accounts the company controls, and read the provider's current terms.
Does using ChatGPT with customer data break the PDPA?
There is no single answer. It depends on whether the purpose matches what customers were told or has another lawful basis, whether more data is used than necessary, under what conditions data goes abroad, and whether a contract with the provider sets security duties. This article is not legal advice; for a real case, consult your legal adviser or data protection officer.
Where should a company start with AI and the PDPA?
List which personal data each AI task uses, for what purpose, where it is sent and who can access it. Then remove what is not needed, tie access to roles and keep logs you can trace. This is existing PDPA practice applied to a new tool.
What Enersys does
Enersys is a Bangkok software house that has built business software since 2012. Our AI work starts with choosing tasks that suit AI and agreeing how to measure them, then preparing and connecting the data each task needs, and placing AI agents into the workflow with a person checking or approving the steps that matter and access following each user's role. See the overview on our AI page.
Genesis AI connects to ERP, CRM, HR, email and document stores through an API or a supported connector, and answers from documents with sources so users can check the original. PrivacyHub handles PDPA governance: personal data stays in the source system and PrivacyHub keeps only metadata.
If you are not sure how ready your organisation is, try the AI readiness assessment or talk to our team about where to start.
Sources
All links accessed 14 Oct 2026.
