Where your hotel’s guest data goes when your staff use ChatGPT.

Chapter 01

A guest in room 412 has been charged twice. It is 9:20pm, the duty manager wants the apology out before the guest goes to bed, and the receptionist writing it is not a writer. So she opens a free AI tool, pastes in the guest’s message along with the name, the booking reference and the dates of the stay, and asks for something polite. Ten seconds later she has a good email. In those same ten seconds your hotel lost the ability to say where that guest’s data went.

Start by noticing what she got right. She wanted the guest answered tonight rather than tomorrow. She wanted the tone to be better than she could manage at the end of a shift. She used the fastest tool available to do a job her employer wants done. Every part of that judgement serves the hotel.

What she did not have was a route that was both fast and safe. That is not a training problem and it is not a discipline problem. It is a provisioning problem, and it belongs to whoever decides what tools sit on the desk.

Ask any front office manager how their team handles a difficult email in a foreign language at 11pm and you will hear some version of this story. The tools are free, they are on every phone, and they are genuinely good at the task. The only real question is whether the usage is visible to you or not.

Chapter 02

The uncomfortable part is not that consumer AI tools are careless. It is that after the fact you cannot prove anything. Where the text was processed, whether it was retained, whether it contributed to a model, who at the provider could have seen it: on a personal account, none of that is answerable by you.

Consumer tools process what you type on the provider’s infrastructure, frequently outside the EU. Retention and training practice vary by tool and by plan, and they change. You may well be using a provider whose terms are perfectly reasonable this month. The point is that you are relying on a claim rather than a control, and you have no record either way.

For ordinary office text that is an acceptable trade. A draft agenda, a rewritten paragraph of marketing copy, a translation of an internal notice: if that leaks, you have a bad day, not a notifiable incident. Guest data is a different category. A name attached to a booking, the dates of a stay, a passport scan, a health note in a special-request field. Once that has gone through an unmanaged account there is no path back and no record to produce.

If you want the vocabulary your security people will use, the OWASP Top 10 for LLM Applications ranks prompt injection first and sensitive information disclosure second. The second is the one that applies here, and it does not require an attacker. It only requires an employee, a deadline and a text box.

Chapter 03

The reflex is to block the tools. It is decisive, it is cheap, and it is the single most expensive mistake available in this area. A ban does not remove the demand that created the behaviour. It removes your view of it.

The work still has to be done and the tools still exist. What changes is the device and the account. Usage moves from a corporate browser you can see to a personal phone you cannot, and from a work account with a contract behind it to a personal account with nothing behind it. You have not reduced exposure. You have converted a measurable risk into an invisible one, and you have taught your team that the honest answer to “are you using AI?” is no.

That last part is the real cost. The moment the truthful answer becomes career-limiting, you stop receiving information about your own operation. Six months later you cannot answer a customer’s security questionnaire about AI usage, because your inventory says zero and your inventory is fiction.

A useful check: if your rule were followed exactly, would the work still get done on time and to standard? If the honest answer is no, you have not written a policy. You have written a reason for people to route around you.

Chapter 04

The way out is not less AI. It is a route that is quicker than the personal phone and safe by construction, so that reaching for the unmanaged tool becomes the slower option rather than the forbidden one. Four things do most of the work.

Of the four, redaction is the one that changes the arithmetic rather than the odds. Visibility tells you where you stand, an approved tool changes behaviour, a clear rule sets expectation. But redaction means that even when someone gets it wrong, and someone will, the thing that leaves is not the thing that hurts. It is the only control on the list that assumes failure and still holds.

Chapter 05

Treated as a compliance chore, this is a cost. Treated properly, it produces two things you can use commercially, and both arrive as a side effect of doing the work rather than as an extra project.

Your corporate customers are increasingly in NIS2 scope. Article 21(2)(d) requires them to manage security in their direct supplier relationships, and hotels are direct suppliers. The AI section of their questionnaire is already appearing, and it asks which AI services touch their people’s data, what happens to that data and who is accountable. A hotel with an inventory answers in an afternoon. A hotel with a ban and a blind spot answers slowly, badly or not at all, in a procurement conversation where slow reads as unmanaged.

The other gain is quieter and worth more. When using AI properly is easy and admitting to it is safe, you find out what your people are actually doing, which is the only basis on which you can improve any of it. The receptionist who told you she uses a translation tool every evening has just handed you a use case, a training need and a small piece of your risk picture, for free.

None of this requires taking a position on whether AI belongs in hospitality. It is already there, tonight, at your front desk, in the hands of someone doing her job well with the wrong tool because it was the only fast one. The decision in front of you is not whether that happens. It is whether you can see it.