AI Governance for Hotels
Guidance on adopting artificial intelligence responsibly and securely in your hotel's operation.
What's included
AI is already entering hotel operations, with or without formal approval. We help bring it under clear governance, across the areas below.
Assessment before adoption
We identify where AI makes sense in the operation, such as guest service, marketing and internal processes, and review tools and suppliers before they go into use, looking at data, risks and contracts.
Shadow AI audit
We find out which AI tools staff are already using on their own, often without formal approval.
Responsible use policies
Clear rules on what staff can and cannot enter into AI tools, and a simple approval process for new tools before anyone starts using them.
Contracts with AI suppliers
Review of the data and privacy clauses in contracts with AI tool suppliers.
Microsoft Copilot
Before Copilot is switched on, we review permissions and data classification in Microsoft 365, so it doesn't surface guest, HR or finance files to people who shouldn't see them.
AI security
Risks specific to AI tools, such as prompt injection and data leaking through chatbots and assistants, assessed with suppliers before and after deployment.
Staff training
Training so staff use AI safely and responsibly in their day-to-day work.
Regulatory risk and monitoring
Identifying the regulatory and privacy risks of each use of AI in the operation, and tracking changes relevant to the hotel sector, such as Bill 2338/2023 (Brazil's AI bill) and the related bills progressing with it.
- Inventory of AI tools in use, including informal adoption ("shadow AI")
- Documented responsible AI use policy
- Risk assessment report by tool or supplier
- Due diligence checklist for new AI adoption
- Training material for staff
Why this matters for your hotel
Adoption of artificial intelligence is growing fast in hospitality, from guest service chatbots to data analysis tools, dynamic pricing and marketing automation. Using these solutions without clear criteria can create privacy, security and compliance risks, especially when guest data is involved.
In many hotels, staff are already adopting AI tools on their own, without prior security review or formal approval. This unstructured use, known as "shadow AI", is one of the main sources of risk: sensitive data can end up exposed to suppliers without proper contractual safeguards.
We help your hotel map current AI use, assess suppliers responsibly and set clear policies for staff, without compromising the security of guest data or compliance with the LGPD.
Where AI is already entering hospitality
Adoption rarely starts with a formal decision. In many hotels, AI is already present in some of these areas, often without leadership having formally assessed each tool:
- Chatbots and virtual assistants in guest service (website, WhatsApp, check-in kiosks)
- AI-assisted dynamic pricing and revenue management
- Content generation and marketing automation: room descriptions, campaigns and social media
- Back-office productivity tools: summarising emails, reports and meeting minutes, with assistants such as ChatGPT or Copilot
- Predictive analysis of occupancy, demand and guest behaviour
- CV screening, support for recruitment and staff performance reviews
- Generative AI features switched on by default in systems the hotel already uses (PMS, CRM, HR platforms), often through a product update and without explicit notice to the customer
Risks that often go unnoticed
Not every AI risk is obvious. The ones that come up most in hotels that have not yet formalised a policy are:
- Guest data entered into generative AI tools such as ChatGPT, Gemini or Copilot with no control over where it is stored or whether it feeds the training of other models
- Automated pricing or candidate screening decisions with no human review, with the risk of discriminatory outcomes. Article 20 of the LGPD already gives individuals the right to request a review of decisions based solely on automated processing
- Contracts with AI suppliers without clear clauses on data retention, use and deletion
- Employee data (CVs, performance reviews, occupational health data) processed by HR AI tools with no defined legal basis under the LGPD or formal notice to staff
- Tools adopted by individual teams without approval from leadership or IT ("shadow AI")
- Suppliers of systems already under contract (PMS, CRM, booking engine) that start processing data with AI after an update, when the original contract did not provide for it
- No one formally responsible for tracking regulatory changes on the use of AI in Brazil
Related articles (in Portuguese)
AI governance in hospitality: using AI with security, privacy and control
Generative AI is already in use at many hotels, with or without approval. How to create an AI policy, assess suppliers and avoid shadow AI.
Read article
AI in hotel guest service: how to use it without breaching the LGPD
Chatbots, voice assistants and AI tools already handle guest data. Legal bases, supplier contracts and what never to send to a third-party AI.
Read articleFrequently asked questions about AI in hospitality
How can a hotel use AI safely?
With four things in place before scaling up use: an inventory of what staff already use, a short policy stating what can and cannot go into AI tools, an assessment of each supplier before contracting (where the data is kept, whether it is used to train models, which LGPD clauses they accept) and human review of any decision that affects a guest or employee. Use itself can be broad. What it cannot be is invisible.
What are the risks of using AI in hospitality?
The most frequent: guest data pasted into free tools with no control over retention; automated pricing or candidate screening decisions with no human review and with bias; contracts with AI suppliers lacking clauses on data use and deletion; AI features switched on by an update in systems already under contract (PMS, CRM) when the original contract did not provide for it; and no one responsible for tracking regulation. None of them requires stopping the use of AI. All of them require governance.
What should a hotel staff AI use policy include?
Which tools are approved and under which account (corporate, not personal); which data can never be entered (identity documents, cards, health data, employee information); when AI output needs human review before it becomes an action; how to request approval for a new tool; and who owns the policy. One well-written page that staff are trained on is worth more than a manual nobody reads.
How can a hotel control staff use of ChatGPT and other tools (shadow AI)?
First, find out what is already in use: a quick audit by department usually reveals chatbots, translators and writing assistants adopted on people's own initiative. Then offer an approved alternative with a corporate account, rather than just banning tools, and train staff on what must not be entered. Technical blocking only makes sense for high-risk data, and even then only once the alternative exists.
How should a hotel assess an AI tool before contracting it?
Six questions for the supplier: where the data is processed and stored; whether the hotel's data is used to train models; how long it is kept and how it is deleted; whether the supplier accepts the LGPD processor clause; whether access and decisions are logged; and how the hotel exits the contract and takes its data with it. If the supplier will not answer one of them in writing, that is already the answer.
Can an AI chatbot access the hotel's PMS?
Yes, with controls. Access should be through an integration with minimal permissions (checking availability and creating bookings, not reading the full guest history), with every query logged, payment data out of the chatbot's reach and a supplier contract that defines how the exchanged data is handled. Conversations with guests are personal data too and need a retention period.
Ready to adopt AI responsibly?
Assess the AI tools in use at your hotel and create a clear use policy. We work in English or Portuguese, Monday to Friday, 9:00 to 18:00 Brasília time.