AI governance in hospitality: how to use AI with security, privacy and control
Generative AI tools are already in use in many hotels, approved or not. The question is no longer whether the team will use AI, but whether the hotel knows which tools are in use, with what data, and under whose control. That is AI governance.
Why AI governance is different from "using an AI tool"
Adopting an AI tool is a one-off decision: someone tries it, likes it, and starts using it every day. AI governance is something else: it is the set of rules that decides which tools the hotel allows, what data they can work with, who approves a new tool before the team starts using it with real information, and what happens when someone finds an unapproved tool that has been in use for months.
In many hotels, those answers have not yet been formalised. That does not mean AI is not in use; it only means nobody is looking at the whole picture.
The Shadow AI problem in hospitality
Shadow AI is to artificial intelligence what Shadow IT has always been to software: tools used by the team without approval, without a reviewed contract and without leadership knowing about them. In hospitality, it tends to show up in quiet, everyday ways:
- A receptionist who pastes a guest's complaint email into the free version of ChatGPT or Gemini to write a more polite reply.
- The marketing team uploading photos and data from past campaigns, sometimes with guest names in testimonials, to a content generation tool.
- HR using an AI tool to screen CVs or summarise performance reviews, without checking where that data is stored.
- Management asking a generative AI to analyse an occupancy and revenue spreadsheet that contains the hotel's commercially sensitive data.
None of these cases usually starts in bad faith. They start because there is no clear policy and no list of approved tools. The result is the same either way: guest data, contracts or commercial information end up processed by a third-party supplier without the hotel having assessed that processing.
Where AI is already part of hotel operations
AI governance has to cover more than guest service. AI, generative or not, already shows up regularly in these areas of hospitality:
- Guest service and reservations: chatbots, voice assistants and summarising tools that read guest data directly from the PMS. See the dedicated guide on AI in guest service and the LGPD for that specific case.
- Marketing and content: generating text, images and campaigns, often using real guest photos or data from earlier campaigns as a reference.
- Revenue management and pricing: tools that analyse historical occupancy and competitor data to suggest rates.
- HR and recruitment: CV screening, writing job descriptions and summarising internal reviews.
- Data analysis and BI: assistants such as Copilot that summarise financial or operational reports, and that may end up receiving complete spreadsheets instead of data that has already been filtered.
- Security and IT: AI tools used by the technical team itself to triage alerts, which also need assessing, not just what hotel operations use.
Not every adoption of AI starts with a new contract. The PMS, CRM, HR platforms and corporate tools the hotel already pays for can gain AI features in an update, and the hotel then has a new kind of data processing without ever deciding on it. That is why the inventory should also record which existing suppliers have started using AI on the hotel's data.
What to put in an AI use policy
An effective AI policy for a mid-sized hotel does not need to be a long legal document. It needs to be short, specific and known by the team. The elements that make a difference:
A list of approved tools: which AI tools the team may use, and for which purposes each one was approved.
Data that must never go into an unapproved AI tool: identity documents, payment data, sensitive data as defined by the LGPD (Brazil's data protection law), supplier contracts and the hotel's financial information.
An approval process for new tools: who the team should ask for approval before starting to use a new AI tool at work, even a free version.
Defined responsibility: who at the hotel has the authority to approve, veto or switch off the use of an AI tool.
What happens when the policy is not followed: how an unapproved tool found in use is handled, treated as a process deviation to correct, not as a witch hunt that discourages the team from being open.
Regular review: the list of approved tools and the rules of use should be reviewed regularly, and whenever a supplier changes, a tool gains new AI features or the data processing changes.
Assessing the risk of AI suppliers
Before approving any AI tool for use with the hotel's real data, it is worth applying the same rigour you would apply to hiring a new PMS or payment gateway. The points that matter most:
- Where the data is processed and stored, whether there is an international transfer and which mechanism under the LGPD supports that transfer, as set out in the ANPD regulation (in Portuguese). The ANPD is Brazil's data protection authority.
- Whether the supplier uses customer data to train general-purpose models, and whether that can be switched off by contract.
- Whether there is a clause requiring notification of a security incident within a defined period.
- What role the supplier plays in the processing under the LGPD. It does not become a processor just because the contract says so: the role depends on who defines the purposes and essential elements of the processing, as the ANPD guide on processing agents (in Portuguese) explains. When it acts as a processor, the contract should set out its obligations and responsibilities clearly.
- Whether there is a clear path for deleting the data at the end of the contract or on request.
Suppliers that cannot answer these questions clearly should stay off the list of approved tools until the doubts are resolved, even when the tool itself is good.
Accountability: who runs AI governance day to day
A mid-sized hotel does not normally need a dedicated AI role. It needs the responsibility to be clearly assigned to someone who already answers for IT, information security or compliance, in-house or through an external partner, with the authority to approve or refuse a new tool and direct access to the board. A common mistake is to let each department decide on its own: that fragmentation is exactly what creates Shadow AI.
A practical checklist to get started
- Find out what is already in use: ask the team, with no punishment, which AI tools they use at work today.
- Classify each tool by the type of data it touches (guest data, financial data, internal data with no risk).
- Write a short policy with the list of approved tools and what must never be entered into them.
- Decide who approves new tools and tell every department.
- Review the contracts of the AI tools already in use with the same criteria applied to any other technology supplier.
- Review the inventory and the policy when a tool changes supplier, gains new AI features or starts processing a new category of data.
Next steps
AI governance is not about banning artificial intelligence from hotel operations; it is about making sure the hotel knows what is in use and can answer for it to the ANPD, to guests and to its own board, if needed. The same discipline that already applies to PMS, POS and payment suppliers has to apply to the AI tools the team is already using today. And the subject is about to gain legal weight: see what PL 2338, Brazil's AI bill, means for hotels.
Our team can map the AI tools already in use at your hotel, draft a use policy suited to the size of the operation and review AI supplier contracts before renewal. Talk to our team.
Sources
- ANPD, Guia Orientativo para Definições dos Agentes de Tratamento de Dados Pessoais e do Encarregado (guidance on processing agents and the DPO, version 2.0, 2022, in Portuguese), gov.br/anpd
- ANPD, Resolução CD/ANPD nº 19, Regulamento de Transferência Internacional de Dados (international data transfer regulation, August 2024, in Portuguese), in.gov.br
AI governance for hotels
AI use policies, assessment of tools and suppliers, and control of Shadow AI for hotels and resorts.
View service- Inventory of AI tools in use
- AI use policy
- Risk assessment of AI suppliers
- Shadow AI control
Related reading
What does AI governance mean for a hotel in practice?
It is the set of rules, roles and processes that defines which AI tools the team may use, with what data, on what legal basis and with what prior approval. In practice, it starts with an inventory of the AI tools already in use (approved or not), a short, objective policy on what may and may not be entered into them, and a simple process to assess and approve new tools before the team starts using them with real guest data.
What is Shadow AI and why is it a risk for a hotel?
Shadow AI is the use of artificial intelligence tools by staff without approval, contract review or leadership knowing about it, usually free accounts on AI chatbots used to draft emails, summarise guest complaints or generate marketing content. The risk is not the productivity the tool brings; it is that guest data, contracts or internal information end up processed by a third-party service with no contract defining the supplier's role and the terms of the processing, no security clause and nobody having assessed where that data is stored.
Is it safe to use ChatGPT, Gemini or Copilot in day-to-day hotel work?
It can be, as long as the tool and the use are assessed beforehand, not afterwards. The risk is not in the tool itself but in pasting guest data, contracts or financial information into a free account without knowing whether that data is used to train the model or how long it is stored. For generic tasks that involve no personal, confidential or commercially sensitive data, the risk tends to be much lower. For any task with guest data or sensitive commercial information, we recommend an approved tool with contractual guarantees, not a free personal account.
How is this guide different from the article on AI in guest service and the LGPD?
The article on AI in guest service covers one specific case: chatbots and assistants that talk directly to guests. AI governance is the broader umbrella, covering every use of AI in the operation (guest service, marketing, HR, revenue management, data analysis and security) with a single policy, an approval process for tools and clear responsibility for the subject. Guest service is only one application of it.
Who should be responsible for AI governance in a mid-sized hotel?
Mid-sized hotels generally have no dedicated role for this, and they do not need one. An effective approach is to assign the responsibility to whoever already answers for IT, information security or compliance, with the power to approve or veto new AI tools and direct access to the hotel's board. What does not work is letting each department decide on its own, because that is exactly how Shadow AI takes hold.
How do you assess the risk of an AI supplier before signing?
Before connecting any AI tool to the hotel's real data, check where the data is processed and stored, whether the supplier uses customer data to train general-purpose models (and whether that can be switched off by contract), whether there is a clause requiring incident notification within a defined period, and what role the supplier plays in the processing under the LGPD, which depends on who defines the purposes of the processing and not only on what the contract says. Suppliers that cannot answer these questions clearly should stay off the list of approved tools until the doubts are resolved, whatever the quality of the tool.
Put AI under control before Shadow AI becomes a habit
Talk to our team and see how to map the AI tools in use, draft a policy and assess suppliers.