An employee pastes confidential plans into an unapproved public AI tool. Which response best addresses the organizational issue?

1. Encourage every employee to use whichever tool gives the fastest answer.
2. Delete the policy rather than addressing the exposure.
3. Assume copied text cannot leave the organization because the employee still owns the document.
4. Follow the data-incident process and provide clear approved tooling, data rules, and role-based training.