You’re brushing too broad a stroke GDPR only affects personal information. There’s plenty of sensitive business information that is not covered by GDPR - for example per business customer revenue data - that is legal to put into an AI tool but your employer may not want you to.