AI and Staff Behaviour in Guinea: Why Training Is Not Enough

It is 6 p.m. in an NGO office in Kaloum. A programme officer has to send a report to donors the next morning. She opens ChatGPT, pastes the list of beneficiaries with their names, villages and phone numbers, and asks for a clean summary. The report is ready in ten minutes. The data, meanwhile, has gone to a server abroad.

This scene plays out every day in Conakry, in banks, mining companies, telecom operators and humanitarian organisations. Nobody is acting in bad faith. People want to do their job well, and quickly. That is exactly why the problem is first a matter of behaviour, and only then a matter of technology.

How Guinean teams actually use AI

In most organisations, generative AI came in through the side door. One colleague shows the tool to another, it gets installed on a phone, and people use it for a letter in French or to translate a document into English for a partner. Usage then spreads quickly:

• rewording an email to an unhappy customer, including the name and account number;

• summarising a mining subcontract or the minutes of a meeting;

• cleaning up a payroll spreadsheet or a beneficiary database;

• preparing a tender response with internal figures.

Many employees use their free personal account, sometimes on their own phone over mobile data. The employer sees nothing. We described this pattern and what it costs in our article on the real cost of shadow AI.

What Law L/2016/037 expects, even without an active regulator

Law No. L/2016/037/AN on cybersecurity and the protection of personal data requires the data controller to protect data against any unauthorised disclosure. It also regulates transfers outside Guinea. Pasting a beneficiary list into an assistant hosted abroad therefore touches both rules at once.

The authority provided for by the law is not yet fully in place. That does not change the organisation's responsibility. If a leak happens, the employer is the one who will have to explain what it had put in place. We cover the legal framework in our guide to Law L/2016/037 and AI governance.

Why training alone is not enough

The usual answer is an awareness session. Half a day, a few slides, an attendance sheet. Participants leave convinced. Three weeks later, under deadline pressure, they do exactly the same thing again.

This is not a flaw of Guinean staff, it is human nature. Several reasons explain it:

• Forgetting. A rule learned in a training room fades fast if nobody recalls it at the right moment.

• Urgency. When the director is waiting for a document, compliance comes second.

• Invisible risk. Nothing happens on screen when sensitive data is pasted. No warning, no immediate consequence.

• Data that is hard to recognise. A phone number, a passport number or an Orange Money ID does not always look like a secret.

We explored this in why AI security training doesn't work. Training is still useful, but it cannot carry the load on its own.

The nudge at the moment of risk

The idea is simple: step in at the exact moment the employee is about to send sensitive data, not three weeks earlier. A short message appears in the browser: "This text contains phone numbers and beneficiary names. Do you want to anonymise them before sending?"

This small reminder changes behaviour far more than a long training course. It brings three things:

1. Immediate awareness, at the moment the decision is made.

2. A practical way out, not just a ban: the text goes through, but without the personal data.

3. Learning through repetition: after a few alerts, the employee removes names before pasting, without being asked.

Tone matters a lot. A message that blames people pushes them to work around the tool, for example by switching to their personal phone. A helpful message in plain French is accepted.

Fitting the approach to the Guinean context

A few local realities should shape the rollout:

• Language. Messages should be in clear French. Many teams also speak Susu, Pular or Maninka at work, so managers' spoken explanations work better in those languages.

• The phone. A policy that only covers office computers misses a large share of real usage.

• Donors and partners. NGOs and mining companies report to foreign partners who ask more and more questions about data protection.

• Field teams. In Boké, Kamsar or Nzérékoré, staff often have less access to training. An automatic reminder reaches them as well as it reaches head office.

Measuring the change in behaviour

A good setup produces simple indicators: alerts per week, share of anonymised submissions, most exposed departments, most frequent data types. After a few weeks, the curve should go down. If it does not drop in one department, that is the signal to go back, talk, and sometimes rethink the tools provided.

These logs also serve as evidence. The day Guinea's data protection authority becomes operational, or when a donor asks for an audit, the organisation can show what it has done. To see how a leak actually happens, read the anatomy of an AI data leak.

Summary

In Guinea, data leaks to AI rarely come from an attack. They come from busy employees who want to do the right thing. Training lays the groundwork, but a helpful reminder at the moment of risk is what really changes habits. Law L/2016/037 already applies, so it makes sense to build these reflexes now.

ZeusLock detects sensitive data in prompts and files, offers one-click anonymisation and keeps a record of every incident. Book a ZeusLock demo to see how to support your teams without slowing them down.