Opinion
Free is the most expensive option you'll ever choose
There's a decision being made in your business every day by people who don't know they're making it. Someone needs help with a document, there's a free AI tool one tab away, they use it. They just chose your vendor, your terms and your data-handling policy — in two seconds, on your behalf.
Run any tool through four questions
When I evaluate anything for a client I run it through four lenses. I call it SEEC — Security, Expansion, Ease and Cost. It's a habit from thirty years of enterprise infrastructure and it takes about a minute. Run "the free tier" through it and something interesting falls out.
💵 Cost — wins. It's free. Nothing to argue with.
🚀 Ease — appears to win. No procurement, no approval, no training. Already open in a browser tab.
🔒 Security — loses badly. Different terms than the paid tier. No contract. No compliance agreement. No visibility for you.
📈 Expansion — loses badly. No user management, no way to enforce anything, no audit surface. Twelve people on twelve personal accounts isn't a system — it's twelve systems.
Look at the shape of that. Free wins on the two lenses you feel today and fails the two you feel later.
Cost and Ease are immediate and personal — the person at 4:40 on a Thursday feels both, sharply, right now. Security and Expansion are deferred and institutional. Nobody feels them until somebody asks a question, and by then months have passed. That asymmetry is the whole trap.
Now work backwards from the bad day
The bad day: a client, an insurer or opposing counsel asks a simple question. Was our information ever put into an AI tool?
To answer, you need a record of what was sent. To have a record, you need a sanctioned tool that produces one. To have bought one, you need to have decided what data goes where. To have decided that, you need to have known you had a problem at all.
Awareness → classification → tool → policy → logging → the ability to answer.
Most small businesses are at step zero. The entire chain is maybe two weeks of ordinary work. It isn't hard and it isn't expensive — it just never happens, because nothing forces it. No renewal date, no audit, no invoice. Nothing arrives to make you deal with it.
The part that should genuinely worry you
Almost every compliance problem can be fixed after the fact. No encryption? Turn it on. No access reviews? Start next quarter. Weak passwords? Force a rotation. You close the gap, document the remediation, move forward. That's how the whole field works.
This one cannot be fixed retroactively.
You cannot go back and create a log of what already happened. The disclosures were made. There is no record, there never was one, and no amount of budget will produce one now.
So when someone asks what went out over the last eighteen months, your honest answer is permanently "we don't know." Not "it was fine." Not "here's the report." We don't know — and we can never find out.
That's the real exposure. Not the disclosure, which may well have been harmless. The permanent inability to characterise it. An insurer can work with a bad answer. Nobody can work with a missing one.
So when is free actually fine?
I'm not telling you never to use a free tool. The rule is narrower and more useful.
Free is fine for anything you'd be comfortable seeing published. A job posting. A social caption. "Explain this concept to me." Nothing is at stake, so nothing is exposed.
The moment someone else's information enters, free is never the right answer. Not because it's bad software — the free tools are often excellent. Because you've quietly moved from a tool decision to a custody decision, and free tiers do not do custody.
What to do about it this week
Run SEEC on whatever your team is using right now. Four questions, one minute. If it fails Security and Expansion, you've found your gap.
Name a sanctioned tool and pay for it. The business tier costs about what one software subscription costs. It exists specifically so someone is contractually accountable.
Then draw the line in plain language: if it has a person's name on it, it doesn't go in. That's the whole intervention, and it's roughly a week of attention.
None of this is new
Vendor risk management. Data classification. Sanctioned tooling. Audit trail. Retention. These are the ordinary controls enterprise IT built over thirty years — mostly adopted after something expensive went wrong. I spent those thirty years inside them: hospitals, a major international law firm, a sixty-branch public library system.
The tool is new. The problem is not.
The takeaway
Free wins on the scoreboard your team can see and loses on the one that decides whether you can answer a question later.
And unlike almost everything else in this field, you cannot buy your way out of it after the fact. There is no product that retroactively creates the record you didn't keep.