Nobody told legal about your RAG pipeline -- why that's a problem