Public AI tools such as ChatGPT and Gemini are safe enough for work when 3 conditions hold: staff use business accounts the company has approved, restricted data never goes into any tool, and a person checks every output before anyone relies on it. A 6-part written policy makes those conditions enforceable and maps to the NIST AI RMF.
Most companies are past deciding whether staff use AI. In the 2024 Work Trend Index, Microsoft and LinkedIn found that 78% of AI users bring their own AI tools to work. MIT’s Project NANDA reported in 2025 that workers at more than 90% of the companies it surveyed regularly used personal AI tools for work, while only 40% of those companies said they had bought an official LLM subscription. A policy decides whether that use happens where the company can see it.
Our earlier risk-based assessment of generative AI asks whether ChatGPT is secure by design, and our post on managing cyber risks with responsible AI sets out the principles. This article covers the policy for how staff use these tools.
What a workplace policy for public AI tools is
A workplace policy for public AI tools, often called an AI acceptable use policy, is the written rule set that decides which AI tools staff may use, through which accounts, with which data, and who checks the output before anyone relies on it. Its job is to bring shadow AI, the use of AI that the organization has not approved and cannot see, into accounts the company manages.
Few organizations have one that holds. ISACA’s 2026 AI Pulse Poll of more than 3,400 digital trust professionals found that only 38% of organizations have a “formal, comprehensive” AI policy, up from 28% in 2025, and 25% have no active policy at all. In the same poll, 90% believe employees are using AI in their organization.
The account matters more than the tool
OpenAI’s Help Center says that on its services for individuals, such as ChatGPT, it may use a user’s content to train its models unless the user turns off “Improve the model for everyone”. It adds that when a user gives feedback, such as a thumbs up, the entire conversation may be used for training even after opting out. For ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu and its API, OpenAI says it does not use inputs or outputs to improve its models by default.
Google’s Gemini Apps Privacy Hub says a subset of chats is reviewed by human reviewers, and that reviewed chats are kept for up to 3 years even after the user deletes their activity. It asks users not to enter confidential information they would not want a reviewer to see, and notes that work or school accounts may be subject to different data handling terms.
| Account | What the provider says about training and review | Retention the provider describes | What the policy allows in it |
|---|---|---|---|
| ChatGPT on a personal account | OpenAI may use content to train its models unless the user opts out, and feedback can bring a whole conversation into training even after opting out. | The company has no workspace controls over a personal account. | Only public information goes in. |
| ChatGPT Business, Enterprise or Edu, or the API | OpenAI does not use inputs or outputs to improve its models by default. | For Enterprise and Edu, workspace admins control retention, and deleted conversations are removed within 30 days unless OpenAI must keep them by law. | Public and internal information go in. |
| Gemini Apps on a personal Google Account | Google uses chats to improve its services, including generative AI models, and human reviewers read a subset of chats. | Reviewed chats are kept for up to 3 years, even after the user deletes their activity. | Only public information goes in. |
| Gemini with a work or school Google account | Google says use may be subject to different data handling terms. | The terms for that account decide it, so they are read before approval. | The approval decides. |
A policy cannot depend on every employee finding the right setting on a personal account, so it decides which accounts are allowed. When I read OpenAI’s page on 25 September 2026, it had been updated that same day. Providers change these terms often, so read them again whenever you approve a tool.
The policy, in 6 parts
1. Data classes
The policy sorts information into 3 classes with one rule each. Public information, such as published marketing copy, may go into any approved tool. Internal information, such as meeting notes and drafts, may go only into an approved business account. Restricted information never goes into a public AI tool, whatever the account.
List restricted information by name, so nobody has to interpret a definition while pasting. My list would include personal data, credentials and API keys, health and payment card data, incident details, unannounced financial results, legal advice, and anything shared under a confidentiality agreement. Cyberhaven, a data security vendor, reported in February 2026 that 39.7% of the AI interactions in its research involved sensitive data. A business account changes how the provider treats data, and the company’s own obligations stay where they were.
2. Approved tools and accounts
The policy names the approved tools and allows only business accounts the company manages, with sign-in through its single sign-on. Personal accounts are not used for company work. Cyberhaven’s research found that 32.3% of ChatGPT use and 24.9% of Gemini use ran through personal accounts, which bypass single sign-on, central logging and the company’s retention settings.
Before approval, someone reads the provider’s terms on training, human review and retention for that account type and records the date. An AI assistant added to software the company already uses counts as a new tool. FS-ISAC, the information sharing center for financial services, took the same line in its September 2023 framework for external generative AI: firms should publish a list of approved generative AI systems based on an assessment of each vendor, and treat generative AI like any other third-party system.
Read the provider’s published security answers as well, and check their date. An answer written more than a year ago describes a company whose staff, suppliers and systems have changed since. Our Security Posture Benchmark 2026, which DigitalXForce publishes on 15 October, looks at the age of those published answers. An AI provider is a third party like any other, and our third-party risk management module assesses it the same way.
3. Human review of every output
A person checks any AI output before it goes to a customer, into production code, into a contract or into a decision, and the person who uses the output owns it. In a May 2026 ISC2 survey of 856 cybersecurity professionals who use AI in their roles, 89% had seen AI recommendations lead to incorrect outcomes at their organizations. If specialists see that, everyone else should treat review as the control that matters most.
The wider workforce data says review is often skipped. The global study on trust in AI led by the University of Melbourne with KPMG surveyed more than 48,000 people in 47 countries and found that at work, 66% rely on AI output without evaluating its accuracy and 56% are making mistakes in their work because of AI. The 2026 AI Index from Stanford HAI reports hallucination rates between 22% and 94% across 26 top models in a new accuracy benchmark.
Where an output is published outside the company, it is labeled as AI-generated wherever the law or a customer requires it. Some markets already require it: Stanford HAI’s 2026 AI Index records that one of the most advanced AI markets finalized mandatory labeling rules for AI-generated and synthetic media in 2025.
4. Logging
The company records which AI tools are used, by whom and for which kind of work. Single sign-on and web proxy logs, where the company keeps them, can be compared each month against the approved list. Mistakes, such as restricted data pasted into the wrong tool, go through the existing incident process.
The cost of skipping this is measurable. IBM’s 2025 Cost of a Data Breach Report found that 1 in 5 organizations reported a breach due to shadow AI, and organizations with high levels of shadow AI saw breach costs $670,000 higher on average than those with low levels or none. Of the organizations with AI governance policies, only 34% audited regularly for unsanctioned AI. IBM is a vendor, and these figures come from its research.
5. Training
Every employee gets short training at onboarding and once a year. It covers the 3 data classes with real examples, how to reach the approved accounts, how to check an output and how to report a mistake.
In the EU this part is also a legal duty. Article 4 of the AI Act has required providers and deployers of AI systems to take measures on the AI literacy of their staff since 2 February 2025. The European Commission’s AI literacy questions and answers say the Digital Omnibus on AI, in force since mid-July 2026, kept AI literacy as an obligation while dropping the requirement for a specific “sufficient” level, and that national market surveillance authorities supervise it from August 2026. ISACA found that 33% of organizations now train all employees on AI, up from 22% in 2025.
6. An inventory of AI use
One register lists every AI tool and AI feature in use, with its provider, account type, owner, purpose, highest data class allowed, approval date and the date its terms were last read. The log review in part 4 finds AI that nobody declared, and each find is either registered or switched off. A register like this usually starts life in a spreadsheet, and moving GRC from spreadsheets to an automated platform covers the point where that stops working.
The policy itself needs a named executive owner. The NIST AI RMF expects executive leadership to take responsibility for decisions about AI risks (Govern 2.3). Why that accountability stays with people is the subject of my previous article, Will AI replace cybersecurity teams?
If you would rather not start the policy from a blank page, our AI-Powered Policy and Compliance Management module ships with 20+ policies, 15+ standards and 5 plan templates, and XForce GPT generates policies, standards and plans for review by your own people.
How the policy maps to the NIST AI RMF, ISO/IEC 42001 and the EU AI Act
The NIST AI Risk Management Framework 1.0, released in January 2023, has 4 functions: Govern, Map, Measure and Manage. Each part of the policy serves an outcome in the framework’s core.
| Part of the policy | NIST AI RMF function | The outcome it serves |
|---|---|---|
| 1. Data classes | Govern, Manage | Govern 1.1 asks that legal and regulatory requirements involving AI are understood, managed and documented. Manage 1.3 lists avoiding a risk as a response option. |
| 2. Approved tools and accounts | Govern | Govern 6.1 asks for policies and procedures that address AI risks associated with third-party entities. |
| 3. Human review | Map | Map 3.5 asks that processes for human oversight are defined, assessed and documented. |
| 4. Logging | Measure, Manage | Measure 2.4 asks that AI systems are monitored when in production, and Manage 4.1 asks for post-deployment monitoring plans that include incident response. |
| 5. Training | Govern | Govern 2.2 asks that personnel and partners receive AI risk management training. |
| 6. Inventory | Govern | Govern 1.6 asks for mechanisms to inventory AI systems. |
For generative AI specifically, NIST’s Generative AI Profile, NIST AI 600-1, released in July 2024, defines risks that are unique to or exacerbated by generative AI, including confabulation, data privacy and information security, and each of those 3 maps to a part of this policy.
ISO/IEC 42001:2023 is the AI management system standard, and ISO describes it as designed for organizations that provide or use AI-based products or services. I would treat this policy as the first document of that management system, so the work is not repeated if you certify later.
The EU AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. Its AI literacy duty in Article 4 applies to deployers, which the Act defines as anyone using an AI system under its authority outside personal, non-professional activity. Which of its other obligations apply to your use of public AI tools is a question for your legal team.
Where DigitalXForce is not the answer
A company of 30 people with one approved AI tool needs this policy and a spreadsheet. It does not need a platform.
The case changes when AI spreads into systems the company runs itself. We built AI TRiSCM™, the AI module of our Trust, Risk, Security and Compliance Management platform, for that stage: it discovers AI assets across cloud, code, pipelines, containers, model endpoints and RAG stores and maps them to the frameworks above. The glossary defines it, the AI TRiSCM and AI Risk Governance page has the module details, and what TRiSCM is explains the category. For a company that wants the inventory and the evidence with cloud hosting, DigitalXForce Lite is the full DigitalXForce platform hosted in the cloud, with the same functionality.
Questions about public AI tools at work
Is it safe to put company data into ChatGPT?
It depends on the account and the data. Internal information can go into an approved business account, where OpenAI says it does not use inputs or outputs to improve its models by default. Restricted information, such as personal data, credentials or unannounced results, should not go into any public AI tool.
Does ChatGPT train on what employees type?
OpenAI says that on its services for individuals, such as ChatGPT on a personal account, it may use content to train its models unless the user opts out, and feedback can bring a whole conversation into training even after opting out. For ChatGPT Business, Enterprise, Edu and the API, it says it does not do so by default. That difference is why the policy allows business accounts only.
How is ChatGPT Enterprise different from a personal ChatGPT account for privacy?
OpenAI says it does not train on business data from ChatGPT Enterprise by default, while a personal account may be used for training unless the user opts out. For Enterprise and Edu, workspace admins control how long data is kept, and deleted conversations are removed within 30 days unless OpenAI must keep them by law. A personal account has none of the company’s single sign-on, logging or retention controls.
Is Microsoft Copilot or Google Gemini safer than ChatGPT for company data?
No brand is safer by name, because the account type and its terms decide what happens to the data. Google’s own privacy hub says a work or school account may be subject to different data handling terms from a personal one, and the same split between consumer and business terms applies to OpenAI. Compare the business terms of each tool you consider, and approve the account type, not the brand.
Should a company ban ChatGPT and other public AI tools?
I would not. A ban leaves the demand in place and pushes use onto personal accounts the company cannot see or log, and Microsoft’s 2024 research found that 78% of AI users already bring their own tools to work. Samsung confirmed in May 2023 that it was temporarily restricting generative AI on company computers, after Bloomberg reported that staff had uploaded sensitive code to ChatGPT, and it said at the time that it was looking for ways to use generative AI safely.
What is shadow AI, and how common is it?
Shadow AI is the use of AI tools, AI features or personal AI accounts for work without the organization’s approval or visibility. MIT’s Project NANDA found in 2025 that workers at more than 90% of the companies it surveyed used personal AI tools for work, while only 40% of the companies had bought an official LLM subscription. IBM’s 2025 breach research found that 1 in 5 organizations reported a breach due to shadow AI.
What should an AI acceptable use policy include?
It should include data classes with a named list of restricted information, the approved tools and account types, human review of every output, logging of AI use, training for every employee, and an inventory of AI tools and features. It also needs a named executive owner and a date on which each provider’s terms were last read. Each of those parts maps to an outcome in the NIST AI RMF.
Does the EU AI Act require AI training for employees?
Article 4 of the EU AI Act has required providers and deployers of AI systems to take measures on the AI literacy of their staff since 2 February 2025. The European Commission says the Digital Omnibus on AI, in force since mid-July 2026, kept the obligation but removed the requirement for a specific “sufficient” level. The Commission’s guidance ties the right measures to each organization and its AI systems, and staff who operate high-risk AI systems still need training for human oversight.
About this article
This article is Day 13 of the DigitalXForce Cybersecurity Awareness Month 2026 series, written by Margareta Petrovic. Every figure in it was read at its source on 25 September 2026, and the provider terms are read again before each review of the approved tool list.
Sources
- OpenAI Help Center, “How your data is used to improve model performance”. https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance, read 25 September 2026, when the page showed it had been updated that day.
- OpenAI, “Enterprise privacy at OpenAI”, updated 8 January 2026. https://openai.com/enterprise-privacy/, read 25 September 2026.
- Google, Gemini Apps Privacy Hub. https://support.google.com/gemini/answer/13594961, read 25 September 2026.
- Microsoft and LinkedIn, 2024 Work Trend Index, “AI at Work Is Here. Now Comes the Hard Part”, published 8 May 2024, a survey of 31,000 knowledge workers in 31 markets. This is vendor research. https://www.microsoft.com/en-us/worklab/work-trend-index/ai-at-work-is-here-now-comes-the-hard-part, read 25 September 2026.
- Aditya Challapally, Chris Pease, Ramesh Raskar and Pradyumna Chari, MIT Project NANDA, “The GenAI Divide: State of AI in Business 2025”, July 2025, based on 52 organization interviews, 153 senior leader surveys and a review of more than 300 public AI initiatives. https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf, read 25 September 2026.
- ISACA, “AI Use Accelerates, While Governance and ROI Lag, Says New ISACA Research”, published 5 May 2026, on the 2026 AI Pulse Poll of more than 3,400 digital trust professionals. https://www.isaca.org/about-us/newsroom/press-releases/2026/ai-use-accelerates-while-governance-and-roi-lag-says-new-isaca-research, read 25 September 2026.
- Cyberhaven, “Sensitive Enterprise Data Is Flowing Into AI Tools at Scale”, published 11 February 2026, on its 2026 AI Adoption and Risk Report. This is vendor research. https://www.cyberhaven.com/blog/sensitive-data-flowing-into-ai-tools, read 25 September 2026.
- IBM, “IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls”, published 30 July 2025, on the 2025 Cost of a Data Breach Report. This is vendor research. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls, read 25 September 2026.
- ISC2, “ISC2 Research: Rethinking AI’s Impact on Cybersecurity Roles”, published 14 July 2026, survey of 856 cybersecurity professionals conducted in May 2026. https://www.isc2.org/insights/2026/07/rethinking-ai-impact-on-cybersecurity-roles, read 25 September 2026.
- University of Melbourne and KPMG, “Trust, attitudes and use of artificial intelligence: A global study 2025”, a survey of more than 48,000 people in 47 countries. https://kpmg.com/xx/en/our-insights/ai-and-technology/trust-attitudes-and-use-of-ai.html, read 25 September 2026.
- Stanford HAI, The 2026 AI Index Report, Responsible AI chapter. https://hai.stanford.edu/ai-index/2026-ai-index-report/responsible-ai, read 25 September 2026.
- FS-ISAC, “Framework of an Acceptable Use Policy for External Generative AI”, September 2023. https://www.fsisac.com/hubfs/Knowledge/FrameworkOfAnAcceptableUsePolicyForExternalGenerativeAI.pdf, read 25 September 2026.
- CNBC, “Samsung bans use of AI like ChatGPT for staff after misuse of chatbot”, published 2 May 2023. https://www.cnbc.com/2023/05/02/samsung-bans-use-of-ai-like-chatgpt-for-staff-after-misuse-of-chatbot.html, read 25 September 2026.
- Regulation (EU) 2024/1689, the AI Act, Article 4 and Article 113, EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689, read 25 September 2026.
- European Commission, “AI Literacy: Questions and Answers”. https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers, read 25 September 2026.
- Stanford HAI, The 2026 AI Index Report, Chapter 8: Policy and Governance, April 2026, which records the final labeling rules for AI-generated and synthetic media issued in 2025. https://hai.stanford.edu/assets/files/ai_index_report_2026_chapter_8_policy_and_governance.pdf, read 25 September 2026.
- NIST, AI Risk Management Framework, AI RMF 1.0 released 26 January 2023, and the Generative AI Profile, NIST AI 600-1, released 26 July 2024. https://www.nist.gov/itl/ai-risk-management-framework and https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf, read 25 September 2026.
- NIST Trustworthy and Responsible AI Resource Center, AI RMF Core, section 5: Govern 1.1, 1.6, 2.2, 2.3 and 6.1, Map 3.5, Measure 2.4, Manage 1.3 and 4.1. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/, read 25 September 2026.
- ISO, ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system. https://www.iso.org/standard/42001, read 24 September 2026.
Do this once instead of every audit.
Every step above can be done by hand, and training and output review should stay with people. DigitalXForce keeps the AI inventory and the control evidence up to date, maps the result to 50+ frameworks once, and holds it current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
