AI & Automation
Is It Safe for Staff to Use Free ChatGPT at Work?
Oliver Mogg9 min read
Short answer: staff should not use consumer AI tools with sensitive company or client data. Consumer AI tools are built for individual use and may not provide the same privacy, governance and administrative controls as business or enterprise AI platforms.
In this post, I'll explain why the risk matters, why banning AI outright usually backfires, and how businesses can let staff benefit from AI without creating unnecessary data protection problems.
This is a common question because AI is genuinely useful, but it also creates a very real governance issue if staff are using it without approval or guidance. Following the “They Ask, You Answer” approach, I'm going to answer the question directly, show both sides of the argument, and then give a practical view on what a sensible AI policy should look like.
The concern is not hypothetical. A Cybernews survey found that 59% of employees admitted to using AI tools their employer had not approved, and 75% of those users had shared potentially sensitive information with them (source). The biggest point to make here is this: if you don't have an AI policy in place, and it isn't actively managed, there could be GDPR breaches and data breaches happening in your business that you're simply not aware of.
Quick definition before we go further: when I say “Shadow AI,” I mean staff using AI tools with no approval, oversight or visibility from the business. It's the stuff happening quietly in the background that you can't see, and it's more common than most owners think.
The case for banning ChatGPT
Let's start with one side of the argument: ChatGPT should be banned.
The first issue is that it's a confidential data risk. Staff can paste in customer databases, contracts or financials, and consumer AI tools may use personal account content to improve their models unless the user has changed the relevant privacy settings. This is not just a “free tool” issue. Paid personal versions of ChatGPT, Claude and Gemini can still sit outside business governance, and their data handling is different from business or enterprise plans.
- OpenAI states that personal ChatGPT Free, Plus and Pro workspaces have data sharing enabled by default, while business products are not used for training by default.
- Anthropic gives consumer Claude Free, Pro and Max users a model improvement choice, while its commercial products are not trained on by default.
- Google's Gemini privacy guidance makes clear that users can control whether Gemini Apps activity is used to improve Google AI, and that selected activity may be reviewed to improve the service.
This is something most people simply aren't aware of. AI is such a new and shiny tool that everyone wants to bring it into their work, but very few staff are doing the research in the background to understand the security side of it. And it's worth knowing that opt-outs typically only affect future conversations. They don't retrieve anything you've already submitted.
The second issue is that Shadow AI is real. Even when a tool is officially banned, UpGuard's research found that 45% of workers find a workaround to keep accessing blocked applications (source).
Then there's compliance and GDPR. As the business, you're still responsible for the data. Yes, you could let an employee go for causing a breach, but that doesn't undo the damage. Under UK GDPR, remember that your business is the data controller, so the liability sits with you, not the employee who made the mistake.
Picture this scenario. You've got a new, young employee. They're efficient, they're effective, they know more about AI than you do, and they've been using AI tools within the business. It only takes one small mistake, one upload of sensitive information, for this to become a genuine GDPR breach.
One mistake becomes an incident. Look at Samsung in 2023. Engineers pasted source code into ChatGPT to debug it, couldn't retrieve it once it was in, and it triggered a company-wide ban on consumer AI tools. So the argument goes: staff can't be trusted with it, block it entirely. It sounds like an over-the-top response, but unless you have an AI policy in place, you genuinely can't be certain AI isn't being misused in your business.
The case against banning it
Now I want to talk about the other side, which is that banning is the wrong move. And full transparency, this is the side I'm on. I personally believe AI is a tool that can massively help businesses, when used correctly.
The productivity gains are real. We don't ban calculators or Excel for the odd mistake. AI is just another tool, it's simply far more complex, and that means more thought-through policies need to be in place to keep it secure.
Banning also tends to backfire. If staff find AI useful, some will look for other ways to access it, especially if the business has not provided a safe approved alternative. That means you do not really remove the risk, you just lose visibility of how AI is being used.
There's a competitive risk too. Businesses implementing AI in the right ways are excelling in their field. So the question I'd ask is this: do you want to get left behind by banning AI as a quick, blanket response to your fears about it?
AI literacy is becoming a core skill. It's the same story as the internet, social media and the cloud, once feared, now completely normal and integrated into how we work. If you don't start to implement it, you'll be left behind.
The real problem isn't ChatGPT. It's the missing policy, guidance and training. If people are not told which tools are approved, what data must never be entered, and why consumer AI accounts are different from business AI platforms, they will make their own judgement calls. That is a governance gap, not a technology problem.
The honest reality check
Most owners worry about ChatGPT because they picture staff putting sensitive information into it. And they're right to worry. But be honest, staff have taken data risks for years through personal email, WhatsApp, USB sticks and consumer cloud storage.
AI didn't create the governance problem. It just exposed one that was already there.
And it does matter. IBM's Cost of a Data Breach reporting has found that shadow AI can add around $670,000 to the average cost of a breach (source). So this is worth taking seriously, but seriously doesn't have to mean banning.
So what should you actually do?
Stop asking “Should staff use ChatGPT?” and start asking “How can staff use AI safely?” In practice, it comes down to three honest questions. Work through them in order and you'll land on the right approach for your business.
Do you need to use AI at all?
Be honest with yourself first. If AI genuinely doesn't add anything to how your business operates, the cleanest answer is to ban it outright, and to put that in a written policy so there's no ambiguity. But a policy on paper isn't enough on its own. As we've seen, plenty of staff will find a workaround if it's only a line in a handbook.
If you're going to ban it, you have to enforce it properly, and that means using IT controls to block access to the AI sites and apps at the network level, so the tools simply aren't reachable from company devices. A ban you can't enforce isn't really a ban, it just moves the risk somewhere you can't see it.
Can staff use consumer AI tools without entering sensitive data?
If you're happy for people to use AI but you don't want sensitive data going into it, the distinction should not be “free versus paid.” It should be “consumer versus business.” Consumer AI tools are designed for individual use, whereas business and enterprise AI platforms are designed for organisational use, with stronger privacy, governance and administrative controls. The exact terms of each platform can change over time, so the safest approach is to treat consumer AI tools as unsuitable for client data, contracts, financials, personal data or anything confidential unless your business has reviewed and approved them.
If staff are going to use consumer AI tools at work, the policy needs to be very simple: do not enter anything sensitive. No client data, no contracts, no financials, no personal or payment details, and nothing you wouldn't be comfortable making public.
But here's the catch, and it's a big one: stopping people entering sensitive data is far harder than it sounds. The whole appeal of these tools is that you paste something in and it does the work for you, so the natural instinct is to give it the real document, the real email or the real spreadsheet. One rushed copy-and-paste and the damage is done.
Want to use AI properly? Look at a business AI product.
If you want AI to become a normal part of how your team works, and you're realistic that you can't guarantee sensitive information will never be entered, then the sensible answer is a business or enterprise-grade AI product. These platforms are built for organisational use, with stronger privacy commitments, admin controls, governance options and clearer boundaries around how business data is handled. The important point is that you are choosing a tool built for business data, rather than relying on staff to police themselves inside a consumer app.
We'll do a separate post on which models are best and why, because that's a topic in its own right. But for the question in the title, that's really the answer.
To wrap up
Consumer AI tools are not automatically dangerous, but they should not be treated as safe places for sensitive business data. The risk is specifically about putting company or client data into tools that have not been approved, governed or configured for business use.
Decide whether you need AI, decide whether you can trust the process to keep data out of consumer tools, and if you can't, invest in a business or enterprise platform that handles that risk properly. The businesses that thrive won't be the ones that panic and ban AI. They'll be the ones that make a clear, deliberate choice and teach their people to use it responsibly.