If you have just discovered that half the office uses ChatGPT on personal accounts, two things are true. There is a real privacy problem to fix. And your team has shown you, at their own expense, that the tool is useful.
Why a ban does not work
People who have found something that saves them an hour a day do not stop because of a memo. They stop telling you. The use moves to phones and home laptops, and you lose the one thing you had, which was knowing about it.
What the real problem is
Personal accounts sit outside the business. You cannot see what went in. On free and personal plans, conversations may be used to train the provider’s models unless the person has switched that off. And when someone leaves, their account, with everything in it, leaves with them.
Australia’s privacy regulator recommends that organisations do not put personal information, and particularly sensitive information, into publicly available AI tools. Staff on personal accounts are doing exactly that, with good intentions.
What to do instead
- Find out what is happening. Ask people, and make it safe to answer.
- Choose one approved tool on a business plan, with company logins.
- Write two pages. Which account to use, what may go in, what never does, who checks before something goes out.
- Help people move. Half an hour each to bring across what they had built is time well spent.
- Say thank you. The people who went first are the ones who will teach the others.
The one hard rule
Most of this is encouragement. One part is not negotiable: company logins and client information do not go into tools the business has not approved. That includes the newer agent tools that ask to sign in to your systems as you.
What you get for it
A team using AI in the open, on accounts you control, with a rule everyone has read. That is safer than a ban, and it is also where the useful work starts, because good ideas can now be shared instead of hidden.