The agenda of a logistics company's management meeting has one line on it: ChatGPT, on or off. IT wants to close the domain after a report of a customer list in a prompt. HR says half the office already uses it and a ban will not change that. After half an hour the item moves to the next meeting.
It moves because the question is put wrong. Allow or ban are two of four options, and the two that work least well. The third is limited use with a condition, the fourth is naming the business tier as the preferred route. For most organisations the answer is a combination of those two: not the free account, yes the business account, with a few agreements about what goes in.
What does a ban get you?
Not an organisation without ChatGPT. The colleague with a deadline picks up her phone and opens it on a personal account, with the same customer list. The use does not disappear, only the view of it, and with the view goes the ability to have any say. Why blocking makes the risk invisible is explained separately; the core is enough here: a ban moves the work to accounts without a data processing agreement and devices without management.
There is a second effect. Banning ChatGPT and naming nothing in its place amounts to saying: sort it out yourself. People do, with Perplexity, with a free translation tool, with the AI feature that happened to be in their software already. The ban covered one name and the use has ten.
What does allowing it without agreements get you?
The mirror image. The use is visible, but it is mixed: a free account here, a self-paid Plus subscription there, occasionally a licence bought through a department. On screen it all looks the same. Underneath, three sets of terms apply. On a free or personal account, input can be used to improve the model by default unless the user switches that off; on the business tiers that is excluded by default, as OpenAI itself describes. What that difference means in practice is in free versus business AI accounts.
Allowing without agreements therefore means the organisation says yes to something without knowing which version it is. That is not a decision, it is tolerance with a good name.
What are the four options, and what follows from each?
| Option | What happens in practice | What the organisation sees | What has to come with it |
|---|---|---|---|
| Ban | Use continues on personal accounts and private phones, and shifts to other tools | Little; the use sits outside the network | An alternative by name, otherwise it is a ban on work |
| Allow without agreements | Free, personal and business accounts side by side, with sensitive data in all three | The use, but not under which terms | Nothing, and that is the problem |
| Limited use with a condition | Use within one sentence: business account only, no personal data, internal work only | The use and the condition that goes with it | The condition, short enough to read at the moment of work |
| Business tier as preferred route | The organisation sets up a business account and names it; the free account becomes not allowed with that account as its alternative | The share of use that runs through the preferred route | A licence, a data processing agreement and the agreements on data |
The bottom two do not exclude each other. An organisation that sets up a business account puts it on allowed, or on limited use with a condition, and puts the free account on not allowed with the business account as the first button. What those statuses mean exactly is in four statuses for AI tools.
When is a ban the right decision after all?
When an alternative that does the same work sits next to it. A ban on the free ChatGPT account is defensible when the business account or another approved tool is ready, and the ban names that alternative. Then it is not a ban on AI but a choice of route.
A ban is also in order for work that belongs in no public chatbot at all, whatever the account: client files, medical data, performance reviews. Only that is not a ban on the tool but on the data, and it belongs in the policy on what may go into a prompt. Banning a tool to solve a data problem does not work, because the data travels to the next tool.
What does the third option look like in practice?
An accounting firm closes ChatGPT on the network after an incident with a customer list. Three months later the office manager notices the junior staff use it on their phones, and that two of them have meanwhile moved to another chatbot nobody has heard of. The firm takes out a business subscription, puts that account on limited use with the condition "no client data", and puts the free account on not allowed with the business account as the alternative. The use comes back to the laptop, where it is visible, and the unknown chatbot gets an assessment.
That is not a success story, it is an ordinary correction. What it shows: the third and fourth option cost a licence and two sentences of policy, and they deliver something a ban cannot, which is a view of whether the decision is followed.
BeeSensible records the organisation's decision per tool, with the condition or the alternative attached. Open the free account and the business account appears as the first button; open the business account and the condition appears. Continuing is always possible, and what happens next is counted without a user id. This is what the overview looks like, decisions next to observed use:
