The agenda of a logistics company's management meeting has one line on it: ChatGPT, on or off. IT wants to block the domain after a customer list turned up in a prompt. HR says half the office already uses it for emails, quotes and translations, and that the work gets done noticeably faster. After half an hour the item is carried over to the next meeting.
It is carried over because both sides are right. ChatGPT helps with the work, and a customer list in a free account is a real problem. "On or off" leaves no room for both. "Which account, under what condition" does.
Why is "on or off" the wrong question for ChatGPT?
Because ChatGPT is not one thing. On screen it all looks the same, but underneath, three kinds of account run side by side: a free account, a Plus subscription people pay for themselves and a business licence through the organisation. On a free or personal account, input can be used to improve the model by default unless the user switches that off; on the business tiers that is excluded by default, as OpenAI itself describes. What that difference means in practice is explained in free versus business AI accounts.
Allowing ChatGPT therefore means saying yes to three sets of terms at once. Banning it also removes the business account that could have solved the problem. What often happens next, with personal accounts and phones, is described in what happens when you block AI without a workable alternative. For one specific tool like ChatGPT, the more useful question is smaller: which account do we designate?
What are the four options for ChatGPT?
| Option | What happens in practice | What the organisation sees | What has to come with it |
|---|---|---|---|
| Ban | The work remains, and part of the use shifts to personal accounts, phones and other tools | Little; that use sits outside the network | A designated alternative; otherwise the work has nowhere to go |
| Allow without any rules | Free, personal and business accounts side by side, with sensitive data in all three | The use, but not the terms it runs under | Little, and that is the problem |
| Limited use with a condition | Use subject to a one-sentence condition: business account only, no personal data or internal work only | The use and the condition that goes with it | The condition, short enough to read when the tool opens |
| Business tier as the preferred option | The organisation sets up a business account and designates it; the free account is set to not allowed, with that account as its alternative | The share of use that runs through the preferred account | A licence, a data processing agreement and the rules on data |
The bottom two are not mutually exclusive, and for most organisations the combination is the answer. The business account is set to allowed, or to limited use with a condition. The free account is set to not allowed, with the business account as the alternative. What those statuses mean exactly is explained in four statuses for AI tools.
When does a ban on ChatGPT fit?
A ban on the free account is easy to defend when the business account or another approved tool is ready, and the decision names that alternative. Then it is not a ban on AI but a choice about which tool to use.
Sometimes an organisation has already chosen another tool, such as Microsoft Copilot, and does not want a second business chatbot. Then ChatGPT as a whole can be set to not allowed, with Copilot as the alternative. How to weigh that up is covered in our article on whether to ban ChatGPT once Copilot is allowed.
Work that does not belong in any public chatbot, such as client files, medical data or performance reviews, is a different matter. That is not a decision about the tool but about the data, and it belongs in the policy on what may go into a prompt. Otherwise the data simply travels to the next tool. Which data employees most often paste into ChatGPT, and which rules to set for it, is covered in our article on whether ChatGPT is safe to use at work.
What does that decision look like in practice?
An accounting firm blocks ChatGPT on its network after an incident with a customer list. Three months later the office manager notices junior staff using it on their phones, and finds that two of them have moved to another chatbot nobody has heard of. The firm takes out a business subscription, sets that account to limited use with the condition "no client data" and sets the free account to not allowed, with the business account as the alternative. The use moves back to laptops, where it is visible, and the unknown chatbot is assessed.
That is not a success story; it is an ordinary correction. It cost a licence and two sentences of policy, and it delivered something a ban could not: a view of whether the decision is being followed.
BeeSensible records the organisation's decision per tool and per variant, with the condition or the alternative attached. Open the business account in the browser and you see the condition. Open a variant that is not allowed and a notice appears that offers the business account as the first option. Whether someone can still continue after that is the organisation's choice. What happens after a notice is counted without a user ID. This is what the overview looks like, with decisions alongside observed use:
