At the management meeting of an engineering firm, a short list is on the table. Microsoft 365 Copilot has been set up and allowed since the spring, and yet ChatGPT turns out to be open on dozens of desks almost every day, mostly on free accounts. The IT manager asks the question everyone has been thinking: so do we ban ChatGPT now?
No, not necessarily. Allowing Copilot was a decision about Copilot. Nothing has been decided about ChatGPT yet, and a ban is only one of the outcomes on offer. The other three keep the use visible, and you need that visibility to adjust the decision later.
Why is ChatGPT still open when Copilot is already there?
Because people are trying to get something done for which Copilot is not the obvious choice. Copilot is strong at work that lives in Microsoft 365: summarising an email thread, rewriting a document, turning a Teams meeting into action points. A long text in a particular tone, a piece of code or simply the tool someone has been using for a year, on a free account that predates the Copilot purchase: that use carries on.
So employees who use other tools alongside Copilot are not being defiant. Their choice tells you what Copilot apparently does not offer for that task, and that information disappears as soon as you ban the tool.
What does a ban do to your visibility?
A technical ban, blocking a domain on the network, stops the visible use, not the use itself. The tab moves to a personal phone, the free account was already there, and the customer details someone wanted summarised now go through a channel with no data processing agreement and no oversight. KPMG and the University of Melbourne surveyed 48,000 workers in 47 countries in 2025: 57 per cent hide their AI use from their employer. A ban will not bring that number down.
What you lose is exactly the figure you needed: how often ChatGPT is still opened, and whether that drops once you have named Copilot as the alternative. Blocking AI makes the risk invisible, and invisible is not the same as gone.
What are the possible outcomes?
The decision about ChatGPT has the same four possible outcomes as the decision about any other AI tool: allowed, limited use, not allowed or no decision yet. A ban is something else again: not a status but a technical measure. It is worth putting all five side by side.
| Outcome | What it does in practice | What you still see afterwards |
|---|---|---|
| Technical ban | Domain blocked; the use moves to phones and personal accounts | Nothing |
| Not allowed, with Copilot as the alternative | Anyone who opens ChatGPT sees the decision in the browser, with Copilot as the first button; they can continue if the organisation allows it | How often it is opened, how often the alternative is chosen |
| Limited use, with a condition | Public information only, or the business account only; the condition appears when the tool is opened | Whether the condition works, in counts |
| Allowed as a business variant | ChatGPT Business or Enterprise alongside Copilot, for work outside Microsoft 365 | The share of use that runs through allowed tools |
| No decision yet | The honest interim state, with the request to use public information only | That there is use you still have to decide on |
The difference between the first two rows is the whole point. A "Not allowed" status with an alternative is a decision people see while they work: someone opens ChatGPT, sees that the organisation would rather they used Copilot and can get there in one click. Anyone who carries on anyway does so deliberately, and that is counted without a name attached. A ban offers no such choice and counts nothing. How the four statuses relate to each other is set out in our article on the four statuses for AI tools; the wider question, leaving Copilot aside, is covered in our article on whether to allow or ban ChatGPT at work.
Which ChatGPT do you mean?
ChatGPT, like Copilot, is not one thing. A personal Free, Plus or Pro account runs under consumer terms: chats can be used to improve the model unless the user switches that off, and the organisation has no data processing agreement and no admin control. ChatGPT Business, Enterprise and Edu exclude workspace data from training by default and give administrators control over members and settings. What that means for each environment is explained in the privacy risks of ChatGPT.
It is the same split as with Copilot, where the consumer version on copilot.microsoft.com has no enterprise data protection and the signed-in variants do. The account type matters more than the tool. So in a register, free and business ChatGPT are two rows, each with its own status. The decision to "ban ChatGPT" is usually about the first row, while the answer lies in the second.
What does that look like at the engineering firm?
The firm makes three decisions instead of one ban. The free ChatGPT account is set to "Not allowed", with Copilot as the named alternative. For the team that writes tender documents, and says ChatGPT gives it better results than Word, a ChatGPT Business workspace is set to limited use, with one condition: business account only. Claude, which turns up on a handful of desks, stays marked "No decision yet" until someone has assessed it.
A quarter later, the share of AI use through allowed tools has risen, and free ChatGPT is opened only occasionally. When it is, it almost always turns out to be for code. That is not a discipline problem but the next decision: which tool does the firm name for code?
This is what such a register looks like, with the decision the organisation itself has made for each tool:
