At the management meeting of an engineering firm, a short list is on the table. Microsoft 365 Copilot has been set up and allowed since spring, and yet ChatGPT turns out to be open on dozens of desks almost every day, mostly on free accounts. The IT manager asks the question everyone had already been thinking: so do we ban ChatGPT now?
No, not necessarily. Allowing Copilot was a decision about Copilot. Nothing has been decided about ChatGPT yet, and a ban is only one of the outcomes on offer. The other three keep the use visible, and you need that visibility to adjust the decision later.
Why is ChatGPT open when Copilot is already there?
Because people are trying to get something done for which Copilot is not the obvious route at that moment. Copilot is strong at work that lives in Microsoft 365: summarising an email thread, rewriting a document, turning a Teams meeting into action points. A long text in a particular tone, a piece of code, or simply the tool someone has been using for a year, on a free account that existed before Copilot was bought: that use carries on.
Why employees use other tools next to Copilot is therefore not a matter of defiance. It is information about what Copilot apparently does not offer for that task, and that information disappears the moment you ban.
What does a ban do to your visibility?
A technical ban, a domain blocked on the network, stops the visible use and not the use itself. The tab moves to the personal phone, the free account was already there, and the customer details someone wanted summarised now travel along a route with no data processing agreement underneath and nobody watching. KPMG and the University of Melbourne asked 48,000 workers in 47 countries in 2025: 57 percent hide their AI use from their employer. A ban does not make that number smaller.
What you lose is exactly the figure you needed: how often ChatGPT is still opened, and whether that drops once you have named Copilot as the route. Blocking AI makes the risk invisible, and invisible is not the same as gone.
Which outcomes are there?
The decision about ChatGPT has the same four possible outcomes as the decision about any other AI tool: allowed, limited use, not allowed, or no decision yet. A ban is a fifth thing, not a status but a technical measure, and it is worth putting the five side by side.
| Outcome | What it does in practice | What you still see afterwards |
|---|---|---|
| Technical ban | Domain blocked; the use moves to phones and personal accounts | Nothing |
| Not allowed, with Copilot as the alternative | Whoever opens ChatGPT sees the decision in the browser with Copilot as the first button; continuing is possible | How often it is opened, how often the alternative is chosen |
| Limited use, with a condition | Public information only, or the business account only; the condition appears on opening | Whether the condition lands, in counts |
| Allowed as a business variant | ChatGPT Business or Enterprise next to Copilot, for work outside Microsoft 365 | The share of use that runs through allowed tools |
| No decision yet | The honest interim state, with the request to use public information only | That there is use you still have to decide on |
The difference between the first two rows is the whole point. Not allowed with an alternative is a decision that becomes visible at the moment of work: someone opens ChatGPT, sees that the organisation would rather they used Copilot, and can get there in one click. Whoever continues anyway does so deliberately, and that is counted without a name attached. A ban offers no such choice and counts nothing. How the four statuses relate is set out in four statuses for AI tools; the wider question, apart from Copilot, in allow or ban ChatGPT at work.
Which ChatGPT do you mean?
ChatGPT, like Copilot, is not one thing. A personal Free, Plus or Pro account runs under consumer terms: chats can be used to improve the model unless the user switches that off, and the organisation has no data processing agreement and no admin control. ChatGPT Business, Enterprise and Edu exclude workspace data from training by default and give administrators control over members and settings. What that means per environment is in the privacy risks of ChatGPT.
That is the same split as with Copilot, where the consumer version on copilot.microsoft.com has no enterprise data protection and the signed-in variants do. The account type matters more than the tool. In a register, free and business ChatGPT are therefore two rows, each with its own status. The decision "ban ChatGPT" is usually about the first row, while the answer sits in the second.
What does that look like at the engineering firm?
The firm takes three decisions instead of one ban. The free ChatGPT account goes to not allowed, with Copilot as the named alternative. For the team that writes tender documents, and says it gets better results there than in Word, a ChatGPT Business workspace is set up, at limited use with the condition: business account only. Claude, which shows up on a handful of desks, stays at no decision yet until someone has assessed it.
A quarter later the share of AI use through allowed tools has risen, and free ChatGPT is only opened occasionally. Where it still is, it almost always turns out to be for code. That is not a discipline problem, it is the next decision: which route does the firm name for code?
This is what such a register looks like, with the decision the organisation itself has set per tool:
