ChatGPT at Work: The Rules to Set and the Risks to Avoid
Key takeaway
ChatGPT can save companies a lot of time, provided clear rules are in place. The main risks are leaking confidential data, breaching GDPR, reusing made-up answers without checking, and staff using unapproved tools. A business plan, a short usage policy and team training cover the essentials.
Key points
- Banning ChatGPT does not work: teams then use it in secret.
- Business plans do not use your data for training by default, according to OpenAI.
- Never enter sensitive personal data or trade secrets into a consumer tool.
- Any answer meant for a client or a decision must be checked by a human.
- A one-page policy and hands-on training are enough to get started.
ChatGPT at work: the short answer
ChatGPT is an excellent work tool, provided you settle three things: which plan to use, which data never goes in, and who checks the answers. Without these rules, every employee improvises, and the company carries the risks without knowing it.
The right approach is neither a ban nor a free-for-all. It is a simple framework, a business plan and hands-on training. This article details the real risks and offers a policy ready to adapt.
The 6 real risks of ChatGPT at work
The risks do not come from the tool itself, but from how it is used. Here are the six that come up most often.
1. Leaking confidential information
Pasting a contract, a customer file or source code into a consumer tool means handing it to a third party. In 2023, several outlets including Bloomberg reported that Samsung restricted generative AI tools after employees pasted internal code into them. The risk is the same in a small business: a proposal, a price list or a sales strategy.
2. Breaching GDPR
Entering personal data into ChatGPT is data processing, subject to GDPR. You need a legal basis, must inform the people concerned, limit data to what is strictly necessary and have a contract with the provider. Sensitive data, such as health information, calls for even greater caution.
3. Made-up answers
ChatGPT can produce false information with great confidence. In 2023, a federal court in New York sanctioned lawyers who filed a brief citing court decisions invented by ChatGPT (Mata v. Avianca). Any answer meant for a client, an official document or a decision must be checked.
4. Shadow AI
When the company provides no tool, teams use their personal accounts. That use escapes all oversight: no privacy settings, no shared history, nothing deleted when the person leaves.
5. Copyright and ownership
A generated text or image may resemble protected content, and the protection of generated content remains uncertain. For content published under your brand, keep meaningful human input and check that nothing copies existing material.
6. Dependence and skill loss
Delegating without understanding weakens the team. An employee who can no longer judge the quality of an answer can no longer spot errors. Training also keeps that critical eye sharp.
Consumer or business plan?
For company use, choose a business plan: it is the simplest protective measure. The main differences:
| Criterion | Personal account (free or Plus) | ChatGPT Business / Enterprise |
|---|---|---|
| Training on your data | Possible unless the user opts out | Not by default, according to OpenAI |
| Access management | Individual | Centralized, with company sign-in depending on the plan |
| When an employee leaves | Conversations stay on their account | The admin removes access |
| Data processing agreement | Not designed for companies | Provided for businesses |
OpenAI states on its Enterprise privacy page that it does not train its models on data from Business, Enterprise and API offerings by default. The same questions apply to Microsoft Copilot, Google Gemini or Claude: check the terms of the plan you choose.
What European law says
Two texts govern ChatGPT use at work: GDPR for personal data and the AI Act for AI itself.
- GDPR: applies as soon as personal data is entered. In Belgium, the competent authority is the Data Protection Authority.
- AI Act, Article 4: since February 2, 2025, every company using an AI system must take measures to support its staff's AI literacy. The European Commission cites exactly the case of employees using ChatGPT to write or translate. We explain this obligation in AI Act Article 4: AI literacy.
- AI Act, Article 50: since August 2, 2026, certain AI-generated texts published to inform the public must be disclosed, unless they underwent human review and someone holds editorial responsibility.
A 10-rule ChatGPT policy
An effective policy fits on one page and can be understood in two minutes. Here is a starting point to adapt to your company:
- Approved tools: only the listed tools, on business plans, are used for work.
- Prohibited data: never sensitive personal data, HR files, passwords or trade secrets.
- Client data: anonymize anything about a client before entering it.
- Checking: any answer used in an external document is reviewed and verified by its author.
- Accountability: whoever publishes or sends remains responsible for the content, not the tool.
- Transparency: disclose AI use when the recipient could reasonably expect to know.
- Prohibited uses: no decision about a person (hiring, discipline, credit) based on AI alone.
- Rights: no copying of protected content; content published under the brand is reworked.
- Point of contact: one person answers questions and keeps the approved tools list up to date.
- Incidents: any data entered by mistake is reported to the point of contact immediately.
How to roll out ChatGPT in your team
A successful rollout follows three steps: choose the tool, train on real cases, measure. Start with a pilot group, identify two or three tasks that save time, then expand.
To go further, our guide AI training for business: where to start covers training formats. And when a task keeps coming back, it can become a dedicated AI agent, safer and more reliable than an improvised conversation.
Our approach at Ozapp
Ozapp is an AI-first agency based in Belgium. Our AI consulting & training service helps companies choose their tools, write their policy and train their teams on their own cases, in French, Dutch or English. For a free first assessment, try our AI maturity diagnostic.
This article is for information only and does not constitute legal advice.
- Explore our service: AI consulting & training
- Get a free quote: Contact
FAQ — ChatGPT at work
Is it legal to use ChatGPT at work?
Yes, as long as you respect GDPR, client confidentiality and the AI Act. In practice, that means choosing a suitable plan, not entering personal data without a legal basis and informing the people concerned, and training your teams. Article 4 of the AI Act requires companies using AI to support their staff's AI literacy.
Does OpenAI use our data to train its models?
For ChatGPT Business, ChatGPT Enterprise and the API, OpenAI says it does not use business data to train its models by default. For personal accounts, conversations may be used to improve models unless the user turns this option off in settings. Check the terms of the plan your teams actually use.
Should you ban ChatGPT at work?
A total ban rarely works: employees switch to personal accounts with no oversight at all. It is better to provide an approved tool, set simple rules on data and fact-checking, and train teams. A ban can make sense for specific uses, such as health data or HR files.
What should an AI usage policy include?
An effective AI policy fits on one page: approved tools, prohibited data, the duty to check answers, prohibited uses, transparency toward clients, an internal point of contact and an incident procedure. Pair it with hands-on training, or it stays a dead letter.
ChatGPT, Copilot or Claude: which should a company choose?
The best choice is often the tool that fits your environment: Microsoft Copilot if you work in Microsoft 365, Gemini with Google Workspace, otherwise ChatGPT or Claude on a business plan. Compare confidentiality, data hosting, access management and cost per user rather than raw performance.
