By Antonio Giarrusso, founder of Userbot and Head of AI at the smeup group · November 2026
ChatGPT can be used at work, as long as it’s done with a tool and rules decided by the company: access with company credentials, clear rules on which data is allowed, traceability. The real risk is use with personal accounts and no control: the company doesn’t know what is being shared and has no record of anything.
The four real risks.
- Personal accountsIf everyone uses their own account, the company doesn’t know what’s being shared, can’t revoke access when someone leaves and has no record of anything.
- Data leaving the perimeterContracts, customer data, code: depending on the plan and settings, conversations may be kept by the vendor or used to improve its models.
- No company sourcesA generic chat answers with what it knows about the world, not with your company’s procedures and documents. And sometimes it’s confidently wrong.
- Costs out of controlSubscriptions scattered across personal cards and expense claims: impossible to know how much is being spent, and on what.
According to UpGuard’s “State of Shadow AI” report (November 2025), more than 80% of workers use unapproved AI tools. Banning them doesn’t work: people switch to their phones. I cover this in the guide on Shadow AI.
The minimum rules.
- One official tool, accessed with company credentials.
- Clear rules on which data can and can’t be used, enforced by the tool.
- Several models available, chosen by task and cost, with no dependence on a single vendor.
- Answers grounded in company documents, not just in what the model knows about the world.
- A log of every step and spending caps, to measure and correct.
That’s what Userbot does, the Italian platform for governed AI adoption: chat, multiple models, company knowledge and agents in a single perimeter. The full method is in the guide AI adoption in companies; the legal obligations are in the one on the EU AI Act.
Outline of an internal AI policy.
One page, not a manual. Six items are enough to get started:
- Approved tools
- Which AI tools can be used for work, and with which account. Anything else is off-limits for company data.
- Data
- What never goes into an AI tool (personal data of customers and employees, trade secrets, credentials) and what can.
- Responsibility
- Whoever uses AI remains responsible for the result: checking content, citing sources, no automated decisions about people.
- Transparency
- When to tell customers and colleagues that content or an answer was generated with AI.
- Training
- Who needs which training, in line with the AI literacy obligation set out in the AI Act.
- Reporting
- Who to contact to propose a new tool or report a problem, without fear of sanctions.
Then the part that really matters: having the tool enforce these rules, not just the PDF.
Frequently asked questions.
Can ChatGPT be used at work?
Yes, as long as it’s done with a tool and rules decided by the company: company logins, clear rules on allowed data, traceability. The real risk is use with personal accounts, with no control.
Is a single vendor’s enterprise version better, or a platform?
It depends on how tied to that vendor you want to be. A model-agnostic platform lets you use several models in the same environment and switch between them without rebuilding processes and integrations.
Is an internal policy enough?
You need one, but it’s not enough. A rule the tool doesn’t enforce stays a suggestion: permissions, approved models and logs need to live in the tool.