How IT Teams Can Respond to Personal ChatGPT Use at Work

Employees may use personal ChatGPT accounts at work even when their organization provides an approved Enterprise workspace. That can expose company data, but a personal account alone does not show that a prompt was used to train a model, became public, or reached another user.

In an article for BleepingComputer, Vakaris Noreika, NordLayer’s VP of Product Research and Development, describes two hypothetical scenarios for IT teams investigating such use. Without prompt-level controls, an event may show that someone used a personal account but retain no prompt text or sensitive-data findings. An investigation may then depend on reviewing the relevant conversation with the employee.

The second scenario uses NordLayer AI Scout on a managed browser. A configured detector checks prompts on the device and can block a submission that matches a rule, such as a customer account number format. The tool can classify ChatGPT conversations as Personal or Corporate and associate activity with a person through work email; directory sync with Entra ID, Okta, or HiBob can add department, team, and role information.

Noreika says teams should establish what data was shared, preserve relevant evidence, and involve the appropriate incident, privacy, or data owner. The response depends on the information involved. The article also stresses that an Enterprise subscription does not make every task or type of data permissible.