Security & Governance

The Risk That Scales With Adoption

🔄 In the previous lesson, you built department-specific ChatGPT workflows. Every one of those workflows involves data — customer information, financial figures, employee records, strategic plans. The more value you get from ChatGPT, the more data flows through it.

That creates risk. And the risk is growing: 34.8% of employee ChatGPT inputs now contain sensitive data, up from 11% in 2023. 225,000 stolen OpenAI credentials were found on dark web markets. And shadow AI — employees using unauthorized AI tools — affects millions of professionals.

This lesson teaches you to manage that risk without killing productivity.

Data Classification: What Goes In, What Doesn’t

Create a simple three-tier system your team can follow:

The red line is firm. Even on Enterprise with SOC 2 compliance, some data shouldn’t flow through external AI systems. Customer Social Security numbers, medical records, and authentication credentials belong in your own systems, not in ChatGPT conversations.

The yellow zone is where plans matter. Internal data that isn’t regulated or personally identifiable can go through Team/Enterprise because those plans contractually guarantee data isn’t used for training. On Free or Plus, that same data has weaker protections.

✅ Quick Check: A sales rep wants to upload a prospect list with company names, contact names, email addresses, and deal values to ChatGPT for analysis. What tier is this? Yellow — it contains business contact information (not highly sensitive PII, but internal and non-public). Acceptable on Team/Enterprise. Not recommended on Free/Plus. If the list included personal phone numbers or financial details, it moves to Red.

Shadow AI: The Hidden Risk

Banning ChatGPT doesn’t work. If your company blocks ChatGPT, employees find workarounds — personal accounts, third-party tools, browser extensions. This is shadow AI, and it’s worse than sanctioned use because:

• IT has no visibility into what data is being shared
• No admin controls or audit trail exists
• Browser extensions can silently scrape data from both ChatGPT and internal tools

In February 2025, researchers discovered 40+ compromised browser extensions used by 3.7 million professionals. These extensions scraped data from active browser tabs — including ChatGPT sessions and internal SaaS portals — bypassing traditional DLP filters.

The fix: Provide a better sanctioned alternative. Roll out Team or Enterprise, train people on it, and make it easy to use. Employees use shadow AI because the official option is missing or too restrictive, not because they want to cause problems.

Your ChatGPT Usage Policy

Every organization using ChatGPT should have a written policy. Here’s a framework:

1. Approved plans and access

• Which ChatGPT plan is authorized (Team/Enterprise)
• Who has access and how to request it
• Personal account use policy (typically: allowed for personal tasks, never for company data)

2. Data handling rules

• Green/Yellow/Red classification with examples specific to your industry
• What to do if you accidentally input sensitive data (delete the conversation, report to IT)
• File upload guidelines (what types of files are OK)

3. Output verification requirements

• All ChatGPT outputs used in client communications must be reviewed by a human
• Factual claims must be verified before publishing
• Legal and financial content requires department review

4. Transparency expectations

• When to disclose AI assistance to clients/stakeholders
• How to label AI-generated content internally
• Industry-specific disclosure requirements

5. Incident reporting

• How to report suspected data exposure
• Who to contact for security concerns
• Process for reviewing and improving the policy

✅ Quick Check: You discover that 15 employees are using free ChatGPT accounts for work because they “didn’t know the company had a Team plan.” What’s the governance failure? Communication and onboarding. The policy exists but employees don’t know about it. Fix: (1) Announce the approved tool in all-hands, (2) add it to new employee onboarding, (3) make the Team plan as easy to access as email — it should be a default tool, not something people have to find and request.

Enterprise Security Features

For organizations with compliance requirements:

These features matter most in regulated industries — healthcare (HIPAA), finance (SOX), and government. If your compliance team asks “is ChatGPT secure?” — point them to these certifications and the Enterprise security documentation.

Regulatory Landscape

EU AI Act (August 2025): General Purpose AI rules require transparency documentation and EU copyright compliance. If you operate in the EU, understand how your AI usage intersects with these obligations.

GDPR: Any personal data processed through ChatGPT must comply with GDPR requirements. Enterprise’s data processing agreements (DPAs) help, but your organization remains responsible for data controller obligations.

US state laws: Data privacy laws vary by state (CCPA in California, etc.). Your usage policy should account for the strictest applicable regulation.

Industry-specific: HIPAA (healthcare), SOX (finance), FERPA (education) may impose additional restrictions on what data can be processed by external AI systems.

Key Takeaways

• 34.8% of employee ChatGPT inputs contain sensitive data — data classification (Green/Yellow/Red) is essential
• Shadow AI is worse than sanctioned use — provide approved tools instead of banning ChatGPT
• Every organization needs a written ChatGPT usage policy covering data handling, output verification, transparency, and incident reporting
• Enterprise adds SOC 2, SAML SSO, encryption, and admin controls for regulated industries
• EU AI Act, GDPR, and industry regulations apply to ChatGPT use — compliance is your organization’s responsibility even when using Enterprise
• The goal isn’t restricting AI — it’s enabling AI use with appropriate guardrails

Up Next

You’ve covered everything: plans, prompting, data analysis, Custom GPTs, department playbooks, and security. In Lesson 8, you’ll bring it all together by building a complete ChatGPT workflow for your specific role and department.