What Can Employees Enter into ChatGPT? A Business Guide to an AI Use Policy
Your team is most likely already using AI tools; the question is not whether they use them but how. We cover what data must never be entered, an approved tool list, data classification and a policy draft you can copy and adapt.
In brief: Employees are probably already using ChatGPT, Gemini, Claude and similar AI tools at work, with or without your approval. Banning them usually leads to “shadow AI” use; managing it is safer. A good AI use policy answers four questions: Which tools are approved? Which data may be entered and which may never be? How will outputs be verified? Whom do you report to when something goes wrong? The core rule: personal data, customer information, trade secrets, passwords and confidential source code are not entered into AI services other than approved, contract-protected tools; and output is not sent outside until a human has verified it. In this guide you will find data classification, example rules and a copyable policy draft. This content is general information and does not replace legal advice.
Last updated: October 2026
Why is a policy needed?
AI tools provide productivity: meeting summaries, email drafts, coding help, report editing, translation. But uncontrolled use creates these risks:
- Confidentiality and trade secrets: An employee can paste a customer quote, contract text or a financial statement into a chat tool. Where the data is stored and whether it is used to train models varies by tool and account type.
- Personal data (KVKK): When a customer's name, phone, health or identity information is entered into a tool, questions of personal data processing and transfer abroad can arise. On this topic, review the KVKK guide on generative AI (Turkey's personal data protection authority).
- Misinformation: Models can produce answers that look plausible but are wrong (“hallucinations”). Output used without verification leads to wrong quotes or wrong legal information.
- Copyright and licensing: The source and licence status of generated text, images or code may be unclear.
- Security: There are risks of prompt injection, malicious plugins and fake “AI” sites. The OWASP LLM Top 10 is a good reference for these topics.
A policy does not eliminate these risks, but it gives the team clear boundaries and makes responsibility explicit.
Manage instead of banning
A total ban often does not work: Employees keep using the same tools on personal phones and accounts and you cannot see it. A healthier approach:
- Provide approved tools. Identify tools with corporate accounts, admin controls and contractual data protection guarantees.
- Write clear rules. Explain with examples what can and cannot be entered.
- Train people. Most violations come not from bad intent but from lack of awareness.
- Audit and update. Tools change quickly; the policy should be reviewed at least once a year.
Step 1: Classify your data
Do not put all data in the same bucket. A simple three-colour system is enough for most businesses:
| Class | Example | General AI tools (publicly available) | Approved corporate tools |
|---|---|---|---|
| Green — Public | Text on your website, published blog posts, general questions | Allowed | Allowed |
| Yellow — Internal use | Draft presentations, anonymized process notes, internal documents without personal data | Only anonymized and with manager approval | Allowed within the policy |
| Red — Confidential / sensitive | Personal data, customer lists, contracts, prices and costs, financial statements, passwords/keys, confidential source code, trade secrets, employee information | Never | Only where explicitly permitted, covered by contract and legally assessed as needed |
Show the classification to the team with concrete examples; abstract sentences such as “do not enter confidential data” are not clear enough.
Step 2: Build an approved tool list
For each tool, evaluate:
- Data use: Are inputs used for model training? Can this setting be turned off? Corporate plans usually have different terms; read the contract and privacy terms.
- Retention and deletion: How long are conversations kept, and can they be deleted?
- Access control: Is there single sign-on (SSO), user management and logging?
- Data location and transfer: In which country is the data processed, and what are the transfer safeguards?
- Security certifications and audits: The security documents the provider publishes.
- Integrations: Are plugins and third-party connections under control?
Publish the list of approved tools in one place (an internal wiki) and record who approved what and why. For tools outside the list, define a “request and review” process.
Step 3: Write the rules with examples
Must not be entered (red lines)
- Customer, employee or candidate personal data (name plus phone, email, address, ID number, health data, etc.)
- Contracts, quotes, price lists, costs and profit margins
- Passwords, API keys, access tokens
- Confidential source code and architecture documents (only with an approved tool and permission)
- Financial statements and unpublished information
- Any information covered by a non-disclosure agreement (NDA) with a third party
May be entered (examples)
- Public information and your own published content
- General questions with no personal data (“How do I politely answer a customer complaint email?”)
- Anonymized examples (names, company names and identifying details removed)
What must be done
- Always check the output: facts, figures, sources and quotations must be verified.
- In areas like law, finance and health, AI output must not be the basis of a decision without expert approval.
- For texts that go outside (quotes, contracts, press releases), responsibility lies with the employee, not the tool.
- State AI-generated content where the policy requires (e.g. in customer communication or publication).
- Asking in doubtful cases should be allowed and encouraged.
Step 4: Process and responsibility
| Topic | What needs defining |
|---|---|
| Policy owner | Who manages it? (IT, information security, the KVKK officer, management) |
| Approval process | How is a new tool requested, and who approves? |
| Training | At onboarding and yearly; short and with examples |
| Incident reporting | If confidential data is entered by mistake, whom to tell and how quickly? |
| Monitoring | To what extent is tool use monitored (with employee notice and KVKK compliance)? |
| Review | At least once a year; when new tools or regulatory changes appear |
When confidential data is entered by mistake, a panic- or punishment-focused approach leads to incidents being hidden. A “report immediately if you make a mistake” culture protects you more than it exposes you. If an incident involves personal data, consult your legal/KVKK officer.
A short policy draft you can copy and adapt
AI Tools Use Policy (Draft)
1. Purpose. To enable employees to benefit from AI tools productively and safely, and to protect company, customer and employee data.
2. Scope. All generative AI tools that produce or analyze text, images, audio or code.
3. Approved tools. Business use is carried out only with the tools on the [Approved Tool List] and with a corporate account. For use of a tool not on the list, apply to the [Responsible Unit].
4. Prohibited data. Personal data, customer/employee information, contract and price information, financial information, passwords and keys, confidential source code and information under NDA may not be entered into any AI tool outside approved and authorized use.
5. Anonymization. If internal documents are to be used, names, company names and identifying information are removed beforehand.
6. Verification. AI output is verified by the employee before it is published or shared. Responsibility for the output rests with the employee.
7. Transparency. Use of AI is stated in customer- or public-facing content where required.
8. Reporting. If prohibited data is entered by mistake, it is reported to [Responsible Person] immediately; the reporting employee is not penalized.
9. Training and updates. The policy is reviewed at least once a year; employees are trained.
This text is a starting point; adapt it with your legal adviser to your sector, contracts and regulatory obligations.
An alternative that keeps control with you: your own AI solution
For businesses working with sensitive data, one path is to build an AI solution they control: an assistant connected to the internal knowledge base, with limited access permissions, logged records and, when needed, no data leaving the company. The basis of this approach is the RAG (Retrieval-Augmented Generation) architecture; you can find details in our RAG article and AI chatbot guide. For the security side, see our web application security guide.
Not every business needs a custom solution; for most, a clear policy, an approved corporate tool and training are enough. But for high-volume or sensitive workflows, a custom solution can make sense for both security and productivity. To evaluate the investment, see our AI ROI calculation article.
Moving to action: a 30-day plan
| Week | What to do |
|---|---|
| 1 | Learn current use through surveys/conversations (which tools, for which jobs?). Draft the data classification. |
| 2 | Choose approved tools and review contract/privacy terms. Involve legal and the KVKK officer. |
| 3 | Write the policy; back it with examples; review it with managers. |
| 4 | Run a short training, publish the policy and announce the reporting channel. Set a review date three months out. |
6 common mistakes
- Only banning. Shadow use grows and visibility shrinks.
- Writing abstract rules. Give examples and classification instead of “don't enter confidential data.”
- Letting people use free personal accounts for work. Corporate terms usually provide stronger protection.
- Not verifying output. Wrong information goes out under the company's name.
- Skipping training. A policy that is published and forgotten is not applied.
- Not updating the policy. Tools and regulation change quickly.
Using AI safely with Aktaş Digital
We do not just recommend tools to businesses; we develop AI solutions that work with your own data, with access and logging control: AI chatbot systems, AI document analysis and RAG systems and an AI customer support assistant. To evaluate your use case, data classification and security requirements together, you can write to us through our quote form.
Frequently Asked Questions
Can employees paste a customer email into ChatGPT?
An email containing personal data should not be pasted into any general tool other than an approved, contract-protected one. A text anonymized by removing names, phones and identifying details can be used to the extent your policy allows.
Do corporate plans mean “data is safe”?
Corporate plans usually offer stronger data protection, admin control and guarantees such as not using data for training; but terms vary by provider and plan. Review the contract and privacy terms and do the transfer assessment under KVKK.
Is monitoring AI use against employee privacy?
Monitoring must be done with notice obligations and proportionality. Inform employees and apply only the monitoring that is necessary. Consult your legal adviser for details.
Who owns the copyright to content we produce with AI?
This is a legally evolving area and may vary by country. For critical content (logos, brands, long texts), obtain legal advice and read the ownership and licence clauses in the tools' terms of use.
Is a policy needed even for a small team?
Yes, but it can be short: one page, a few clear examples and an approved tool list are enough. What matters is that the team knows what they can and cannot enter.
Who should prepare the policy?
Information security/IT, legal or the KVKK officer and the business units should prepare it together. Involving the people who will apply the rules makes adoption easier.
Conclusion
The aim of an AI policy is not to stop innovation but to enable it to be used safely. Classify your data, define approved tools, write rules with examples, have output verified and train the team. The first thing you can do today: ask your team through a short form which AI tools they use, and for which jobs.
