When you introduce ChatGPT at work, employees should be able to answer three questions: which workspace do we use, which tasks and data are approved there, and who checks the result? Start with one recurring task and public or fictional examples. Customer, employee and contract data come later, once the specific use has been assessed.
A paid account alone does not create a shared way of working. If everyone uses a personal account, responsibility, data rules and review practices remain unclear. A rollout needs a managed business workspace, suitable settings and practical instruction based on the work people do. Check which controls the selected plan provides before buying it.
1. Choose a task whose result can be checked
Consider a sales team preparing replies to complaints. A public product description and an invented complaint are enough for an initial test. The team checks whether the draft understands the problem, reads clearly and avoids promising a refund or delivery date that nobody has agreed.
The real customer email is a second step. It may include names, order numbers, payment details and confidential terms. Removing the name does not automatically make it anonymous. Approve a specific combination of task, data and tool rather than declaring “ChatGPT is allowed”.
- Suitable for practice: a reply to an invented complaint using public product information.
- Needs a separate assessment: a reply to a real customer email containing the information required to handle the case.
- Outside the first test: the complete customer file, unrelated payment information and automatic sending of the reply.
This is an example of how to prepare a trial, not approval for your data. The same distinction works for quote drafts, internal instructions and meeting notes. Include rework when assessing quality: a quick draft saves nothing if correcting it takes longer than writing the previous response.
2. Establish a managed business workspace
Name the workspace administrator and a deputy. Give staff individual accounts rather than a shared password. Decide who invites people, assigns roles, removes departing employees and takes over shared templates or assistants. Check the authentication and access controls included in the actual offering.
Define the boundary between systems too: what belongs in the approved workspace, and what stays in the business application? Connected apps, file sources and actions require their own decisions. Permission to draft text does not automatically include reading an inbox, sharing files or sending messages. For each connection, check recipients, permissions and potential changes to other systems.
3. Assess training, storage and access separately
According to OpenAI, business data from ChatGPT Business, Enterprise and the API is not used for model training by default. Explicitly opting in to data sharing can change this. OpenAI offers a data processing agreement for these products. These points address important provider questions, but do not approve every kind of company information.
For personal accounts, Data Controls let you turn off training use for new conversations. This does not delete saved chats, and voluntarily submitted feedback may involve separate data use. A single setting therefore does not replace company approval.
Record three separate answers: is content used for training, how long are chats, files and logs retained, and who can view or export them? Check each answer against the selected service, plan, contract and enabled features.
Keep a dated record of the assessment and relevant settings. Approval for a chat is not blanket approval for later apps, new data sources or a different plan. Reassess the affected use when these change.
4. Resolve data approval with the responsible people
For personal data, the assessment includes purpose and legal basis. The European Commission describes several legal bases; consent is not the only option. Your data protection leads also assess the necessary information, transparency, access and deletion, and where applicable processor arrangements and international transfers.
Health information and other specially protected data need their own assessment. Processing likely to pose a high risk requires a data protection impact assessment before it starts. Customer contracts or trade secrets can also protect material without personal data. Resolve those requirements before adding real cases to the pilot.
5. Practise with staff and make mistakes visible
A short policy helps when people understand its boundaries. Practise with a normal task, an incomplete case and a draft containing a deliberate error. In the complaint example, that could be an invented delivery date. The person who will send replies needs to distinguish supported facts from statements that appear only in the draft.
Agree what gets checked before use: factual accuracy, names and figures, sources, commitments and recipients. ChatGPT can produce plausible but incorrect information. The person approving a response remains responsible for that approval. Staff also need a known route for reporting accidental data submissions or incorrect output; they should not try to resolve an incident by entering more information.
In an AI workshop, we can prepare these exercises around your tasks and develop practical working rules. The format depends on the team’s experience and responsibilities. Legal approval of data use remains with your responsible specialists.
6. Record the pilot’s scope on one page
For our illustrative complaint-response task, the entry could look like this. It records the agreed boundary and makes later changes visible:
- Task: prepare a reply without independently offering discounts or committing to dates.
- Tool and data: a named business workspace, approved product information and initially fictional cases.
- Access: selected staff with individual accounts; external apps are not approved for this pilot.
- Review: the responsible sales employee checks facts and commitments and sends the response personally.
- Ownership: a named person for the workspace, templates, questions and reported errors.
- Evaluation: compare handling time, including corrections, with previous replies; add real customer data or new connections only after reassessment.
If information is missing or checking creates more work, keep the pilot limited. Improve the sources, template or workflow first. The next step is not automatically buying more licences.
When private AI is a better fit
Some tasks need tighter data and operational boundaries than the chosen chat service offers. Assess a controlled API integration, dedicated infrastructure or a local model. Our private AI page explains these options. Local operation still needs decisions about access, backups, updates and possible external connections.
If it is unclear which workflow is worth pursuing, our AI audit example shows how a task becomes a proposal you can assess. Our prices and audit terms support budget planning. For an initial conversation, the task, your current tools and unresolved questions are enough. You do not need to send confidential documents.
