You can use ChatGPT safely in your business if you settle three things first: which tools and which type of account are allowed, which data is never entered, and who checks the outputs before they reach customers. These rules are written into a short AI use policy that every employee knows.
In many businesses, employees already use AI tools such as ChatGPT, Claude or Gemini, often from personal accounts and without clear rules. The problem is not the tool itself, but the lack of control: what information leaves the business, where it is stored and who is responsible if a generated text contains a mistake. The guide below helps you bring order without banning a useful tool.
In short
A good AI use policy is short and specific: the list of approved tools, the type of account allowed, prohibited data, the human review rule and a contact person for questions. A total ban rarely works; people end up using the tools in secret, from personal accounts.
Please note
This article is for information only and does not constitute legal advice. It reflects the situation at the time of writing (October 2026). Providers' terms change, and for data protection you should consult the GDPR on EUR-Lex, the guidance from ANSPDCP (the Romanian data protection authority) and, where appropriate, your data protection officer or a lawyer.
Why does your business need an AI use policy?
Without rules, each employee decides alone what to copy into a chatbot. One pastes a contract to summarise it, another enters the customer list to write personalised emails, a third sends a customer a generated reply without checking it. Each action seems harmless, but together they create real risks: leaks of confidential information, data protection breaches and errors that reach customers.
A written policy also solves a problem of accountability. When the rules are clear, employees know what they are allowed to do, and managers know what to check. In addition, the European regulation on artificial intelligence (the AI Act) requires businesses that use AI to ensure their staff have sufficient knowledge of these tools, and a policy accompanied by a short training session is a practical way to meet that requirement.
What data you should never enter into ChatGPT or other AI tools
The basic rule: do not enter into an AI tool anything you would not email to an outside company you have no contract with. Specifically, the following categories are not entered into unapproved tools and, as a rule, not into approved ones either without a clear reason:
- Personal data of customers, employees or candidates: names linked to contact details, CNP (Romanian personal identification number), addresses, phone numbers, order history.
- Special categories of data: information about health, political opinions, trade union membership, biometric data.
- Passwords, access keys, API keys, login credentials.
- Non-public financial data: internal financial statements, margins, price quotes to customers, bank details.
- Contracts, legal documents and confidential correspondence with partners.
- Proprietary source code, internal technical documentation, unpublished product plans.
- Any information covered by a confidentiality agreement.
When you do need help with such a document, anonymise it: replace names with “Customer A”, remove exact figures and keep only the structure of the problem. The answer is often just as useful.
Personal account or business plan: why it matters
Most providers offer both consumer plans and business plans. The difference is not only about features, but above all about how the data you enter is handled.
- Use of data for training: in general, on consumer plans the default settings may allow conversations to be used to improve the models, with an option to turn this off. On business plans, providers usually state that data is not used for training by default.
- Contract and data protection: business plans usually include a data processing agreement (DPA), which is necessary if personal data passes through the tool.
- Administration: on business plans you can manage accounts centrally, withdraw access for an employee who leaves and set data retention rules.
- The business's control over content: in an employee's personal account, the business has neither access to nor control over the conversations, even if they contain work information.
Important limitation
Terms, privacy settings and plans change periodically. Before choosing a tool, read the provider's current terms, privacy policy and official pricing page. Do not rely on what applied a few months ago or on what a colleague says.
ChatGPT and the GDPR: what you need to know
If personal data passes through the AI tool, the General Data Protection Regulation (GDPR) applies in full. A few basic questions your business must have answered:
Legal basis
Any processing of personal data needs a legal basis: contract, legal obligation, legitimate interest, consent and the others set out in the GDPR. The fact that a tool is useful is not, in itself, a legal basis. Data subjects must be informed, usually through the privacy notice, that their data may also be processed with the help of AI service providers.
The contract with the provider (DPA)
The AI tool's provider usually acts as a processor, meaning it processes data on your business's behalf. The GDPR requires a written contract with specific clauses. Business plans usually offer such an agreement; an employee's personal account usually does not.
Transfers outside the European Economic Area
Many AI providers are based outside the EU. Transferring personal data to third countries is allowed only with safeguards provided for in the GDPR, such as an adequacy decision or standard contractual clauses. Check where the data is processed and which transfer mechanism the provider uses; some also offer options for storage in Europe.
For high-risk processing, for example automated analysis of employee data, a data protection impact assessment may be required before you start. The competent authority in Romania is ANSPDCP.
Checking the answers: AI can be convincingly wrong
Language models can produce answers that are fluent and confident but wrong: invented figures, legal provisions that do not exist, incorrectly cited sources. The risk is not that AI makes mistakes, but that the mistake looks credible.
- Any text that reaches a customer, partner or authority is read and approved by a person before it is sent.
- Figures, dates, prices and references to legislation are checked against the original source.
- For legal, tax or medical information, AI can be a starting point, not a conclusion.
- Generated code is reviewed and tested like any other code, including from a security perspective.
- Responsibility for the result stays with the person who uses it, not with the tool.
Sample AI use policy: a checklist
An effective policy fits on one or two pages. Use the list below as a skeleton and adapt it to your business, together with whoever handles data protection:
- Purpose: why the business uses AI tools and for which types of task (drafting, summarising, research, translation, programming).
- Approved tools: the exact list, with the type of account allowed (usually the business account, not personal accounts).
- Prohibited data: the list of categories that are never entered, with specific examples from the business's activity.
- Anonymisation: how a document is prepared before it is used with AI.
- Human review: which types of output must be checked, and by whom, before external use.
- Transparency: when to state that content was generated or assisted by AI.
- New tools: the procedure by which an employee requests approval for a tool that is not on the list.
- Incidents: what an employee does if they have entered sensitive data by mistake, and whom they report it to.
- Training: a short session when someone joins, repeated periodically.
- Review: the policy is updated when providers, terms or legislation change, with a named owner.
Practical tip
Put a page of specific examples from your business next to the policy: “do this” and “don't do this”. People remember an example far more easily than an abstract rule.
When a general-purpose tool is not the right solution
A general-purpose chatbot is very good for individual tasks, but it has limits when it comes to the business's documents, role-based permissions or integration with other systems. If the team ends up copying the same internal documents into the chat every day, that is a sign you need an assistant configured on your own sources, with controlled access and logging. Likewise, if the data is highly sensitive, a solution with stricter control over where the data is processed may be more appropriate.
How WEB-AZ helps
We work with models from several providers and build AI assistants that answer from your business's documents, with role-based permissions and clear data rules. We can help you choose an architecture suited to how sensitive your data is. The legal side, meaning the final policy, the legal bases and the contracts, remains the responsibility of your lawyer or data protection officer, with whom we work together.
Next steps