Secure ChatGPT at work: simple rules
Concrete rules for using ChatGPT and AI assistants at work without exposing data, secrets, or sensitive decisions.
Équipe responsable de la préparation, de la mise à jour et de la coordination des contenus pratiques de Cybernow. Les sujets techniques et réglementaires doivent être attribués à un spécialiste identifié avant publication finale.
Areas of expertise
- Cybersécurité pour PME
- Services managés
- Gouvernance et risques
Problem
AI is already used in the company, with or without an official policy.
Expected outcome
Clear usage rules employees understand and apply.
Use business accounts
Personal accounts make governance and audit nearly impossible.
- Centralized accounts.
- Validated privacy settings.
- Logging where available.
Ban certain data
Employees need examples, not abstract rules.
- No customer data.
- No secrets or API keys.
- No non-public contracts.
Validate sensitive outputs
AI can hallucinate, oversimplify, or invent references.
- Mandatory human review.
- Verified sources.
- No high-risk automated decisions.
Frequently asked questions
Can ChatGPT be used with customer data?
Not without contractual safeguards, enterprise security, and compliance validation.
Is a policy enough?
No, it must be supported by training, controlled accounts, and guardrails.
Which tool should we choose?
Choose a tool with governance, privacy, admin controls, and business-suitable terms.
Methodology and limitations
This content is a practical synthesis intended to guide an initial review. Applicable priorities, timelines, costs, and controls depend on your environment, assets, and risk level; validate them before making a decision.
Useful primary references:
Create a clear AI policy
Cybernow governs AI usage with rules, training, and controls.
Secure my AI usage