Policy Guide
Building a
ChatGPT Security Policy
To use generative AI like ChatGPT, Claude, and Gemini safely at work, you need a clear corporate policy. Here's a step-by-step guide on what your policy should include and how to enforce it.
4 Types of Information Never to Enter into AI
Regardless of which generative AI service is used, the following types of information must never be entered.
Personally Identifiable Information (PII)
Customer names, email addresses, phone numbers, national IDs, passport numbers, and all forms of personal data
Source Code and API Keys
Internal source code, API keys, database credentials, and system architecture information
Internal Business Documents
Unpublished financial data, business plans, contracts, M&A information, and sales strategies
Regulated Data
GDPR/privacy-regulated data, medical records, and financial transaction information
4 Key Elements of a ChatGPT Enterprise Policy
The essential elements an effective AI usage policy must contain.
01
Define Scope and Purpose
- Employee scope the policy applies to
- Definition of ChatGPT and generative AI services
- Corporate and legal impact of policy violations
02
Specify Permitted and Prohibited Actions
- List of prohibited input data types
- Permitted AI use cases for work
- Review obligation when using AI outputs
03
Technical Controls
- AI DLP solution deployment (endpoint)
- Manage AI service allowlist
- Warning/blocking configuration for sensitive data detection
04
Training and Incident Response
- Mandatory AI security training for new employees
- Policy violation incident reporting procedure
- Quarterly policy review and update
Frequently Asked Questions
No. Policy is a starting point, but technical controls must be implemented alongside it. AI DLP solutions automatically enforce policy and prevent human error or intentional violations.