Most companies that “ban ChatGPT” have nothing against AI. They object to employees pasting company data into a consumer account the company has no contract with, where by default the vendor may use it to improve its models. The usual fix is an approved tool: a business plan with no-training and retention terms, a model endpoint inside the company’s own cloud account, or an open-weights model on hardware the company runs. With the right contract in place, the public tools are fine for a lot of work.
Below: what actually happened in the cases everyone quotes, which rules apply in 2026, what each vendor’s business terms say today, and where your text goes in each option. Everything was checked against primary sources in September 2026; they are listed at the end.
What happened at Samsung and the banks
Samsung is the case everyone cites. In early 2023 its semiconductor business allowed engineers to use ChatGPT. Korean media then reported three separate incidents: staff pasted source code to fix bugs, used the tool to write meeting minutes, and entered equipment measurement and yield data. Samsung did not confirm the details at the time. At the end of April 2023 a memo told staff in one of its biggest divisions that generative AI was temporarily restricted on company computers. In an internal survey the month before, 65% of respondents had said they were worried about the security risks.
Apple restricted ChatGPT and GitHub Copilot in May 2023, according to the Wall Street Journal, because it feared confidential data would end up with developers who train models on user data. The same reports listed JPMorgan, Bank of America, Citi, Deutsche Bank, Goldman Sachs, Wells Fargo, Walmart and Verizon as having restricted ChatGPT.
Two things about these cases are easy to miss.
First, nobody was hacked. The data went exactly where the employee sent it. The worry was what happens after that: who keeps it, for how long, whether it trains a model, and whether a court can make the vendor hand it over.
Second, the bans did not last as bans. JPMorgan built its own internal platform, LLM Suite, which gives staff access to large language models “in a secure environment”. It was released in summer 2024 and reached 200,000 onboarded users within eight months. That is the typical arc: block the consumer app, then give people something approved.
What the risk actually is
When an employee uses a personal consumer account, four separate problems stack up.
Training by default. On ChatGPT Free, Plus and Pro, content may be used to improve OpenAI’s models unless the user turns off “Improve the model for everyone” in Data controls. If the user clicks thumbs up or down, the whole conversation may be used even after opting out. Anthropic’s consumer Claude plans use chats for training if the user allows model improvement. So whether your source code ends up in a training set depends on one setting in someone else’s account.
Retention you don’t control. Business data on OpenAI’s platform is deleted within 30 days of the user deleting it, “unless we are legally required to retain them”. That last clause is real. In the New York Times lawsuit, a court order from June 2025 to 26 September 2025 required OpenAI to keep consumer ChatGPT and standard API content it would otherwise have deleted. ChatGPT Enterprise, Edu and API customers with zero data retention were not covered.
No contract. This one matters most legally. Under GDPR, a company that lets a vendor process personal data must use a processor that gives “sufficient guarantees” and must have a binding contract with it (Article 28). A healthcare provider needs a business associate agreement. An employee’s personal account has neither, so the breach happens at the moment of pasting, whether or not anything ever leaks.
No records. Regulated firms must supervise and archive business communications. A chat in a personal account sits outside every archive the compliance team runs.
The rules that apply in 2026
GDPR
Personal data of EU customers or staff in a prompt is processing. It needs a lawful basis, a processor contract under Article 28, and a legal route for any transfer outside the EU. For US vendors the EU-US Data Privacy Framework is still valid: the EU General Court dismissed the Latombe challenge on 3 September 2025 (case T-553/23). An appeal is pending at the Court of Justice as C-703/25 P, so keep an eye on it.
Regulators have acted on chat services directly. Italy’s Garante temporarily blocked ChatGPT in late March 2023, and in December 2024 it fined OpenAI €15 million for processing personal data to train ChatGPT without an adequate legal basis, not notifying a March 2023 breach, weak transparency and missing age checks. OpenAI called the fine disproportionate and said it would appeal.
HIPAA
Any service that receives, stores or transmits electronic protected health information for a covered entity is a business associate and needs a signed BAA. HHS is explicit that a cloud provider which only holds encrypted data and has no key is still a business associate. OpenAI says it can sign BAAs for its API. A clinician’s personal ChatGPT account comes with no BAA at all.
Financial services
FINRA’s Regulatory Notice 24-09 (27 June 2024) says its rules apply to generative AI “just as they apply when member firms use any other technology or tool”. Supervision, communications with the public and recordkeeping all still apply. Most of the 2023 bank restrictions followed from exactly that.
EU AI Act
The AI Act entered into force on 1 August 2024. The bans on prohibited practices and the AI literacy duty applied from 2 February 2025, and the obligations for general-purpose AI model providers from 2 August 2025. The AI Omnibus amendment, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk deadlines: 2 December 2027 for stand-alone high-risk systems, which include AI used in hiring such as CV sorting, and 2 August 2028 for AI built into regulated products. Transparency duties under Article 50 applied on schedule from 2 August 2026, and the AI literacy duty was softened to taking measures to “support” it.
For a company that uses a chat assistant to draft emails, the AI Act adds little. If the same assistant starts ranking job applicants, you are deploying a high-risk system and the December 2027 date applies to you.
What the business plans promise
Every major vendor now sells a business tier with different defaults from the consumer app. The table summarises what each vendor’s own page says as of September 2026.
| Offering | Trains on your data by default? | Retention and control | Compliance notes |
|---|---|---|---|
| ChatGPT Free, Plus, Pro | May, unless the user opts out | Per user account | No company contract |
| ChatGPT Business, Enterprise, Edu | No | Workspace admins set retention | SOC 2 Type 2 for Enterprise and Business |
| OpenAI API | No | Deleted after 30 days; zero data retention for eligible uses | BAA available |
| Claude Team, Enterprise, API | No | Feedback may be kept up to 5 years; owners can turn feedback off | Commercial terms |
| Microsoft 365 Copilot and Copilot Chat | No, not used to train foundation models | Your retention policies, labels and audit apply | DPA, EU Data Boundary (Anthropic models excluded) |
| Gemini in Google Workspace | Not used for training outside your domain without permission | Existing Workspace controls apply | HIPAA support, FedRAMP High |
The model endpoints inside the big clouds go further. Microsoft says prompts and completions for models sold by Azure in Microsoft Foundry are “NOT available to OpenAI or other providers” and are processed within the geography you pick, unless you choose a Global or DataZone deployment. On Amazon Bedrock, models run in deployment accounts that the model providers cannot access, so they never see your prompts or completions.
What a business plan does not change: the text still sits on the vendor’s servers for as long as the retention terms allow, and a court order can still reach it. That is the same trust you already place in your email and document providers. For most internal work it is a reasonable trade. For trade secrets, regulated data without a BAA, or material a client contract forbids sending to subprocessors, it may not be.
Where your prompt goes in each option
The honest way to compare options is to follow one prompt and ask who can read it.
Running open-weights models yourself
The strongest option for confidential data is also the most work: download an open-weights model (Llama, Qwen, Mistral, Gemma and others) and run it on machines inside your own network. Prompts never leave. You choose what gets logged and for how long, which makes recordkeeping and GDPR retention rules easier to meet, and nobody else’s retention clause or court order touches the data.
The costs are real, though. You now operate an inference service: GPUs, an engine such as Ollama or vLLM, authentication, logging, updates and someone on call. And an 8B or 14B model that fits on a single workstation card is weaker than a frontier model at long reasoning. It is usually good enough for classifying, extracting fields, summarising internal documents and drafting routine text. Test it on your own tasks before you decide. Our Ollama vs vLLM vs TGI benchmark covers engine choice, and the private LLM fine-tuning guide covers adapting a model to your documents.
There is a middle path that many firms take: run the open model on GPU instances inside the cloud account you already have. The cloud provider is then a processor under a DPA you have already negotiated for everything else, and no model vendor is involved at all.
Where rented GPUs and GPUFlow fit
GPU marketplaces are the cheap end of the market, and they belong in this comparison only with a clear label.
GPUFlow is one of them. You rent a GPU for a number of hours and get an OpenAI-compatible API key for the open model the provider runs on it, usually through Ollama. The model runs on the provider’s own computer. That means your prompts and the answers pass through that machine in plaintext while the rental runs. GPUFlow’s terms forbid providers from recording, reading, keeping or sharing renters’ requests or answers, and GPUFlow itself does not store the text. But the provider has root on the machine, and the rule against recording is enforced by contract; nothing technical stops it.
So GPUFlow is not the answer for regulated or confidential data. Don’t send it customer records, health data, source code you care about, or anything a client contract restricts. Our own docs say it more bluntly: don’t send passwords, card numbers or other secrets you wouldn’t share with a stranger.
Where it does fit: trying an open model on real hardware before you buy a card, running prompts over public or synthetic data, and building and testing an app against an OpenAI-compatible API before you point it at your own server. Community-cloud machines on other marketplaces raise the same question for anything you upload; How to secure your dataset on a public GPU node covers that side.
A policy people will actually follow
A flat ban with no alternative mostly moves usage to personal phones, where you can see even less. What works better is short enough to remember:
| Data class | Examples | Allowed tools |
|---|---|---|
| Public | Published docs, marketing copy | Any approved tool, including consumer apps |
| Internal | Policies, internal wikis, non-sensitive code | Business plans with a DPA and training off |
| Confidential | Client data, trade secrets, deal terms | Cloud endpoint in your tenant, or self-hosted |
| Regulated | Health data, card data, personal data at scale | Self-hosted, or a vendor with the specific agreement (BAA, DPA) |
Then do the unglamorous parts:
- Buy one business plan or cloud endpoint and make it the default, with single sign-on so accounts close when people leave.
- Set retention to the shortest period that meets your recordkeeping duties, and confirm training is off in the admin console.
- Block consumer AI chat sites on managed devices only once the approved tool is live.
- Keep an inventory of AI uses. Anything touching hiring, credit or similar decisions needs a separate review before December 2027.
- Tell people what to do instead of only what not to do. The Samsung memo arrived after the data had left.
For the running cost side of self-hosting versus per-token services, see Hourly GPU or per-token API?.
Sources
- Samsung restriction and survey: CNBC, 2 May 2023; incident details: The Register, 2 May 2023
- Apple and other companies: TechCrunch, 19 May 2023
- JPMorgan LLM Suite: JPMorganChase technology blog, 3 June 2025
- OpenAI business terms: Enterprise privacy; consumer training settings: How your data is used to improve model performance
- NYT preservation order: OpenAI, response to NYT data demands
- Anthropic: commercial data and training, consumer data and training
- Microsoft: Enterprise data protection in Microsoft 365 Copilot and Copilot Chat, Data, privacy and security for Foundry Models sold by Azure
- Google: Generative AI in Google Workspace Privacy Hub
- AWS: Data protection in Amazon Bedrock
- GDPR Article 28: gdpr-info.eu
- Data Privacy Framework ruling: Jones Day, September 2025; appeal: Digital Policy Alert
- Garante fine: The Hacker News, December 2024
- HIPAA and cloud providers: HHS, Guidance on HIPAA and cloud computing
- FINRA: Regulatory Notice 24-09
- EU AI Act: European Commission, AI Act; Omnibus: White & Case, EU AI Omnibus enters into force
- GPUFlow: API quickstart, What renters can and can’t reach, Terms, Privacy policy
All checked in September 2026.