Can employees use ChatGPT with company data?
Yes, but only on an account your company controls. OpenAI states that by default it does not use inputs or outputs from ChatGPT Business, Enterprise, Edu or its API to improve its models, while personal ChatGPT accounts may be used for training unless the user opts out. Pair a business plan with a written AI policy, data-classification rules and admin-managed sign-in.
The real risk is the personal account
Most company data that reaches ChatGPT does not go through a contract your company signed. It goes through an employee's personal account, opened with a personal email, on a plan your IT team cannot see or govern.
OpenAI's own help center draws the line clearly. For services for individuals, OpenAI says it may use your content to train its models, and the user must turn off "Improve the model for everyone" in Data controls, or use the Privacy Portal, to opt out. Temporary chats are not used to improve models while they remain temporary. Even after opting out, a thumbs-up or thumbs-down on a response can make the whole conversation eligible for training.
What changes on a business plan
OpenAI states that by default it does not use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu or its API to improve its models. For the API, OpenAI's platform documentation adds that abuse-monitoring logs, which may contain prompts and responses, are retained for up to 30 days by default unless longer retention is required by law.
A business plan also moves the relationship from an individual user agreement to a company agreement, gives you an admin console, and lets you remove access when someone leaves. That is the difference between a tool you govern and a tool you merely hope is being used carefully.
What still needs a decision from you
A business plan solves training and ownership questions. It does not decide which data belongs in the tool. You still need to set rules for:
- Regulated data: health information, export-controlled technical data or controlled unclassified information may need a specific agreement or a different environment entirely.
- Confidential IP: unpublished research, source code, deal terms and customer lists.
- Output review: who checks AI-generated content before it reaches a customer, regulator or contract.
- Connectors and plug-ins: which third-party tools the account may connect to, since each has its own terms.
A practical rollout
Block or discourage personal AI accounts for work, license an approved business tool, publish a one-page acceptable-use policy, and train people on what never goes into a prompt. Then review usage quarterly. Banning AI outright usually pushes the same activity onto personal phones where you have no visibility at all.
Common follow-up questions
Does OpenAI train on ChatGPT Business or Enterprise data?
Not by default. OpenAI's help center states it does not use inputs or outputs from ChatGPT Business, Enterprise, Edu or the API to improve its models. API organization owners can choose to enable data sharing, so confirm that setting is off in your own organization.
Is turning off chat history on a personal account enough?
No. Opting out of training on a personal account removes one risk, but your company still has no contract, no admin control and no way to revoke access or retrieve data when an employee leaves. Company data belongs on a company-managed account.
Can we put customer health data into ChatGPT?
Not on a standard plan. OpenAI's API documentation describes processing protected health information only for customers who have executed its Business Associate and Healthcare Addendum and are provisioned for eligible endpoints. Treat health data as prohibited unless that agreement and configuration are in place.
LAN Service Group helps small and mid-size businesses choose and configure a company-controlled AI platform, write the acceptable-use policy, and set up the identity and data controls that keep company data out of personal AI accounts.
Talk to LAN Service Group (888) 281-7243