your best employee is pasting the client list into a chatgpt account you do not own and cannot audit.

roughly three quarters of employees now paste company material into ai tools, and about the same share of workplace chatgpt accounts are personal logins with no admin, no retention setting, and no record you can produce. what goes in is not exotic: pricing, a client list, an unsigned contract, a spreadsheet with names in it, pasted by the people who move fastest because nobody gave them a sanctioned way to move that fast.

the bill arrives later and in someone else's words, a client asking where their data sits, a renewal stalled on a vendor questionnaire, an insurer comparing what your policy claims against logs you cannot pull. the advice going around is to write an ai policy and block the tools, which does not stop the paste. it moves it to a personal phone where you have no visibility at all.

do the version that holds: put every employee on a managed company account for one or two approved tools with training and retention switched off, and write a single page naming what may be pasted and what may not, in examples rather than categories. that is an afternoon of admin, and it closes the largest hole you currently have, but only if the approved path is faster than the personal one.