Employees using personal ChatGPT at work? Here's what IT admins need to do

Monday morning, you handle security for an organization, and suddenly, your security tools flag personal ChatGPT use on a managed laptop, even though your org pays for ChatGPT Enterprise.

You wonder what the employee submitted to ChatGPT. Could be a public job description, or a customer ticket with contact information and internal account details. Maybe sensitive government documents, if that is your line of work, as the acting director of CISA did in 2025?

The case is hypothetical. In this article, we will follow 2 versions of the same event.

In the first, your security tools identify personal account use, but nothing in your current configuration checks what goes into the prompt. In the second, NordLayer AI Scout is deployed on the managed browser, with a custom detector set to “Block” for your customer account number format.

What do you do next?

1. Confirm the account and the employee

You start with the basics. With only your existing controls, you open the event that flagged personal ChatGPT use and work out which identity belongs to what. The user who signed in to your security tools may have a corporate email address. But the ChatGPT login behind the event may be a personal Gmail account.

That gives you 1 person, 2 identities, and 1 awkward conversation ahead.

With NordLayer AI Scout, the signed-in ChatGPT account appears beside the conversation, and the tool classifies new ChatGPT conversations as Personal or Corporate.

Activity is tied to a person through the work email that your MDM tool pushes to the device. Directory sync with Entra ID, Okta, or HiBob adds the department, team, and role information.

2. Establish what reached ChatGPT

In the first scenario, the retained event says the employee used a personal account. It holds no prompt text and no sensitive data findings, so you can’t rebuild the submission from it.

Under the incident review procedure, you ask the employee to show you the conversation. Better keep the request narrow and limit it to the work exchange around that timestamp, unless you want a tour of your colleague’s meal plans or medical questions.

Let’s say, the customer ticket is right there in the prompt, and ChatGPT's reply discusses it in detail. You now have evidence that customer information reached the service.

With NordLayer AI Scout, you open the blocked finding. The browser extension had checked the prompt on the device before it left. A configured detector matched the customer data, and the “Block” action stopped the submission.

The employee then saw an on-page notice that the prompt had been blocked. Nobody on the security team needed to read the prompt for this to happen.

3. Ask why the corporate access went unused

There’s a 99% chance that the explanation is mundane: the corporate session had expired, 2FA took too long, the customer was upset, and the personal ChatGPT tab was already open and signed in.

The employee says that’s why they pasted a customer support exchange into the chat, typed “Draft a response explaining why this customer cannot access their account,” and pressed “Send.”

Without a matching prompt-blocking rule, the prompt reached ChatGPT. Good. Next, you should find out whether this was the first time.

Without NordLayer AI Scout in place, you depend on the employee’s memory. You have to ask whether they ever pasted whole tickets before, uploaded attachments, or created shared conversation links, and generally whether personal ChatGPT became their plan B every time the corporate session expired.

It is also a good idea to ask what they understood about the policy. Sometimes people remember that ChatGPT is approved, but they forget which workspace and data it applies to.

4. Respond to the outcome you confirmed

Without dedicated prompt-level controls, customer data reached a completed conversation in a personal ChatGPT account. You should preserve the evidence you need and bring in the incident, privacy, or data owner.

Then, judge how serious it is based on what was shared. If credentials were exposed, they need revocation or rotation. If it’s customer records, the process may need a privacy assessment. If public text was pasted, there’s no data incident at all, but it makes sense to have a word with the employee about their more powerful Enterprise seat, which is paid for.

In any case, you should keep the write-up accurate, because using a personal account does not prove that the prompt went into model training, became public, or reached another user.

You confirmed that company data entered a service through an account outside of the approved arrangement—that is serious enough without embellishment.

If you use NordLayer AI Scout, you just record that the configured rule blocked this submission. The event shows an attempted policy violation and the control that stopped it. If the employee mentions earlier use of their personal account, you assess it separately.

5. Fix the workflow before you close the ticket

You help with the 2FA and ask the employee to sign in to the Enterprise workspace and finish the support task there so you can see it work. However, an Enterprise subscription does not mean that employees can submit anything, so you also verify that the task and data are permitted.

In the first scenario, you review restrictions on personal instances and the DLP rules that apply.

With NordLayer AI Scout, you confirm the prompt policy on the browser extension.

“Warn,” “Redact,” and “Block” do different jobs.

“Warn” pauses the send and lets the employee choose whether to send anyway or go back and edit the text. “Redact” removes the matched value and sends the rest. “Block” stops the prompt. You pick the action that fits each data category.

Then, you document the account, the device, the confirmed contents, whether the prompt was sent, and who owns the response. Finally, you record the access fix and schedule a check for repeat events.

All in all, in one version, customer data reached personal ChatGPT and needed an exposure assessment. In the other, the configured detector blocked the prompt before it left the device.

In both versions, the employee needs corporate access that works on a Monday morning. Without it, the ticket will close, and a workaround will be ready by tomorrow.

About the author:

Vakaris Noreika, VP of Product Research and Development, is a cybersecurity expert who oversees the development of business security products at NordLayer, a toggle-ready network security platform for businesses. He has many years of experience working on threat intelligence, network security, data privacy, and automated monitoring. He focuses on controls that reduce exposure without creating unnecessary operational overhead.

Sponsored and written by NordLayer AI Scout.