If you run a 10 to 50 person business, someone on your team is probably using ChatGPT, Gemini or another AI tool for work today. Often it's on a personal account, sometimes free, sometimes paid for and expensed.

That's not a reason to panic, and it's not a reason to ban AI. It is a reason to make a few decisions on purpose, rather than letting them get made one account at a time.

What actually differs between a personal and a business account

The tools look the same on screen. The terms underneath are different.

Training on your content. On OpenAI's personal plans (Free, Plus and Pro), OpenAI says it may use your content to train its models unless you opt out under Settings → Data controls (OpenAI help). Even after opting out, if someone clicks thumbs up or down on a response, OpenAI says the whole conversation may be used for training. By default, OpenAI says it doesn't use content from ChatGPT Business or Enterprise workspaces for training (Data controls in ChatGPT).

Human review. Google's privacy page for the personal Gemini app says some chats are reviewed by people, including trained service providers. Reviewed chats are kept for up to three years, even if the user deletes their activity. Google asks users not to enter confidential information they wouldn't want a reviewer to see (Gemini Apps Privacy Hub). For Gemini used through a Google Workspace work account, Google says your content isn't human reviewed or used for model training outside your domain without permission (Generative AI in Google Workspace Privacy Hub).

Who controls the account. A personal account belongs to the employee. When they leave, their chat history leaves with them, including anything they pasted into it. A business workspace has an owner (you), billing in one place and a way to remove people.

None of this means personal accounts are reckless. It means the business has no say over them. For most owners, that's the part worth fixing.

The three decisions

1. Are personal AI accounts allowed for work?

There are three honest answers:

  • No. Work happens only in company accounts.
  • Yes, with limits. Personal accounts are fine for general questions, never for the information in decision 2.
  • Not decided yet. That's fine for a week, but write down that it's undecided and that only approved tools are OK in the meantime.

Pick one. "We haven't talked about it" is also an answer. It's just one nobody chose.

2. What never goes into AI, on any account?

Make the list short and specific so people remember it. A typical list for a small business: customer personal information, payment card numbers, Social Security or tax ID numbers, employee HR records, passwords, and financials you haven't released. If you're on QuickBooks, that includes customer and vendor list exports and payroll reports. "Use plain descriptions, not names" covers a lot of everyday work.

3. Where is the approved place to work, and who pays?

If people find AI useful, give them a business account instead of making them expense a personal one. The price difference may be smaller than you think. As of this writing, a ChatGPT Business seat billed annually is $20 per user per month, the same as personal Plus (OpenAI Business overview). If you're on Google Workspace, check which Gemini features your edition already includes before buying anything new (Google Workspace pricing).

A four-week plan

Week 1: Ask. Send your team two questions: "Which AI tools do you use for work?" and "Is it a personal or company account?" Make clear nobody's in trouble. You want an accurate list, not a careful one.

Week 2: Decide. Make the three decisions above. This takes one conversation, not a committee.

Week 3: Write it down. One page, plain English. Copy the policy template and, if you want it in your words, run the customize prompt.

Week 4: Move people over. Set up the business account, invite the people who use AI most, and help them decide what to bring along. If you use ChatGPT Business, people can merge their personal chats in, but OpenAI says the merge can't be undone and there's no self-service export from Business afterward (OpenAI migration guide). Tell them to export anything personal first. Then stop reimbursing the personal seats.

What I'd skip

I'd skip buying an enterprise AI plan, a monitoring tool, or a 20-page policy for a 25-person company. The goal is simple: people know which tools to use, what never goes in, and who to ask.

I'd also skip banning AI outright unless you have a specific reason. A ban usually just moves the use somewhere you can't see it.

If you only do one thing

Run the subscription audit prompt. Paste your AI charges into your business AI account. It flags personal accounts used for work and gives you the list you need for week 1.

This is general information, not legal advice. If you handle health information or work in a regulated industry, have your attorney or compliance advisor review your rules before you rely on them.