The right answer to “staff are pasting company data into ChatGPT” is not a block, and it is not a shrug. It is governed access: sanctioned tools, on terms that protect the data, opened by role, with a policy people have been trained on. None of the five controls is exotic. Together they manage the risk better than a block does and unlock the fastest value in the programme.
1. Enterprise licences with no-training terms
The enterprise tiers of the main tools, Microsoft 365 Copilot, ChatGPT Enterprise, Claude for Work and Enterprise, contractually commit that business data submitted through them is not used to train the underlying models. This directly answers the concern that drove most blocks. Confirm the exact terms, data residency and retention at contracting, and write them into the usage policy so IT governance can point to them.
2. Data classification and data-loss prevention
Clear rules on what may and may not be shared with which tool, backed by DLP controls, so sensitive material is protected regardless of the tool. Most businesses already have a classification scheme; the work is mapping it to AI use, “public and internal may go to sanctioned tools; confidential may not, except through the approved integration”, and making the DLP enforce it.
3. A sanctioned-tool list and phased, role-based access
A short list of approved tools with their permitted uses, access opened by role and use case rather than all at once, a pilot group that becomes the champions, and an approval route for new tools so the list stays current rather than being bypassed. Extending an existing Copilot trial into a governed rollout is the usual starting point.
4. Usage policy and AI literacy
An acceptable-use policy people can read in five minutes, and the training to go with it: what may be shared, how to check AI output, how to recognise and report a problem. AI literacy for staff involved in AI systems has been a requirement under Article 4 of the EU AI Act since February 2025, which makes this the one control that is also a legal duty.
5. Responsible-AI principles in the assessment process
Fairness, transparency, accountability, privacy and safety, applied to tool selection, vendor evaluation and use-case assessment. In practice: a risk classification (minimal, limited, high) and mitigation plan on every AI business case; workforce impact and compliance value in the value assessment; compliance and audit cost in the total cost of ownership. Four fields, risk category, data protection, human oversight, transparency, added to the template the business already uses.
The specific controls the use cases call for
Beyond the five, the roadmap usually calls for a handful of specific controls: human review of AI output on anything safety-related, compliance-related or contractual; grounded, cited answers from any knowledge assistant; transparency and prompt-injection guardrails on customer-facing chatbots; and no camera-based monitoring of people without HR and legal sign-off. These are written into the relevant use cases rather than into the general policy.
Alignment, not competition
None of this competes with existing governance; it is the practical content of it. Where a business has an AI working group, an IT governance board or a technology-assessment process, the model slots in: the working group owns the policy and the tool list, the assessment process carries the four fields, and the rollout runs through whatever change process exists.
The through-line is simple. The concern behind a block is legitimate; the answer is control, not prohibition. Governed access is the enabling decision for almost everything else in an AI programme, and it is usually the first recommendation in our roadmaps.
The model is delivered under AI governance and the EU AI Act, and the rollout that follows under AI tools and platform rollout.