Uses13 November 2026Should AI at work be banned or regulated?
Bans, undeclared use, data entered and rules in force, as of 13 November 2026
Computer workstation. Photo Håkan Dahlström, CC BY 2.0, via Wikimedia Commons.
Several large companies restricted ChatGPT in 2023, and the question now arises in most organisations: ban AI at work, or regulate it. In the KPMG and University of Melbourne survey, employees whose organisation has banned generative AI are 2 times more likely than those whose organisation has no policy to say they have already entered sensitive company information into a public AI tool, 67% against 33%. The survey does not allow us to conclude that the ban is the cause. At Projet Celsius, we think the useful rule concerns data more than the tool: an official tool, a clear list of what is never entered into it, training, and use that is measured.
Contents
Between February and May 2023, several large companies restricted their employees' use of ChatGPT, according to the press of the time: JPMorgan and Verizon in February, Samsung in May after source code was copied into it, Apple the same month. The reason is almost always the same: company data sent to an external service. More than 3 years later, the question arises in most organisations, with 2 possible answers: ban the tool, or regulate its use. We looked at what the surveys say before taking a position.
A large share of use escapes the employer
| Survey | Sample | Result |
|---|---|---|
| Microsoft and LinkedIn, 2024 | 31,000 knowledge workers, employees or self-employed, 31 countries | 78% of AI users at work bring their own tools; 52% are reluctant to say that they use it for their most important tasks |
| KPMG and the University of Melbourne, 2025 | 48,340 people, 47 countries | 48% of employees who use AI have entered sensitive company information into a public AI tool; 57% use it in a non-transparent way |
| Cisco, 2024 | 2,600 data protection professionals, 12 countries | 27% say that their organisation has banned generative AI, at least temporarily; 48% have entered non-public company information into it |
| Ipsos for Greenworking, 2025 | 1,000 private-sector employees, France | 55% of those who use AI tell their manager; 32% of employees systematically use only tools approved by their company |
Results reported by respondents, read from the authors' publications. Questions and audiences differ from one survey to another.
The figures cannot be compared with one another, but they point in the same direction. A significant share of employees use AI with tools that the company has not chosen, often without saying so, and a share enter data into them that should not leave. In France, according to Ipsos, 32% of employees surveyed systematically use only tools approved by their company.
Where AI is banned, sensitive data is entered into it more often
Share of employees who say they have already entered sensitive company information or protected content into a public AI tool, according to their organisation's policy (KPMG and the University of Melbourne, 2025):
The authors conclude that a pure ban may be ineffective, and that a written policy is not enough without training or suitable tools. This is a correlation: an organisation that bans AI may have more sensitive data, or employees who are more careful about what they report. It does not show that a ban pushes people to enter data into these tools, but it does not show either that it protects them from doing so.
The cost of use out of sight is measured on the security side. In IBM's annual study on data breaches, published in 2025, a breach costs on average 670,000 dollars more in organisations where the use of unauthorised AI tools is high, and 63% of the organisations affected had no AI governance policy or were still developing one.
French institutions regulate through data
French public organisations have made a different choice from a ban. The National Assembly's charter for its staff, circulated in October 2025, authorises AI tools for public data and prohibits them for internal data, except in a tool provided by its IT services; its authors gave up on a list of banned tools, judged very difficult to enforce. In a questionnaire of March 2026 sent to members of parliament and their staff, 85.4% of those who replied said they used AI, with a response rate of 20%.
The State's guide for its civil servants, from June 2026, follows the same rule: free commercial tools are used only for data that could be made public, and the State provides its own assistant. The European Parliament chose a stricter approach in February 2026, by disabling the AI features on its members' devices, as it could not guarantee the security of the data sent to the vendors.
In a company, the introduction of an AI tool may require consulting the works council (CSE) on new technologies; our charters guide details these obligations and how to write them.
The data protection objection
The strongest objection comes from occupations where a leak is costly: defence, health, industrial secrecy, personal data in large volumes. There, a ban is first of all a protection, and the European Parliament chose it for the AI features built into its members' devices. We consider it justified for these data. It then concerns what is entered and the devices, more than the tool: this is the logic of the French public charters, which prohibit internal data in consumer tools without banning AI.
Our position
At Projet Celsius, we think an organisation is better off regulating the use of AI than banning it, except for data that justify strict protection. The surveys do not prove that a ban aggravates hidden use; they show that it does not prevent it, and that use out of sight is costly when data leave. We recommend 4 elements: an official tool under a company contract, a short list of the data that are never entered into it, training, and a use that is counted.
None of the 16 published charters that we compared in our guide converts the use it regulates into electricity or emissions. This count assumes that use goes through tools known to the organisation. The "My AI footprint" tool and the AI Impact Database give the orders of magnitude per person and per occupation.
All the surveys cited rely on self-reported answers; they differ in their audience, their questions and their date. The gap of 67% against 33% in the KPMG survey concerns the entry of sensitive information into public AI tools; it is a correlation. The restrictions of 2023 at Samsung, Apple, JPMorgan and Verizon are known through the press, without any company document.
Sources
12 documents
- Microsoft and LinkedIn, 2024 Work Trend Index, AI at work is here, now comes the hard part2024entry 428
- KPMG and the University of Melbourne, Trust, attitudes and use of artificial intelligence: a global study 20252025entry 426
- Cisco, More than 1 in 4 organizations banned use of GenAI over privacy and data security risks, Data Privacy Benchmark Study 20242024entry 427
- Ipsos for Greenworking, les salariés et l'IA générative2025entry 429
- IBM, Cost of a Data Breach Report 2025, le volet sur l'IA2025entry 430
- Assemblée nationale, rapport du groupe de travail sur l'intelligence artificielle (Bonnet et Masseglia), 22 May 20262026entry 431
- DINUM, with the DITP and the DGAFP, Guide d'usage de l'IA pour les agents publics de l'État2026entry 203
- TechCrunch, European Parliament blocks AI on lawmakers' devices, citing security risks, 17 February 20262026entry 432
- Code du travail, Article L. 2312-8 (powers of the social and economic committee)2021entry 231
- IBM, press release of 30 July 2025 on the Cost of a Data Breach Report 20252025entry 433
- Semafor, The companies banning workers from using ChatGPT, 19 May 20232023entry 434
- Fortune, Apple, Goldman and others ban ChatGPT at work, 19 May 20232023entry 435
Every figure was read in its source; the hub's methodology is described in Methodology and sources.
AI Impact, Projet Celsius, "Should AI at work be banned or regulated?", 13 November 2026. https://projetcelsius.com/en/ai/analyses/should-ai-at-work-be-banned-or-regulated/
