Someone on your team got noticeably faster this year and you were glad about it. Maybe you started it, asking people to find something AI could take off their plate. A few of them did.
That part worked, and it is where the problem comes from. It has nothing to do with the people who took you up on it.
What nobody wrote down is which account the work happened in. Not which tool. Which account.
What is sitting in there now
Go through what a capable person pasted in this year doing the job you asked for.
The draft reply to a customer threatening to leave. An unsigned contract, so somebody could get the renewal terms explained. Next year’s compensation bands, reformatted.
Each of those went through a service your organization has no agreement with. The account belongs to the person, and its settings are whatever they were the day it was opened. If they leave in March, the history goes with them, and there is no export to request because there is no contract.
The paid version is a different agreement
Most leaders assume the company plan is the same product with more seats and an invoice. On the terms that matter it is a different agreement, and the difference is published. I read these on 25 September 2026. They get revised, so check the current version, not any summary including this one.
OpenAI. On the individual plans, OpenAI’s page on data and model training says “we may use your content to train our models,” turned off by a setting called Improve the model for everyone, under Settings then Data controls. On the business side the same page says: “By default, we don’t use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models.”
Anthropic. Read this one twice, because its own documents describe the same setting in opposite directions. The help centre article says chats are used for training if “you choose to allow us to use your chats and coding sessions to improve Claude.” The Consumer Privacy Policy says “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings.” Unless you opt out is not the same instruction as if you choose to allow. The toggle does exist, called Help Improve our AI models under Settings then Privacy, and switching it off does not close the two routes that sentence names: conversations flagged for safety review, which “may still be used to improve our internal trust and safety models,” and anything sent back through the feedback button. Left on, the retention page says data may be kept de-identified “for up to 5 years in our model training pipelines.” The commercial policy sets the default the other way: “By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.” That page carries the feedback exception too. To find out which description governed your team’s accounts, you would have to sit down at each one.
Google. The consumer Gemini Apps Privacy Hub says human reviewers see some of what is collected, then says: “Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services, including machine-learning technologies.” Chats that have been through human review are kept for up to three years and are not deleted when the user deletes their activity. The Workspace commitment takes the opposite position for business editions: content “is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.”
The business plan usually runs the same model. What it adds is an agreement in your company’s name and an administrator with real access: OpenAI says ChatGPT Business workspace admins “can view, access, export, and delete end user conversations in the workspace,” and control how long data is kept.
Be exact about the ceiling. Business does not include the Compliance API, what a security team uses to pull conversation records into an eDiscovery, DLP or SIEM system, which is Enterprise and Edu only. Somebody can go and look. Nothing arrives in a security tool on its own.
The two things leaders reach for
The first is a ban. I wrote about where that goes: the usage does not stop, it moves onto personal equipment, and the refusal only decides whether you hear about it.
The second is a policy document. Somebody drafts an acceptable use policy, it goes round for comment, people acknowledge it in the HR system, and nothing changes. Nobody opens it at the moment it would matter, which is a person with a deadline and a document already on screen. An AI governance checklist has the same problem if it lives in a folder.
The year that already happened
Some of this is already decided, and you can read it off the pages above. If a year of work went through a personal Gemini account, Google’s position is that human reviewers see some of what goes in, and that reviewed chats are kept for up to three years. Deleting the activity now does not pull those back.
What you cannot settle is which way that setting was pointing. Anthropic’s pages describe it both ways, and it sits inside an account you have no right to open.
The operational fix is not complicated and I have written it out elsewhere: a company account for what people do, somebody keeping the list, rules short enough to remember.
A business plan changes one thing that matters here. Somebody on your side administers the account, so the terms covering it are a matter of record rather than of who opened it. For the accounts your work went through this year, there are as many answers as there are accounts, and you hold none of them.
Frequently Asked Questions
Is a personal ChatGPT or Claude account really a problem if the person is careful?
The issue is not carefulness. A personal account is owned by the person, not the organization, so the agreement covering that material is between the vendor and your employee. Nobody on your side chose the retention setting or the training setting, nobody can audit what went in, and when that person leaves, the account and its history go with them.
Do we need an AI committee or an AI governance checklist for this?
Not for this. An AI committee makes sense once you have several functions running real systems and the decisions start conflicting. The problem here is smaller: nobody owns the list of accounts. Give that list to one named person and you have covered most of it, which takes an afternoon rather than a quarter.
How do I find out which AI tools my team is already using?
Two routes, and they catch different things. Expense claims and card statements show you the paid subscriptions, including ones people started paying for themselves and claimed back later, and you can check those today without telling anyone. They will not show you the free accounts, which is where most of this sits, and the only way to get those is to ask people directly and say first that nobody is in trouble for answering. An audit gets you neither, because it tells people they are in trouble before they answer.
Does a paid business plan mean the vendor never sees our data?
No. It means the published default changes: OpenAI, Anthropic and Google all state that content from their business and enterprise products is not used to train their models by default, and an administrator on your side controls access. Retention control varies: OpenAI Business and Google Workspace admins set it, while on Claude it is an Enterprise-plan feature. The feedback rules differ by vendor, so check the one you are buying. Google says in-product feedback from Workspace users is not used to train the models behind its Workspace AI services. OpenAI uses business data for training only where an organization has explicitly opted in, for example through its feedback mechanisms. Anthropic is the one to watch: on commercial plans a thumbs up or down means the whole conversation may be used for training, and an owner has to switch that off with the Rate chats setting. All three still process content to deliver the service.