Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Is it…

Should staff be allowed to use public generative AI tools, and on what terms?

8 decision pointsThe pack behind this answer: AI Security Governance & Acceptable Use

Add to board memo

The short answer

Recommendation
Allow public generative AI tools on terms, set by tool and by data level. Public information with no personal data may go into any tool outside the work account; anything more goes only into a tool on the approved list, up to the level it allows, signed in with the work account.
Reasoning
A blanket ban is likely to push use out of sight, so the useful questions are which data may go in and how people sign in. The pack answers with an approved list that gives each tool the highest data level it takes, and baseline conditions that rise with that level (AG-02, AG-03). Some uses are never allowed whichever tool is used, and special category data never goes into any AI tool. A free tool on a personal account never meets the baseline, so staff who need more than Public information need an approved tool.
Considerations
  • The practices Article 5 of the EU AI Act prohibits are never allowed. In the pack's checklist the first eight have applied since 2 February 2025 and the last two apply from 2 December 2026. Legal decides whether a use matches (AG-05).
  • Training on your data must be barred by a contract term for Internal and Confidential data. Where the tool also has a setting that stops training, keep it off and check it at each review as an added control; it never replaces the term (BC-2).
  • Personal data goes only into a tool approved for personal data, under processor terms, even inside Public information (BC-5).
  • The pack allows Public information in any tool. An organisation with a cautious appetite may choose to forbid even that, which the pack leaves to your policy.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartStaff ask to use a public generative AI tool for workDecisionDoes the use match a never-allowed practice, or might it?OutcomeStop. Tell Legal and do not startDecisionCould special category personal data go in?OutcomeStop. Change the use so that no such data goes inDecisionIs the tool on the list as Approved or Approved with conditions?DecisionIs the data within the level the list allows for this tool?DecisionCould any personal data go in or come out?DecisionIs the tool approved for personal data?OutcomeKeep that data out, or ask for a wider approvalStepUse it on the tool's termsOutcomeAllowed, with the tool's listed conditionsDecisionIs the only data going in Public information?StepAllow it for Public information, outside the work accountDecisionDoes someone rely on this tool as part of their regular work?OutcomeAllowed for Public information onlyStepPropose the tool through intake before anything above PublicOutcomeSend the proposal to the AI governance lead

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 18 steps.

  1. Start

    Staff ask to use a public generative AI tool for work

    Judgement: banning every tool is likely to push use out of sight, so the useful question is which data may go in and how people sign in. The pack answers by tool and by data level, in a policy that applies to any AI system used for work on any device or account. It is written for an organisation that uses other people's AI, which the Act calls a deployer, so nothing here assumes you build a model. Legal confirms the role.

    In the pack

  2. Decision

    Does the use match a never-allowed practice, or might it?

    Some uses are never allowed, whoever supplies the tool: the practices Article 5 of the EU AI Act prohibits (checklist PP-01 to PP-10, the last two applying from 2 December 2026), impersonating a person, getting round a security control, writing malware, and letting AI release a payment or change supplier bank details. If a person is unsure, the answer is yes and the use stops until Legal has looked. Legal decides whether a use matches. This flow only routes it.

    In the pack

  3. Outcome

    Stop. Tell Legal and do not start

    A use that matches a prohibited practice cannot be reworded into a permitted one. The AI governance lead tells Legal, and Legal decides whether anything further is needed. The Article 5 prohibitions take no exception.

    In the pack

  4. Decision

    Could special category personal data go in?

    Special category data is the GDPR Article 9 list: health, trade union membership, biometric data and the others. It never goes into any AI tool at any level, and the rule takes no exception. If you do not know what staff would paste, answer yes.

    In the pack

  5. Outcome

    Stop. Change the use so that no such data goes in

    Tell the requester at once what would have to change. A use that changes so that no special category data goes in is a new request. If such data has already gone into a tool, report it at once through the incident route and tell the Data Protection Officer the same day.

    In the pack

    See also

  6. Decision

    Is the tool on the list as Approved or Approved with conditions?

    The approved list names each tool, the highest data level it takes and its state. A tool with no row is not approved, and a row marked Not approved takes Public information only. An AI feature built into software you already use needs its own row. If you do not know, answer no.

    In the pack

  7. Decision

    Is the data within the level the list allows for this tool?

    Each tool is approved up to Public, Internal or Confidential. A collection, export or copy takes the highest level of anything in it, so a file with one Confidential item is Confidential. Customer and supplier material under a confidentiality agreement counts as Confidential. If you cannot say, answer no.

    In the pack

  8. Decision

    Could any personal data go in or come out?

    Names, contact details, staff or customer records and similar all count. Personal data goes only into a tool approved for personal data, under processor terms. A tool that is not approved for personal data takes none at any level.

    In the pack

  9. Decision

    Is the tool approved for personal data?

    The list records this for each tool. Approval needs processor terms in the contract (P06 clause CL-06), and the Data Protection Officer's advice is recorded for a Tier 2 use. If the list does not say, answer no and keep the personal data out.

    In the pack

  10. Outcome

    Keep that data out, or ask for a wider approval

    The tool may be used only with data inside its row. To use it with more, the use owner proposes the wider use through intake. It is screened and assessed at the tier its answers give, and nothing above the listed level goes in before the decision.

    In the pack

    See also

  11. Step

    Use it on the tool's terms

    The baseline conditions apply to the highest level the tool takes, and a tool approved only for Public carries none, apart from the rule on personal data (BC-5). They are: sign in with the work account through single sign-on (BC-1); a contract term barring training, with any vendor setting kept off and checked at each review as an added control, never a substitute (BC-2, ST-1); the tool and supplier in the inventory (BC-3); and for Confidential data the supplier's documented decision (BC-4). Staff also read the output before relying on it or sending it out, and follow any further condition on the tool's row.

    In the pack

  12. Outcome

    Allowed, with the tool's listed conditions

    The use may go ahead. Everyone with access completes the AI essentials module first, or within the period the plan sets for existing users. Review follows the tier's interval, and sooner if the purpose, the data, the audience or the supplier changes.

    In the pack

  13. Decision

    Is the only data going in Public information?

    Everything staff type, paste or upload counts as data put into the tool. Public means public information with no personal data in it, which the owner has approved for release to anyone. Unlabelled business information is treated as Internal. Personal data inside Public information still needs a tool approved for personal data, so a text that names people does not qualify here (AG-02, AG-03, BC-5). If the person cannot say it is all Public, answer no.

    In the pack

  14. Step

    Allow it for Public information, outside the work account

    The pack allows Public information in any tool, but never through a work account and never under the organisation's name. Staff still read the output before relying on it or publishing it. This does not approve the tool. Judgement: an organisation with a cautious appetite may choose to forbid even this, which the pack leaves to your policy.

    In the pack

  15. Decision

    Does someone rely on this tool as part of their regular work?

    People who have an approved tool stop using the free one, and a one-off can turn into a habit with Internal data in it. Judgement: a tool that people rely on suggests the list is missing something, occasional use of Public information needs no proposal, and regular use does. The pack does not draw this line, so your policy may draw it elsewhere.

    In the pack

  16. Outcome

    Allowed for Public information only

    The use stays inside the Public rule (AG-02), which does not depend on the approved list. If the data ever rises above Public, or the use becomes regular, the answer changes and the use goes through intake first.

    In the pack

  17. Step

    Propose the tool through intake before anything above Public

    The AI use owner answers the twelve intake questions. The AI governance lead screens a complete request within 5 working days by default and sets the tier. Tier 1 is a screen. Tier 2 adds an assessment, and the supplier is assessed under the third-party pack before Internal or Confidential data goes in, and before any Tier 2 or 3 use even with Public data (H-1, AG-11).

    In the pack

  18. Outcome

    Send the proposal to the AI governance lead

    Until the decision is made, staff use only the tools on the list, or Public information alone. Say in the proposal what staff need from the tool, because an approved tool that meets the need is what ends use of the free one. If the vendor may train on your data, what you require comes next.

    In the pack

    See also

Practical checklist

  1. Stop any use that matches, or might match, a never-allowed practice, and tell Legal.
  2. Stop any use that could put special category personal data into the tool.
  3. Check the tool's row on the approved list; a tool with no row is not approved.
  4. Check the data is within the level the list allows, counting a collection or export at the highest level of anything in it.
  5. Check the tool is approved for personal data before any goes in or comes out.
  6. Apply the tool's conditions: work account through single sign-on, the training bar, and any condition on its row.
  7. Send regular use, or any need above Public, to intake through the AI governance lead before the data goes in.
  8. Make sure staff read the output before relying on it or sending it out.

Evidence to have ready

  • The approved list of tools with the highest data level each takes and whether it is approved for personal data.
  • Single sign-on records showing each approved tool connected to the work account.
  • The contract term barring training, and where the tool has a setting that stops training, the check at each review that it is off.
  • The intake decision for each tool, dated before the use began.
  • For each unapproved use found, the date found, the date stopped and the tool it moved to.

Assumptions

  • You classify information in three levels (Public, Internal, Confidential), or can map your own levels onto them.
  • You keep, or will keep, an approved list of AI tools with the highest data level each takes. A tool with no row is not approved.
  • The figures shown, such as 5 working days to screen a request, are the pack's defaults. Your own policy may set different ones.
  • You use other people's AI. Building on a supplier's model API counts as building. If you would build or supply AI, Legal decides your role first.

Not covered here