Section 1/6Why the account is what matters
Shadow AI: staff already use AI, but whose account?
The risk usually lies in the account, not in the use of AI itself. What the terms say for ChatGPT, Claude and Copilot, and four steps to take control.
According to Swedes and the Internet 2026 (opens in a new tab), 7 out of 10 white-collar workers in Sweden use AI. The next question for a business is which tools and accounts its team uses at work, and what information people share with them.
Shadow AI means using AI tools outside the company's approved ways of working. One example is pasting a customer email into a personal account without the business having reviewed the terms. Start by finding out what people use, then give the team clear rules and approved accounts.
Why the account is what matters
The guidance from IMY, the Swedish Authority for Privacy Protection, on GDPR when using generative AI (opens in a new tab) (in Swedish) is written for the public sector, but the reasoning rests on GDPR and applies just as much to a private company. When a company uses an AI service, the vendor is by default a data processor, which requires a data processing agreement. That only holds as long as the vendor does not use the data for a purpose of its own, such as further training its base model. If it does, it becomes a controller in its own right for that processing.
That is where the accounts differ. OpenAI states (opens in a new tab) that content in Free, Plus and Pro may be used to train its models unless the user turns this off under Data controls. Content in ChatGPT Business and Enterprise is not used for this by default. Anthropic (opens in a new tab) draws the same line: the consumer plans Free, Pro and Max come with a training choice, while Team, Enterprise and the API fall under commercial terms where training does not apply.
When a salesperson pastes a customer contract into a personal account, there is no agreement between the company and the vendor, and the text may be used for the vendor's own purposes. According to IMY, the company is also generally responsible for unexpected ways in which the AI service processes personal data.
Account by account: what the terms say
| Account | Is the content used for training? | Agreement with the company |
|---|---|---|
| ChatGPT Free, Plus, Pro | Yes, unless the user turns it off | No, the account belongs to the person |
| ChatGPT Business, Enterprise | No, by default | Yes, the company is the customer |
| Claude Free, Pro, Max | If the user has chosen it | No, the account belongs to the person |
| Claude Team, Enterprise | No, commercial terms | Yes, the company is the customer |
| Microsoft Copilot (formerly Microsoft 365 Copilot) and Copilot Chat with a work account | No, according to Microsoft (opens in a new tab) | Yes, covered by Microsoft's Data Protection Addendum |
The details come from the vendors' own pages and were checked in October 2026. Terms change, so they need checking again with every new agreement. A company already on Microsoft 365 should check what its licences include before buying anything new.
Shadow AI is a sign that staff want to work smarter. Give them an account that is fit for the job.
Banning shadow AI only moves the problem
When 7 out of 10 white-collar workers already use AI, a ban does not make the need go away. The use moves to phones and personal accounts, where the company sees even less. What works is a better alternative: an approved tool that is just as easy to use.
Swedes and the Internet 2026 (opens in a new tab) also shows that only half of Swedes feel AI makes them more productive. That is an argument for training, which is already a legal requirement. The EU AI Act (opens in a new tab) has required AI literacy (opens in a new tab) since 2 February 2025. After the EU's digital omnibus, Regulation (EU) 2026/1744 (opens in a new tab), the requirement is softer: companies must take measures that support their staff's AI literacy. A short policy and a session built on the company's own examples go a long way towards showing that.
How to take control in four steps
Map what is being used. Ask staff, preferably anonymously, which AI tools they use and for what. The answers show where the need is, and it is rarely where management thinks.
Choose a business account. Start from what the company already has. If that is not enough, choose a business plan and sign the data processing agreement before anyone starts.
Write three rules, not twelve: which account to use; what must never be pasted in, such as personal identity numbers, health data and payroll files, and that only what the task needs goes in, in line with the data minimisation principle IMY points to; and that a person reviews everything that goes to a customer.
Train and follow up. One hour with real examples from the company's daily work, and the same survey again after a month.
Next step: AI that works with the company's own systems
A business account solves the immediate risk. The bigger value comes when AI can work with the company's own information in a controlled way: answering from internal documents, summarising cases in the CRM or writing the first draft of a quote. That takes permissions, logging and reliable integrations, and that is what we build in our AI & agents service.
Frequently asked questions
Is it illegal to use ChatGPT at work?
No. What matters is which data is used and in which account. With a business plan and a data processing agreement, most companies can use AI assistants in daily work. Personal data in personal accounts is what causes problems.
Is it enough to turn off training in a personal account?
It reduces one risk, but does not remove it: according to OpenAI, giving a thumbs up or down can make the whole conversation available for training, even after training has been turned off. The company also has no agreement with the vendor and no control over the account, for example when someone leaves. A business account solves all three.
Does the company need an AI policy?
The EU AI Act does not require a document by that name, but it does require measures that support staff AI literacy. A short policy with three rules and a training session is the simplest way to show they exist.
Can NOD³ help choose AI tools?
Yes. We start from the systems the company already has, compare the options and set up the account, the rules and the training.
What would you like to improve?
Tell us about your situation and what you want to achieve. One of our founders will reply within two working days and help you identify a first step. The first conversation is free and there is no obligation to proceed.
What happens next?
- We review your inquiryWe read your inquiry and reply within two working days.
- We clarify the next stepWe ask follow-up questions or suggest a first conversation.
- You decide whether to proceedIf we can help, you receive a proposal for the next step with a defined scope and price.