The short answer
You can use ChatGPT at work if three things are true: your employer permits it, the information you put in is suitable for the tool and the account you are using, and you check the output before you rely on it. Those are three separate questions, and most trouble comes from answering only the first.
If your workplace has an AI policy or an approved tool, follow it. If it has neither, which is still common, the absence of a rule is not permission to paste anything. New Zealand's Privacy Commissioner says not to put personal or confidential information into a generative AI tool unless the provider has explicitly confirmed it is not retained or disclosed, and the same advice comes from regulators in Australia and the United Kingdom.156
The account matters as much as the tool. Consumer ChatGPT may use your conversations to train models unless you opt out; business and enterprise versions do not by default.22 Below is how to work through each question, and a checklist to run before you paste anything.
Four different questions hiding inside one
"Can I use ChatGPT at work?" sounds like a yes-or-no question. It is actually at least four, and they have different answers.
Stay Useful framework
The four gates: possible, permitted, appropriate, safe
A Stay Useful framework, drawn from the regulator and professional-body guidance cited in this guide. Work through the gates in order. Passing one does not pass the next.
Technically possible
Can you open the tool on your device and network? This is the only question most people check, and it is the least important. A tool that is not blocked has not been approved.
Permitted
Does your employer allow it? Look at the AI or acceptable-use policy, the approved-tools list, your employment agreement, and any confidentiality or client agreements that bind you. If you are in a regulated profession, your professional body has a view too.
Appropriate
Would the people affected be comfortable if they knew? Is it honest to present the result as your own work? Does a client, patient or colleague have a reasonable expectation that a person, not a tool, did this?
Safe and responsible
What happens to the information you enter? Is the output accurate enough for what you are about to do with it? Who is accountable if it is wrong? These depend on the provider, the product, the settings, and what you are doing with the result.
Gate two: is it permitted where you work?
Start with the written rules, because they exist more often than people think, and are absent more often than employers think.
Where to look
- An AI use policy or acceptable-use policy. Many organisations added one in 2024 or 2025. In a 2026 survey of over 300 United States employers, 68 percent reported a formal AI policy, up from 38 percent the year before; 55 percent had a review process for AI tools and 54 percent restricted what information could be entered.15
- An approved-tools list. Some employers permit a specific product, such as a Microsoft Copilot or ChatGPT Enterprise licence, and prohibit others. Using the approved tool on a personal account is usually not what they meant.
- Your employment agreement and any confidentiality clauses. These rarely mention AI by name. They do cover disclosing confidential information to third parties, which is what pasting into an external service is.
- Client, customer or funding agreements. If you work on someone else's information under contract, their terms may restrict where it can go, regardless of your own employer's view.
- Your professional body. Lawyers, doctors, accountants, teachers and public servants in New Zealand each have published guidance, covered below.
If there is no policy
Many workplaces still have nothing written down. In Gallup's May 2024 survey of over 21,000 United States employees, 70 percent said their organisation had no guidance or policy for using AI at work.16 In the 2025 KPMG and University of Melbourne study of 48,000 people in 47 countries, only 40 percent of employees said their workplace had a policy or guidance on generative AI.9 Meanwhile almost half of employees admitted using AI in ways that went against company policy, including uploading sensitive company information into free public tools.9
No policy is not a green light. It means the decision has been left to you, and you will own the consequences. The practical move is to ask, in writing, before using AI on work material: "Is there an approved tool, and what am I allowed to put into it?" A one-line email to your manager or IT team creates a record that you asked, and it often prompts the organisation to write the rule it should have had. Where to start when your boss wants you to use AI has a short message you can adapt for exactly that email. If you are a manager, the same evidence says your team is already using these tools; a short written position, even an interim one, is better than silence.
Which account are you actually using?
Whether you are "allowed" often turns on a detail people overlook: the difference between a consumer account and a business account on the same product. They look the same in the browser. They are governed by different terms, and the data is treated differently.
| Provider | Consumer account | Business or work account | Where we read it |
|---|---|---|---|
| OpenAI (ChatGPT) | OpenAI says ChatGPT "improves by further training on the conversations people have with it, unless you opt out". You can opt out in Data Controls, or use a Temporary Chat. | "By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Business, ChatGPT Enterprise, and the API." Workspace administrators control retention. | OpenAI help centre article on how data is used to improve model performance.22 |
| Anthropic (Claude) | Consumer terms: Anthropic may use your content to train models "unless you opt out of training through your account settings". | Commercial terms: "Anthropic may not train models on Customer Content from Services." The customer retains rights to inputs and owns outputs. | Anthropic consumer terms and commercial terms.23 |
| Microsoft (Copilot) | Microsoft's privacy FAQ says it uses data from Copilot and other consumer services for AI training except for certain categories of users and those who opt out. | Users signed in with an organisational (Entra ID) account are excluded from training, and prompts and responses are covered by enterprise data protection. | Microsoft privacy FAQ and enterprise data protection documentation.24 |
| Google (Gemini) | Google asks consumers: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services." A subset of chats is read by human reviewers. | For Google Workspace: "Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission." | Gemini Apps Privacy Hub and the Workspace generative AI privacy hub.25 |
Two consequences follow. First, the same task can be fine on your employer's enterprise account and a policy breach on your personal one. Second, an account is not private just because you created it. OpenAI's terms of use state that if you create an account with an email address owned by an organisation, such as your employer, the account may be added to that organisation's business account, and its administrator "will be able to control your account, including being able to access Content".21
Our companion guide on what happens to the data you enter into AI tools goes through each provider's retention, training and review practices in detail, including temporary chats and what a court order did to deletion promises in 2025.
Gate three: is it appropriate?
A surprising amount of the anxiety around "am I allowed" is not about rules at all. It is about whether using the tool feels like cheating. In Slack's survey of over 17,000 desk workers in late 2024, 48 percent said they would be uncomfortable admitting AI use to their manager. The reasons were feeling it was cheating (47 percent), fear of being seen as less competent (46 percent) and fear of being seen as lazy (46 percent). Only 21 percent cited company policy.10 Microsoft's 2024 survey of 31,000 knowledge workers found 52 percent of AI users reluctant to admit using it for their most important tasks.8
The honest answer is that using AI for work is no more cheating than using a spreadsheet, with one important condition: you do not misrepresent what happened. The KPMG study found 57 percent of employees said they hide their AI use and present AI-generated work as their own.9 That is where appropriateness breaks down, for two reasons. OpenAI's own terms prohibit representing output as human-generated when it was not.21 And professional bodies increasingly expect disclosure: the New Zealand Law Society tells lawyers to communicate to clients when and how AI tools are used in their matters where appropriate,18 and the Medical Council of New Zealand requires informed consent when, for example, an AI tool records a consultation.19
A workable rule: use AI openly for drafting, summarising and analysis, say so when asked or when it matters to the recipient, and never let a tool's output stand in for a judgment you were paid to make.
Gate four: is it safe and responsible?
This is where the legal and commercial exposure sits. Three categories of information deserve particular care, and one habit protects you across all of them.
Personal information
In New Zealand, the Privacy Act 2020 applies to you, not only to your employer. The Office of the Privacy Commissioner's guidance says the Act "applies to business, government, and community organisations of all sizes, as well as to individuals" and that "privacy law applies to the use of AI tools".2 Its specific expectation for generative AI is direct: "Do not input into a generative AI tool personal or confidential information, unless it has been explicitly confirmed that inputted information is not retained or disclosed by the tool provider."1 Where you are unsure, its advice is simpler still: "If in doubt, we recommend you do not use AI tools to handle personal information."2
The Commissioner also notes that sending information to an overseas provider to store or process it is not treated as an offshore disclosure so long as the provider does not use it for its own purposes, and tells you to check exactly that in the provider's terms.2 Training on your inputs is a use for the provider's own purposes.
The same position holds elsewhere. Australia's Office of the Australian Information Commissioner recommends that organisations "do not enter personal information, and particularly sensitive information, into publicly available generative AI tools".5 The United Kingdom government's AI Playbook tells staff to follow organisation-specific policies, especially on security and data handling, and to have humans validate high-risk decisions.6
Confidential and commercial information
New Zealand's Ministry of Business, Innovation and Employment warns that some generative AI tools, particularly free or public ones, "may share prompt data (including attachments) with external parties", and that information in prompts "could be exposed in future through a security breach or the model itself". It adds that anonymising is not a complete defence, because depersonalised information "could be joined up with other information over time to re-identify someone".3 The government's guidance to its own public servants is blunter: "Ensure sensitive or classified information is not entered in public GenAI tools."4
The best-known cautionary case is Samsung, which in 2023 temporarily restricted generative AI on company devices after engineers uploaded internal source code to ChatGPT.11 Source code, unreleased financials, contracts, client lists and anything under a non-disclosure agreement belong in this category.
Accuracy, and who is accountable for it
The tool's output is your responsibility the moment you use it. OpenAI's terms say output "may not always be accurate", that you "must evaluate Output for accuracy and appropriateness for your use case, including using human review as appropriate", and that you must not use output about a person for decisions with legal or material effect on them, such as employment, credit, medical or legal decisions.21 The Privacy Commissioner puts it in the language of the accuracy principle: generative tools "produce confident errors of fact and logic", and simply having a human in the loop "may not be enough" given the well-known problem of automation blindness.2
Courts have made the point expensively. In Mata v. Avianca, a United States federal judge fined lawyers who filed fabricated case citations produced by ChatGPT and then stood by them, writing that "there is nothing inherently improper about using a reliable artificial intelligence tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings."12 New Zealand's courts issued guidelines in December 2023 reminding lawyers that existing professional obligations apply to these tools,13 and in February 2026 the Supreme Court, dismissing an application by a self-represented litigant who had cited hallucinated authorities, warned that reliance on the unverified outputs of AI applications may in serious cases amount to obstruction of justice or contempt of court.14 In Australia, lawyers have been referred to regulators and ordered to pay costs over AI-generated citations that did not exist.27
You do not have to be a lawyer for this to apply. Any figure, quote, citation, date or name that an AI produced needs checking against a source before it goes into anything with your name on it. Our guide on how to use AI at work builds that review step into every workflow.
If you work in a regulated environment
Professional duties do not shrink because a tool did the drafting. New Zealand bodies have said so explicitly.
- Lawyers. The New Zealand Law Society's generative AI guidance states that "a lawyer is not absolved from responsibility for legal advice or defects in an end-product (such as a contract) because it is derived from Gen AI", tells lawyers not to use personal or client information for testing or creating templates, and expects fact-checking of outputs and citations.18
- Doctors. The Medical Council of New Zealand's March 2026 guidance: "AI is not a substitute for your clinical judgement, and you remain responsible for all your clinical decisions and actions." If a tool is not approved by your employer or professional body, you must take reasonable steps to assure yourself it is safe and suitable, and it must not share patient-identifiable information outside the care setting.19
- Teachers. The Ministry of Education's guidance: "Don't use personal data when you use AI tools, what you put in may be reused", "Never send any AI tool the personal information of anyone under the age of 13", and always review and check the outputs.20
- Public servants. The Government Chief Digital Officer's guidance requires that generative AI systems be certified and accredited before staff use them, that sensitive or classified information never be entered into public tools, and that staff receive training on acceptable use.4
- Working with the European Union. Since 2 February 2025 the EU AI Act has required providers and deployers of AI systems to ensure "a sufficient level of AI literacy of their staff", which is one reason multinational employers have been rolling out training and policies.7
This guide is general information, not legal advice. Employment law, privacy law and professional rules differ by country and by profession, and your own agreements may impose stricter limits than any regulator.
Before you paste anything into an AI tool
Run through this each time the information or the task changes. After a few weeks it takes seconds.
- I know whether my organisation has an AI policy, an approved tool, or restrictions on what can be entered. If there is nothing written, I have asked my manager or IT in writing.315
- I know which account I am in: a consumer account that may train on my content, or a business account that does not by default.222324
- If I must use a consumer tool, I have turned off model training in the settings or am using a temporary chat, and I understand that this reduces retention rather than eliminating it.22
- There is no personal information about customers, colleagues, patients, students or members of the public in what I am about to enter, unless the provider has confirmed it is not retained or disclosed.15
- I have not assumed that removing names is enough. Details can be recombined to identify someone.3
- There is no confidential business information, source code, contract text, unreleased financial data or anything under a non-disclosure agreement in a public tool.3411
- I have read what the provider says about storing prompts, using them for training, and human review, and I know what its terms say about who owns the output.221
- If I signed up with my work email, I assume my employer can gain control of the account and see the content.21
- I will treat the output as a draft and verify facts, figures, citations and quotes against a primary source before relying on them or sharing them.21221
- I will not use AI output about a person to make or shape a decision with legal or material effect on them without a real human review.121
- I will not present AI output as entirely my own where that would mislead the recipient, and I will disclose AI use where my profession expects it.181921
- If I am in a regulated profession, I have read my professional body's AI guidance and I understand that my duties are unchanged.181920
- If the tool is collecting personal information about someone from a source other than that person, I know that New Zealand's new IPP 3A (in force since 1 May 2026) requires reasonable steps to tell them.26
- For any significant piece of work, I have noted what I used AI for, so I can answer "how was this produced" later.19
What to do when your workplace has no rules yet
If you are the person who notices the gap, you are well placed to close it. A short interim position covering the following is more useful than a long policy nobody reads, and the New Zealand government's guidance for businesses lists usage policies as a primary way to "communicate to staff what tools are endorsed, and how they can be used".3
- Which tools and which accounts are approved, and which are not.
- What may never be entered: personal information, confidential material, credentials, client data.
- The expectation that a person checks every output before it is relied on, and how that is recorded for significant work.
- When AI use should be disclosed to clients, customers or colleagues.
- Who to ask when a case is not covered.
Regulators and governments in New Zealand, Australia and the United Kingdom converge on the same four moves: approved tools, no personal or sensitive information in public tools, a human check before acting, and training for staff.1456 A one-page policy that says those four things is a defensible start.
Related questions
Can my employer see if I use ChatGPT?
It depends on how you use it. On an employer-managed device or network, activity can be logged in the same way as any other web use, subject to your employer's monitoring policy and local law. If you signed up to ChatGPT with your work email address, OpenAI's terms say the account may be added to your organisation's business account, whose administrator can control it and access its content.21 On an approved enterprise tool, assume administrators can see usage. On a personal account on a personal device, your employer cannot see the conversations themselves, but can still see the result if AI-produced work is presented as yours and turns out to be wrong.
Can I get fired for using ChatGPT at work?
Potentially, if your use breaches a policy, a confidentiality obligation or a professional duty, or if you rely on inaccurate output in a way that causes harm. The specifics depend on your employment agreement and your country's employment law, which is why this guide cannot answer it for you. What the evidence shows is that the risk sits in the information you enter and the accuracy of what you rely on, not in the fact of using a tool. Where there is no policy, the safest course is to ask for one.
Is it cheating to use ChatGPT at work?
Using a tool is not cheating. Misrepresenting what happened can be. Nearly half of desk workers in Slack's 2024 survey felt AI use was cheating,10 but the professional bodies that have addressed this focus on disclosure and accountability, not abstinence. Use it openly, check the result, and do not claim a judgment you did not make.
Do I have to tell my boss I use AI?
If your policy requires it, yes. If your profession expects disclosure to clients or patients, yes for those cases.1819 Otherwise it is a judgment call, and the evidence suggests transparency costs less than people fear: in the New Zealand survey above, 93 percent of workers using generative AI said they were transparent with their manager.17 Being the person who can explain how a tool improved your work is a stronger position than being the person who hid it.
Who owns what ChatGPT writes for me?
OpenAI's and Anthropic's terms both assign to the user whatever rights the provider has in the output.2123 But most employment agreements assign work you produce in the course of employment to your employer, and copyright in AI-generated material is unsettled in many countries. Treat the output as work product belonging to your employer, and do not assume it is protectable.
What if my employer requires me to use AI?
Then the permission question is answered and the other three gates matter more. Ask which account and tool, what may be entered, and how output should be checked and recorded. A requirement to use AI does not transfer accountability for errors away from you unless the organisation says so in writing.