Shadow AI Policy: Should You Block ChatGPT and Claude?
Sweden's Government Offices are blocking ChatGPT and Claude for an approved tool. What shadow AI is, why blocks get bypassed, and an AI policy that works.
Short answer: a block alone rarely works. People switch to phones, personal accounts, and tools you can't see — that's shadow AI. What works better: block or discourage consumer accounts, give staff an approved tool under a business contract that doesn't train on your data, and make the approved path easier than the workaround. Then write the rules down in a one-page policy.
Sweden's Government Offices (Regeringskansliet) just ran this exact play. It's a useful template for any small team deciding between banning AI and pretending the topic doesn't exist.
What Sweden just did
Starting Monday, Oct 26, 2026, ChatGPT and Claude will no longer be reachable from staff computers at Sweden's Government Offices, Sveriges Radio's Ekot reported on Oct 23. According to Ekot:
- The block exists so staff use services the Government Offices have approved — including Microsoft's Copilot.
- Digitalisation director Mikael Wettercrantz declined an interview, but on the intranet he said that using AI services without an agreement can have "consequences for our information security" ("konsekvenser för vår informationssäkerhet") — quote translated by Tacavar.
- Ekot's survey found blocks also in place at Skatteverket (the Swedish Tax Agency) and Statens institutionsstyrelse (SiS), while Kronofogden (the Enforcement Authority) is preparing a position.
- Trafikverket (the Transport Administration) is the cautionary example: its internal audit earlier this year found widespread, risky use of about ten different AI services, and wrote — translated by Tacavar — that it had seen "several examples of problematic use of open AI services", concerning both the sensitivity of the information entered and how AI-generated answers were handled.
- The Government Offices had already restricted DeepSeek.
- And here's the detail most coverage skips: some staff keep access to ChatGPT and Claude through a separate AI-assistant platform the Government Offices built themselves.
After the block was announced, Hacker News readers debated whether Copilot was chosen mainly because it rides existing Microsoft 365 licences and already-signed data-processing terms. That's opinion, not reporting — but it's the same objection your own staff will raise, so it's worth answering (see the contracts section below).
One more note worth flagging: Ekot also reported that after a review, the Government Offices raised security in Copilot itself, per internal information Ekot has seen. The press office wouldn't detail the change, citing security. "Approved" is not a one-time stamp; tools get reviewed.
What is shadow AI?
Shadow AI is staff using AI tools the company hasn't approved or contracted for. It's the AI-era version of shadow IT: the tool isn't malicious, but it sits outside your contracts, your logging, and your data controls. Nobody agreed terms with the vendor, so nobody knows what happens to what employees paste in.
Trafikverket's audit is the cleanest public example. Roughly ten different AI services in daily use, sensitive information going in, AI-generated answers being acted on without review — all discovered by internal audit, after the fact. That's the typical shape: shadow AI doesn't show up in a ticket queue; it shows up in an audit.
(No, we won't quote a "% of employees use unauthorized AI" statistic. Most of the numbers circulating are vendor surveys with soft methodology. If a stat can't survive a footnote, it doesn't belong in your policy memo either.)
Block vs approve: the actual decision
Most organizations land on one of three postures:
| Posture | Risk | Cost | Likely bypass | When it fits |
|---|---|---|---|---|
| Ban all AI | Staff lose a real productivity tool; policy is widely ignored | Low to write, high to enforce | Very high — phones, home devices, personal accounts | Rarely, and only where regulation genuinely forbids AI processing |
| Block consumer apps + provide an approved tool | Low — contracted vendor, logged usage | Medium — licences plus admin work | Moderate — drops sharply once the approved tool is good | Most SMBs and teams. Tacavar's recommendation, labelled as such |
| Allow with policy only, no tool provided | Higher than it looks — the policy has no teeth and no logging | Lowest upfront | Near-total — nothing changes except the paperwork | Teams with genuinely no sensitive data in AI conversations |
The middle option is what Sweden did, scaled down: block the uncontracted front doors, provide an approved tool, keep a controlled exception path.
What "approved" has to mean: contracts and data terms
Sweden's stated rationale is the whole lesson compressed into two words: "without an agreement." The contract is the control. When you approve a tool, you're not blessing a chatbot — you're signing terms that say what the vendor may do with your data.
A checklist for what an approved AI tool needs:
- A business/enterprise plan, not personal accounts
- No training on your inputs by default
- A DPA with the vendor acting as data processor
- Defined retention and audit logs
- SSO and admin controls so access is grantable and revocable
- Clarity on where data is processed
- A BAA if you touch health data (see our HIPAA compliance checklist for AI startups)
Here's what the major vendors actually say, in their own words:
Microsoft, on enterprise data protection in Microsoft Copilot and Copilot Chat (fetched Oct 25, 2026):
The use of Microsoft Copilot and Microsoft Copilot Chat, as used by organizations, is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor.
Consistent with our other Copilot offers, the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models.
Read the caveats on the same page too: web queries to the Bing search service sit under different terms where Microsoft acts as an independent data controller, and Anthropic models are currently excluded from the EU Data Boundary. Controls also "vary depending on the underlying subscription plan" — the contract you get depends on the licence you buy.
Anthropic, on whether your data is used for model training (fetched Oct 25, 2026):
By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.
The same page notes that explicit feedback (thumbs up/down) stores the conversation for up to five years, and Team/Enterprise owners can turn feedback submission off. Anthropic's Commercial Terms are here — link, not a substitute for reading them for your own deployment: anthropic.com/legal/commercial-terms.
OpenAI, on enterprise privacy (fetched Oct 25, 2026):
We do not train our models on your data by default
and, from the FAQ on the same page:
By default, we do not use your business data for training our models. If you have explicitly opted in to share your data with us (for example, through our opt-in feedback mechanisms) to improve our services, then we may use the shared data to train our models.
These commitments apply to ChatGPT Business, Enterprise and the API Platform — not the free consumer app. Same page: SAML SSO, access controls, and retention control sit on the enterprise plans.
Note the pattern across all three: the default is no training on commercial-plan data, but the consumer front door is a different product with different terms. Which contract your account sits under matters more than which logo is on it. That's Tacavar's analysis — the vendors' pages say what they say; the "same model, different contract" framing is ours.
If you want a framework for organizing these reviews rather than a checklist alone, NIST's AI Risk Management Framework is a reasonable reference point — we're linking it, not summarizing it beyond what the page says.
Why blocks get bypassed (and what to do about each)
If you've ever blocked a website and found employees on their phones a week later, you already understand this section. Each bypass has a specific countermeasure:
Personal phones and home laptops. Network blocks don't reach devices you don't manage. Countermeasure: policy plus an approved tool available on mobile, so the legitimate path is as convenient as the illegitimate one.
Personal accounts in the browser on work machines. Blocking chatgpt.com by URL misses new domains, mirrors, and API wrappers. Countermeasure: block by category at DNS or a secure web gateway, not a one-off URL list.
Browser extensions and AI features inside other SaaS. Writing helpers, meeting note-takers, and CRM "AI assistants" are shadow AI wearing a suit. Countermeasure: an extension allowlist and a review step for new SaaS apps — the AI feature inside an approved app is part of the approval.
Personal API keys pasted into scripts, IDEs, and agents. A developer's personal API key in a codebase bypasses every contract your company signed, and leaked keys are an incident of their own. See how AI API keys leak and how to rotate them, and our writeup of the LiteLLM 1.107.0 compromise, where a malicious release of a popular LLM proxy exposed every credential on the hosts that installed it. Countermeasure: secrets scanning and egress allowlists.
MCP servers and agent tools wired to unapproved models. An agent with tools is a data pipeline, not a chat window. See MCP tool governance in production.
Integrations that post data out. Slack bots and workflow automations move data between systems without anyone "pasting" anything. See preventing AI agent data leaks through Slack.
We're deliberately vendor-neutral here. The category of control matters; the product logo doesn't.
DLP and network controls that fit a small team
"AI DLP" sounds enterprise, but the small-team version is short:
- DNS or web-filter category blocks for unapproved AI sites (this is the "how to block ChatGPT" part — it's a category, not a URL)
- A managed browser plus extension policy, so the shadow-AI-via-extension path is closed
- Endpoint or browser DLP for paste and upload of labelled data
- Sensitivity labels that carry into the approved tool, so the guardrails travel with the document
- Logging of who used what, which turns "nobody knew" into "the log knows"
Honest limits: none of this covers unmanaged devices, and none of it replaces the contract. The goal isn't airtight containment — it's making the approved path the easy path, so the exceptions become visible instead of invisible.
An AI acceptable use policy: a one-page outline
This outline is a starting point, not legal advice — have counsel review anything you actually adopt.
- Purpose and scope. Who the policy covers and why it exists.
- Approved tools list — and the process to request a new one. A list with no request path guarantees a shadow list.
- Data classes never to enter an AI tool: customer PII, credentials and keys, health data, unreleased financials, source code unless explicitly approved.
- Personal accounts and devices rule. Company AI work happens on company accounts.
- Output review. A human checks AI output before it's sent to a customer or shipped.
- API keys and agents. Only company keys, stored in a secrets manager — never personal keys in scripts. (See why personal AI API keys are a breach waiting to happen.)
- Logging and monitoring notice. Tell people usage is logged. Surprises breed workarounds.
- Incident reporting. Pasted something you shouldn't have? Report it within [X hours — set your own number]. The report should be welcomed, not punished into silence.
- Review cadence. Revisit the approved list quarterly; vendors change terms more often than policies get rewritten.
Ask about Governed AI Ops — Tacavar's managed agent runtime and governance desk for teams already running AI agents: tool allowlists, policy gates before irreversible actions, an audit trail, and spend visibility. It implements operational controls; it isn't a substitute for your counsel: tacavar.com/governed-ai-ops/. If you're evaluating whether a managed governance desk fits your team, the Governed AI Ops buying guide walks through the questions to ask. Or start with a quick security scan.
Rolling it out without a revolt
- Approved tool first, block second. Sweden's Government Offices gave staff Copilot (and some staff an in-house AI-assistant platform), then blocked the ChatGPT and Claude front doors. Blocking first just creates a vacuum.
- Announce the date and the reason. Staff at Sweden's Government Offices got notice and a rationale ("without an agreement" is a reason, not a vibe). "Because security said so" invites defiance.
- Build an exceptions path. Some staff in Sweden keep ChatGPT and Claude through the government's own contracted platform. Your equivalent: a request process with a review, so exceptions land inside your contracts instead of outside them.
- Measure usage after. Approved-tool usage and block hits tell you whether the policy is working or just published.
If you're already running AI agents and want the governance side handled as an ongoing operation, that's the Governed AI Ops service: ask about Governed AI Ops. Related reading: agent firewall and production governance, and if vendor lock-in is your concern, our piece on self-hosted AI and data sovereignty covers the trade-offs of running models yourself.
FAQ
What is shadow AI? Shadow AI is employees using AI tools the organization hasn't approved or contracted for — personal ChatGPT or Claude accounts, unreviewed browser extensions, AI features inside other SaaS, or personal API keys in scripts. It's the AI-era version of shadow IT: the tool works, but it sits outside your contracts, logging, and data controls.
Should my company block ChatGPT and Claude? Blocking alone rarely works — people move to phones and personal accounts, and you get shadow AI instead of safety. The better pattern: block or discourage consumer accounts, provide an approved tool under a business contract that doesn't train on your data, and make the approved path the easiest one. Sweden's Government Offices did exactly this in October 2026.
Why did Sweden's Government Offices block ChatGPT and Claude? According to Sveriges Radio's Ekot, the block — starting Monday, Oct 26, 2026 — is so staff use services the Government Offices have approved, including Microsoft's Copilot. Digitalisation director Mikael Wettercrantz said using AI services without an agreement can have consequences for the office's information security. Ekot also found blocks at Skatteverket and SiS.
Is Microsoft Copilot safer than ChatGPT or Claude for company data? It depends on the contract and plan, not the brand. Microsoft states that organizational Copilot use is covered by its Data Protection Addendum with Microsoft as data processor, and that prompts, responses, and Graph data aren't used to train foundation models. Anthropic states that by default it won't use inputs or outputs from commercial products like Claude for Work to train its models. OpenAI states it does not train on business data by default. None of these commitments apply to personal consumer accounts — which is the entire point.
How do I block ChatGPT at work? Block the AI-tools category at your DNS resolver or secure web gateway rather than maintaining a URL list — new domains and mirrors keep appearing. Pair the block with a managed browser and extension policy for work machines. Then accept the honest limit: none of this reaches personal phones or home laptops, which is why policy and an approved mobile tool matter as much as the block.
Can employees get around an AI block? Yes, and they will: personal phones, home laptops, personal accounts, browser extensions, AI features inside other SaaS, and personal API keys in scripts and agents all bypass a network block. Each has a specific countermeasure (see the bypass section above), but the durable fix is an approved tool that's easier to use than the workaround.
What should an AI acceptable use policy include? At minimum: purpose and scope, an approved-tools list with a request process, data classes that must never be entered (PII, credentials, health data, unreleased financials), a personal-accounts-and-devices rule, human review of outputs, rules for API keys and agents, a logging notice, an incident-reporting path, and a review cadence. The outline above maps to a one-page document.
Do business plans of ChatGPT and Claude train on our data? Anthropic states: "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models." OpenAI states on its enterprise privacy page that it does not train on business data by default. Microsoft states Copilot prompts, responses, and Graph data "aren't used to train foundation models." Caveats apply — feedback submissions, plan-level differences, and web-search queries sit under different terms — so verify against the current terms for the exact plan you're buying, and check OpenAI's current business terms yourself before relying on them.