Someone's using ChatGPT on client work. Are we in trouble?
Nobody’s in trouble. Your staff found something useful before the firm had decided anything, which is what’s happening in most offices. The fix is two steps: find out what’s in use, then give people an approved way to do the same job.
They found a useful tool before you had a rule.
In one survey, 79% of Canadian office workers said they use AI tools at work (IBM and Censuswide, 2025). In another, 29% said their employer has a comprehensive AI policy (KPMG Canada, 2025). Most firms are somewhere in that gap.
What a person pastes into a personal account leaves your Microsoft 365, on terms your firm never agreed to, and whether the tool may learn from it is a setting each person controls, not the firm. The fix isn’t a ban. It’s an approved tool people sign in to with their work account, and one page of rules they can follow.
Sources: IBM and Censuswide (2025) and KPMG Canada (2025) surveys, as linked above, checked 8 November 2026.
| Tool | How it was found | Can it see client files? | Status |
|---|---|---|---|
| ChatGPT, on personal accounts | Sign-in logs: 9 staff | Yes: whatever a person pastes in | Decide first |
| A meeting note-taker | Calendar invites: 3 staff | Yes: it records client calls | Decide first |
| A writing extension in the browser | Installed on 6 computers | Yes: it reads pages open in the browser | Decide first |
| Copilot Chat, the free one in Microsoft 365 | Already included in the plan | Only what each person can already open | Fine as it is |
The two-step fix, and what keeps it fixed.
In this order. The first step is a conversation, not a crackdown.
First, find out what’s in use
Ask, and make clear nobody’s in trouble. Then check the sign-in logs and the apps that have been given access, because some tools won’t come up in conversation.
Then give people an approved way
Copilot Chat is included with eligible Microsoft 365 licences and is signed in to with a work account. For a lot of people it covers the same jobs.
Write the one page
Which tools are approved, what never gets pasted in, and who to ask about a new one. One page gets read.
Stop new apps slipping in
Whether staff can give an app access to mailboxes and files on their own is a setting you control.
Start by seeing what the tools can see.
The AI Exposure Check lists every AI tool in use at your firm and, for each one, whether it can see client files. Two weeks, read-only, in writing. The AI Guardrails set-up then writes the policy and applies the settings.
- $750
- Up to 25 staff
- $1,200
- 26–50 staff
- Two weeks, read-only, in writing
- Credited in full against the set-up within 90 days
- If I can't show you at least three specific things worth fixing (a named file, setting or tool), you don't pay.
Rather read first?
All of it is free, with no email asked.
The free checklist
The section “AI apps granted access”, with where to find each setting.
A sample report
What the list of tools in use looks like, with example data.
Questions owners ask.
Yours isn't here? Email me and you get a written answer by the next business day.
Should we just block ChatGPT?
A block on office computers doesn’t reach personal phones, so on its own it tends to move the problem out of sight. An approved tool and a short policy give people a way to do the job properly, and then a block has something to point to.
Do we have to tell our clients?
That depends on your own obligations, and it isn’t a question I can answer for you. What I can give you is the facts, in writing and dated: which tools were in use, what they could see, and what has changed. Your professional body, your insurer or your lawyer can work from that.
Is Copilot Chat really included?
With eligible Microsoft 365 licences, yes, with no extra seat to buy. The paid Microsoft 365 Copilot licence is the one that works inside your own mail and files.
Start with 20 minutes.
No slides, no demo. I'll tell you whether I can help, and what the Check would cost for a firm your size.
DanielI do the work, and I'm who answers.
What happens after you book
- Pick a timeA 20-minute slot, straight from the calendar.
- We talkNo slides, no demo. I’ll tell you whether I can help, and what the Check would cost for a firm your size.
- If it fits, the CheckTwo weeks, read-only, in writing. The price is fixed before any work starts.