Your team already uses ChatGPT. Or Copilot. Or Gemini.
Sometimes from a personal phone. Sometimes with a client email pasted straight into the chat.
Then the question many companies type into Google appears: “is it legal to use ChatGPT at work?”
There is no yes or no that fits every SME.
There is a first step that works for any company: see the real AI use in the team.
And, if needed, an AI Legal Assessment: Legal Stones’ flagship service to identify AI use, spot the needs and leave you with a documented plan. Inventory (including Shadow AI), governance, data, contracts and training. Remote.
It all starts free, with five questions.
This guide tells you what to look at and where to start with us.
What counts as “using ChatGPT at work”
The logo does not matter, nor who bought the tool.
It counts if someone uses the free chat on a personal account, a company-paid plan, Copilot inside Word or Gemini in the browser.
If someone uses them for work, they form part of your organisation’s AI use — even if leadership never officially procured them.
Using the chat does not automatically make you an AI provider. What matters is what you do with the tool and how the team is using it.
The map of guides: ChatGPT at work.
What you can define in writing
Improving an internal draft, summarising public information or generating ideas, with an identified tool and without third-party data, is the kind of use many SMEs can put in writing.
It is an internal rule: what AI may be used for, with which data and with which tool.
Ban ChatGPT?
That is almost never the best move. A total ban can push use onto personal accounts and tools the company does not even know about.
What usually works better is to define the use and be able to explain it.
What you should not leave to chance
A client email. A fragment of a contract. A spreadsheet of names.
Pasting that into ChatGPT, Copilot or Gemini can involve processing of personal data.
The AI Act does not replace the GDPR: both may need to be looked at together. And it always requires review in your company. A free personal account is not the same as an enterprise plan with a DPA.
We cover that scenario here: ChatGPT with client data.
If you do not even know which tools the team uses, you have a visibility problem often called Shadow AI. It is not a legal label. It means you do not have a clear picture of the AI already inside the company.
The Assessment is how you start bringing that into view.
The provider contract
If you are about to sign ChatGPT Enterprise, Copilot or Gemini, the provider contract matters too. Its terms can affect logs, data processing or use of information for training.
Checklist: AI clauses in SaaS contracts.
If the PDF is already on the table: contract review.
The product: AI Legal Assessment
The AI Legal Assessment is Legal Stones’ flagship service: AI legal consultancy for SMEs already using ChatGPT, Copilot or Gemini.
When you finish you have three things:
- Identified AI use, including what leadership was not seeing (Shadow AI).
- Identified needs: governance, data, contracts and training.
- A documented plan with work reports and recommended measures.
It is done remotely. Scope and price are confirmed before we start.
The first step is free: five questions, a couple of minutes and a first snapshot of use.
If the signal is critical or moderate, the next step is the Assessment.
AI literacy and Article 4
Article 4 sets a duty to adopt measures to support AI literacy.
It applies to providers and deployers: first you need to see whether your company falls into either role. Not every company using ChatGPT is an AI provider. There is also no official EU certificate and no single mandatory course.
Legal Stones’ training oriented to those measures is at CursoAIAct.
Before you train the team, it helps to have the snapshot of use (the five questions) and, if needed, the Assessment. That is where you see whether the need is training, an internal policy, contract review, or all three.
An AI use policy is a recommended measure, not a duty with that name.
The legal detail of Article 4: AI literacy and Article 4.
Frequently asked questions
Is it legal to use ChatGPT in a company?
It depends on the use, the data and the tool. The first step at Legal Stones is five free questions. If needed, the AI Legal Assessment.
Is it legal to paste a client email into ChatGPT?
It depends on what data it contains, which plan you use and whether there are internal instructions. An email with a name and contact details usually includes personal data. Do not treat it as harmless by default.
Should we ban ChatGPT?
Not necessarily. Defining and limiting use is usually more useful than a total ban.
Does using ChatGPT mean we have to comply with the AI Act?
It is not automatic. You need to look at the company’s role and the specific use. The Assessment identifies that use and the needs.
Is the CursoAIAct course the official EU certificate?
No. That official certificate does not exist. CursoAIAct is Legal Stones’ AI-literacy training.
Where do I start?
With the five questions. If the signal calls for it, the Assessment. If a provider contract is waiting to be signed, contract review. If the need is to train the team, CursoAIAct.