OpenAI turned on public access to ChatGPT today, November 30, and by early afternoon three clients had asked us the same question about this new generative AI chatbot: do we need to do something right now? Yes — but not the something most were picturing. We don't have a mature governance framework for a product that has existed a matter of hours; nobody does. What we have is the discipline we apply whenever a capability outruns its policy: name what actually changed, name this week's real risk, and put something small and reversible in front of it before Legal, Security, and whichever executive saw the demo each write a competing memo.
A few caveats first. This is GPT-3.5 — the model family OpenAI has served through its completions API for days already; text-davinci-003 shipped earlier this week. There is no GPT-4, whatever the group chats are speculating tonight, and no Microsoft-branded product sitting on top of any of this. Azure OpenAI Service, Microsoft's hosted version of these models, is still a limited-access program requiring an application and an approved use case, not a general rollout. Everything below is a first-week read; we expect to be partially wrong by the next note.
For IT and security leaders, the near-term problem is not model quality or which job function this threatens. It is duller and more urgent: employees now have a fluent, free, unmonitored text box that absorbs anything typed into it, and several thousand of them found out today. That is a data-leakage problem before it is anything else — the one thing worth acting on this week, not in Q1.
What ChatGPT actually shipped this week — and what didn't
Strip away the novelty and here's what's genuinely new: a free, no-seat, sign-up-and-go conversational interface, fine-tuned from GPT-3.5 with reinforcement learning from human feedback (the same lineage as OpenAI's InstructGPT), built to hold a back-and-forth conversation, remember earlier turns, decline some requests, and — per OpenAI's own notes — occasionally sound confident while being wrong. That matters more than the demo screenshots suggest; we already tried a handful of factual and coding questions where the answer was fluent, well-formatted, and wrong in a way a distracted reviewer would miss.
Here is what did not ship: no admin console, no SSO, no SCIM, no audit log, no DLP hook, no data-processing agreement beyond the consumer terms, and no API for this conversational product — the underlying completion models are API-accessible, but the chat product is a web page and nothing else. OpenAI labels it a free research preview, its way of saying this is not a production tool yet, whatever your most enthusiastic product manager builds on it this weekend. It is already straining under its own popularity — expect "at capacity" messages, because a free, unmetered preview was never sized for viral-launch traffic.
None of that makes it unimportant. It means the gap between "impressive demo" and "governable enterprise capability" is, this week, nearly the entire distance.
The immediate risk is a paste box, not an API
The risk we're prioritizing this week isn't sophisticated. It's an employee with a deadline and a habit of pasting whatever gets the fastest answer: an NDA contract, pasted in for a plain-English summary; a production stack trace, pasted in for a debugging assist, connection string and internal hostname included; a customer list, pasted in to "clean up the formatting." None of this requires malice — just a text box smarter than autocomplete, and a user never told where the line is.
The consumer terms of use governing this product reserve OpenAI's right to use submitted content to improve its models, and no enterprise data-processing agreement stands behind free consumer accounts today. That means no contractual assurance anything pasted in stays out of a training pipeline, and no audit trail proving what left the building, when, or through whose account. None of our existing controls point at this by default — Conditional Access in Azure AD does not gate a public website with no federation to your tenant, and Purview DLP tuned for Exchange Online, SharePoint, and Teams says nothing about a browser tab unless you've already deployed the endpoint DLP browser extension and written a policy naming this destination. Most tenants we work with have the first piece and not the second.
An interim acceptable-use stance, not a moratorium
We're not recommending clients spend a month drafting a full AI governance framework, and we're not recommending they ignore this until one exists. The middle path that ships this week is a one-page interim stance: plain language, scoped generically to "public AI chat tools" so it survives the next competitor's launch, an explicit list of what must never go in, a narrow allowance for low-risk use, a named owner for questions, and a review date so it doesn't calcify into permanent policy written in a panic.
A rough draft we're handing clients this week looks like this:
Interim guidance — public AI chat tools
Effective immediately. Review in 30 days.
Do not paste, upload, or paraphrase into any public AI chat tool:
- Client, patient, or matter data; anything covered by an NDA
- Source code, credentials, connection strings, network diagrams
- Personally identifiable or protected health information
- Anything labeled Confidential or higher under our sensitivity labels
Acceptable, using judgment, with non-sensitive content only:
- Drafting or brainstorming generic, non-sensitive text
- Personal learning and exploration, on a personal account
Questions to the security team, not a debate in the group chat.
This will be replaced by a sanctioned internal option as soon as one exists.
The point is durability: it survives the next chatbot launch without a rewrite, because it's a statement about what leaves the building, not a review of one product's terms of service. Send it jointly from security and legal, keep it to one page, and put the review date in writing so someone actually revisits it.
Why the ban memo fails by next week
The instinct we hear most often is simpler than a policy: block the domain at the firewall or secure web gateway and call it handled. We'd talk any client out of stopping there, for four reasons.
First, it's a public website, reachable from a personal phone or home network in the time it takes to read this sentence. Blocking corporate egress doesn't stop the behavior; it moves it onto unmanaged devices with an unmanaged clipboard — a worse outcome than the one you started with.
Second, most secure web gateway categorization feeds haven't caught up to a product that launched today. A manual URL block is brittle, breaks the moment the front end moves address, and needs someone to maintain it by hand.
Third, the productivity pull is real — faster first drafts, quicker debugging assists — and it takes about one executive trying it and liking it before "no exceptions" quietly becomes "except for me." A ban with no sanctioned alternative doesn't eliminate the behavior; it teaches your best people to route around IT, the same shadow-IT pattern we've spent years fighting with unsanctioned cloud storage and messaging apps.
Fourth: a rule nobody can verify is worse than no rule, because it gives leadership false confidence the risk is handled. Pair the interim stance above with actual visibility. If you already run Microsoft 365 Defender, this advanced hunting query will tell you, today, whether the behavior is already happening on managed devices:
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "openai.com"
| summarize FirstSeen = min(Timestamp), Hits = count() by DeviceName, InitiatingProcessAccountName
| order by Hits desc
We ran a version of this for a regional bank client this afternoon. It found hits. It always finds hits, on day one, everywhere we've looked so far — which is the point: you're not deciding whether to have the policy conversation, only whether to have it with data or without it.
What we're watching for out of Redmond
Microsoft has been OpenAI's exclusive cloud provider and a roughly billion-dollar investor since 2019, and Azure OpenAI Service has spent this year as a limited-access preview: application required, running the GPT-3 completion family, Codex, and — added just last month — DALL-E 2, inside a customer's own Azure subscription with Azure AD authentication and Microsoft's commercial terms behind it instead of a consumer agreement. As of today it has no chat-tuned model resembling what OpenAI just shipped — enterprise plumbing wrapped around an older generation of the same technology.
| ChatGPT (public, today) | Azure OpenAI Service (limited access) | |
|---|---|---|
| Access | Free sign-up, no approval | Application and approved use case required |
| Data handling | Consumer terms; content may be used to improve models | Customer content scoped to your resource, per Microsoft's stated commercial terms |
| Identity and controls | None | Azure AD authentication, RBAC, private networking options |
| Models available | GPT-3.5, chat-tuned | GPT-3 completion family, Codex, DALL-E 2 — no chat-tuned model yet |
| Governing agreement | Consumer Terms of Use | Enterprise/commercial agreement |
Specifically, we're watching whether Azure OpenAI Service adds a chat-tuned model with the same enterprise wrapper — the fastest plausible path to a sanctioned internal alternative; whether the program moves from limited access to general availability, removing the application friction that's currently the only thing slowing enterprise adoption; and whether Microsoft wires its identity and compliance stack — Azure AD Conditional Access, Purview sensitivity labels and DLP — to whatever chat surface it ships, because that's the difference between a governed capability and another one-page memo written in a hurry. We aren't expecting an announcement next week, but given the size of the investment, we'd be surprised if nothing moves within a couple of quarters.
If you're facing this
If your helpdesk is fielding questions your acceptable-use policy doesn't answer yet, you don't need a finished AI governance program by Friday — you need the interim stance above, a named owner, and one query that tells you what's already happening on your network. We ran this exact triage for a regional bank and a state agency in parallel this week, and the shape of the problem was identical both times. If you want a second set of eyes on your draft policy or your detection queries, get in touch and we'll compare notes.