How to stop staff using public ai chatbots and use secure business ai instead

Summary

This guide helps you troubleshoot and resolve: How to stop staff using public ai chatbots and use secure business ai instead. Follow the steps below to fix the issue.

Common Causes

Shadow AI occurs when employees use public, consumer-grade generative AI tools without organisational oversight. For Australian small businesses, this practice introduces significant risks, including the accidental exposure of proprietary code, client records, and financial data. When sensitive information is pasted into a public AI chatbot, that data may be used to train public models, potentially breaching the Privacy Act 1988 and the Australian Privacy Principles (APPs). This guide outlines how to mitigate these risks by restricting access to public AI tools and deploying secure, enterprise-grade alternatives such as Microsoft Copilot with commercial data protection.

Quick Fix Steps

1. Identify which public AI tools staff are currently using through network logs or an internal survey.
2. Block access to unauthorised AI domains via your business firewall or DNS filtering service.
3. Deploy Microsoft Copilot with commercial data protection for all licensed users.
4. Update your organisation's Acceptable Use Policy to prohibit the entry of sensitive data into public AI platforms.
5. Conduct a brief staff training session on the approved secure AI alternative.

Detailed Instructions

1. Establish Data Governance Foundations

Before restricting tools, define what constitutes sensitive data within your organisation. This typically includes client personally identifiable information (PII), financial records, intellectual property, and proprietary source code. Document these categories in a data governance policy and communicate them clearly to all employees.

2. Block Public AI Chatbots

To prevent staff from accessing consumer AI platforms, implement network-level controls:

1. Log into your business firewall or DNS filtering management console.
2. Navigate to the Web Filtering or Content Control section.
3. Create a new block list for known public AI domains (e.g., consumer chatbot URLs).
4. Apply the block list to all corporate devices and guest Wi-Fi networks.
5. Save the configuration and test a blocked domain to ensure the restriction is active.

3. Deploy Microsoft Copilot with Commercial Data Protection

Microsoft Copilot with commercial data protection ensures that user prompts and responses are not saved, Microsoft has no eyes-on access to the data, and the data is not used to train the underlying foundation models.

1. Ensure your organisation has the appropriate Microsoft 365 licences that include commercial data protection.
2. In the Microsoft 365 admin centre, configure Copilot with commercial data protection via the appropriate service settings or assign licences through your licensing management portal.
3. Instruct staff to sign in to Copilot using their corporate @yourdomain.com.au email address.
4. Verify that the "Commercial data protection" shield icon is visible in the Copilot interface before entering any business information.

4. Manage Internal Permissions in SharePoint

Secure AI tools often integrate with your existing data stores. To prevent AI from oversharing sensitive internal information, review your SharePoint permissions:

1. Open the SharePoint admin centre.
2. Select Active sites and choose the site containing sensitive data.
3. Click Permissions and review who has Edit or Full Control access.
4. Remove unnecessary permissions and ensure that sensitive folders are restricted to specific security groups.
5. Use Sensitivity labels in the Microsoft Purview compliance portal to classify and protect documents containing client data.

5. Ensure Compliance with Australian Privacy Obligations

Under the Privacy Act 1988, organisations must take reasonable steps to protect personal information. Using enterprise-grade AI with commercial data protection helps satisfy these obligations by keeping data within your organisation's controlled environment. Maintain an audit log of who has access to AI tools and conduct periodic reviews of data access permissions.

Troubleshooting

Staff continue to access public AI tools

If employees are bypassing network blocks using mobile data or personal devices, enforce device management policies. Require that only managed devices can access corporate resources, and implement Conditional Access policies in Microsoft Entra ID to block unmanaged devices from accessing company data. Consider deploying browser extensions or MDM configurations to block AI domains on managed endpoints.

Copilot commercial data protection not appearing

If the data protection shield is missing, confirm that the user is signed in with their organisational account and not a personal Microsoft account. Verify that the appropriate licence is assigned and that Copilot with commercial data protection is enabled in your Microsoft 365 service settings. The user should also clear their browser cache or restart the application.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?