The instinct is understandable. A client hears that employees are pasting sensitive data into ChatGPT, panics, and says the words every MSP has heard: “Just block it.”
It feels like a decision. It feels like control. It is neither.
The numbers make the problem plain. Fifty-seven percent of employees hide their AI use from supervisors, according to a 2025 KPMG and University of Melbourne study. The study covered nearly 48,000 people across 47 countries.
Employees aren’t necessarily hiding AI because they’re doing something wrong. They’re hiding it because they’ve been told not to use it, while the work still needs to get done.
Block ChatGPT on the corporate network, and an employee can open the same tool on a personal phone or home Wi-Fi. They can still paste company data into it.
The MSP then has less visibility than before the ban, while the client carries more risk.
Bans create a visibility problem
Jerod Brennen, CISSP, Co-Founder and CEO of Aetos One, leads a fractional CISO and managed security services firm. He brings 25 years of cybersecurity experience.
He puts the issue simply: “A ban doesn’t remove AI from the business. A ban removes your visibility into AI use.”
Scott Doerr, founder of ForeGuard Advisory Group, has more than 26 years of cybersecurity leadership experience across banking and healthcare. As a fractional CISO, he has seen this false confidence repeatedly.
“I see the same reaction almost every time I raise this with a leadership team,” he said. “They’re confident they know how many AI tools are in use, a little defensive at the suggestion otherwise.”
“Then they’re shocked when the real number comes back far higher. A ban makes that gap worse, because it teaches people to hide.”
His bottom line: “A ban you can’t enforce isn’t really a control. The only people it stops are the ones who were going to follow the rules anyway.”
Give employees an approved path
The path from prohibition to governance doesn’t have to be complicated. Brennen’s framework starts with understanding the business process. Why is the employee using AI in the first place?
Next, map the data flow. What goes into the AI tool, where does that information go, and who sees the output?
Then, give the business an approved path with controls that are easy to implement, maintain, and monitor.
“Real governance, kept simple, reduces the volume of work for the DLP tool,” Brennen said. “A DLP tool fed clean inputs catches more of what matters than one buried in noise.”
Doerr’s approach for SMBs follows a similar path. Start with visibility and find out what employees actually use before writing a single rule.
Then give people a sanctioned “yes.” Choose one or two approved tools on business accounts tied to company logins. This approach also helps organizations manage access when employment ends.
“After that, decide by consequence,” Doerr said. “Using AI to draft an email is low risk.”
“Pasting customer records into it, or letting it make a decision about a customer, needs an owner and an approval.”
Document those expectations in a short acceptable-use policy that employees will actually read. Pair the policy with simple checks that show whether it is working.
For example, review which AI tools appeared in company sign-ins during the quarter.
Address AI risks in regulated industries
For MSPs serving regulated industries, additional risks can make AI governance more urgent.
Ryan Reck, Founder and Principal of Reck Advisory, is a CISSP, CCSP, and CISM-certified cybersecurity advisor who works extensively with medical practices.
“In a medical practice, a ban might mean someone photographs a referral letter and asks a free chatbot to summarize it,” he said.
“Patient information ends up in a consumer account without a business associate agreement.”
The employee still has a task to finish. If the business doesn’t address why staff want AI, employees may find workarounds outside systems the practice and MSP can monitor.
Reck also flags another risk for MSPs helping clients deploy approved AI tools.
“If the approved tool connects to the company’s files, email, or records, it can surface any document an employee technically has access to,” he said.
That can include files shared too broadly years ago. AI tools can also pull from outdated or conflicting records as easily as current ones.
Before rollout, Reck recommends cleaning up permissions, identifying authoritative sources, and keeping obsolete material outside the tool’s search scope.
“That doesn’t mean deleting it,” he added. “Records the business is required to keep still have to be kept.”
Move the conversation from blocking to governance
When a client insists on a ban, Doerr recommends shifting the conversation away from AI itself.
“Don’t argue about the block,” he said. “Ask what they’re trying to protect, which is almost always client data or something regulated.”
“Then ask where the phone in their employee’s pocket fits into that block.”
“That usually ends the debate and opens the real one, about which tools they’ll approve and who gets to decide.”
Brennen frames the MSP’s role in terms familiar to security practitioners. AI governance isn’t an entirely new discipline. Identity governance and data governance already exist, and AI sits where they meet.
“A client who knows who has access to what, and where sensitive data lives, is in better shape than a client who buys another tool.”
The goal isn’t to stop employees from using AI. It’s to make the approved path the obvious one while ensuring MSPs can see when something goes wrong.
For MSPs looking to put that governance layer into practice, Barracuda AI Data Security provides visibility, policy enforcement, and audit-ready evidence.
These capabilities can help turn a one-page acceptable-use policy into controls that an insurer, auditor, or client can verify.
Photo: patpitchaya/ Shutterstock
This post originally appeared on Smarter MSP.