A written policy alone does not stop it. Carriers that handle this well combine browser-level data loss prevention (DLP), which catches the obvious leaks on managed devices, with a sanctioned private AI environment good enough that adjusters and underwriters stop reaching for personal ChatGPT accounts.
Policy and blocking alone leave the gap open
LayerX's Enterprise GenAI Security Report 2025, built from browser telemetry across its customers, found that nearly 18% of enterprise users paste data into GenAI tools and about half of that paste activity includes corporate information. The same report found 71.6% of requests to GenAI tools came from personal accounts, and only 11.7% of logins used a corporate account backed by single sign-on.
An acceptable use policy tells staff what they may and may not paste, and examiners will ask to see one. It does little at 4:45 on a Friday when a claim file needs summarizing and ChatGPT is one tab away. Blocking chatgpt.com at the firewall has a similar limit: the work moves to the phone in the adjuster's pocket, where the carrier sees nothing at all.
Browser DLP catches the obvious leaks on managed devices
Microsoft Purview can block sensitive text and file uploads to supported consumer AI apps, including ChatGPT, Gemini, and DeepSeek, through inline DLP in Edge for Business. The policy applies on Windows devices managed by Intune. When it is set to block, other browsers are blocked on the device, and Chrome is blocked unless the Purview extension is installed. Defender for Cloud Apps adds discovery and app sanctioning. Netskope, Zscaler, and Forcepoint offer comparable inline inspection through their secure web gateway and CASB products, which suits carriers that are not standardized on Microsoft.
All of these tools stop at the edge of the devices and networks the carrier manages. Microsoft's browser DLP documentation scopes AI app policies to Intune-managed devices and notes that some apps, ChatGPT among them, can send content in encoded form that affects enforcement. A personal laptop or a phone browser is outside the policy entirely. LayerX's October 2025 report says: "Traditional file-based DLP solutions miss where the real risk lies today: GenAI tools, unmanaged accounts, and file-less transfers."
Staff need an approved AI they actually prefer
Blocking without an alternative pushes the work onto devices the carrier does not manage, so carriers need a sanctioned tool that staff would pick over their own accounts. If that tool is ChatGPT, the plan tier decides what happens to the data. OpenAI's help center says that on its individual plans (Free, Plus, and Pro) it may use conversations to train its models unless the user turns off "Improve the model for everyone," and that thumbs up or down feedback can make a conversation eligible even after opting out. By default, it does not use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or its API.
A ChatGPT Enterprise license settles the training question for one vendor. Staff who prefer Claude or Gemini will still go around it, and the carrier still needs a record of what was sent to any model. How to find the AI already in use, and how to bring it inside a sanctioned program, is covered in shadow AI: the biggest governance blind spot.
Regulators treat it as data governance
The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers expects each carrier's AIS Program to address "data practices and accountability procedures" and the carrier's process for relying on AI systems developed by a third party. Policyholder data pasted into a personal ChatGPT account has gone to a third-party AI system the carrier never assessed. Separately, most states have implemented the NAIC Insurance Data Security Model Law (#668), which requires a risk-based information security program and oversight of third-party service providers. More on what examiners look for is in our NAIC Model Bulletin guide.
Swept Access for carriers
Swept Access gives staff Claude, ChatGPT, and Gemini inside a private environment and checks every request against the carrier's data policy before it reaches a model. See how it works on the private AI page.
How do FAQs
Many carriers block consumer ChatGPT on managed devices, usually with browser data loss prevention or a secure web gateway. Blocking alone tends to move the activity to personal phones and laptops the carrier cannot see. Carriers that handle this well pair the block with an approved AI tool that staff are allowed to use for policyholder work, and a written acceptable use policy that says which tool that is.
It depends on the plan. OpenAI says that on its individual plans (Free, Plus, and Pro) it may use conversations to train its models unless the user turns off Improve the model for everyone in Data controls, and that thumbs up or down feedback can still make a conversation eligible after opting out. OpenAI says that by default it does not use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or its API to improve its models.
Only on devices the carrier manages. Tools such as Microsoft Purview, Netskope, Zscaler, and Forcepoint can inspect and block sensitive text and file uploads to consumer AI apps on devices the carrier manages. Microsoft's own documentation scopes its AI app policy to Intune-managed Windows devices using Edge for Business. Personal phones and unmanaged laptops sit outside that reach, so DLP catches the obvious leaks on company hardware and nothing on personal ones.
The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers expects each carrier's AIS Program to address data practices and accountability procedures, and to cover how the carrier acquires, uses, or relies on AI systems and data from third parties. Separately, most states have implemented the NAIC Insurance Data Security Model Law (#668), which requires a risk-based information security program and oversight of third-party service providers.
Give them a sanctioned AI environment with the models they already prefer, on business terms that exclude training, with every request checked against the carrier's data policy and logged. Browser DLP on managed devices then handles the remaining obvious leaks.