TL;DR: A ban can push AI use out of view rather than stop it. Cisco’s 2024 survey reported that 27% of organizations had banned generative AI at least temporarily, while Microsoft and LinkedIn’s 2024 Work Trend Index reported that 78% of AI users bring their own tools to work. Approved tools, data rules, and named reviewers at checkpoints can address the risks a ban was meant to solve.
What does a ban actually stop?
The reasons behind AI bans are real, and they deserve a fair hearing first. Basil C. Puglisi, MPA, states that principle in his working paper on when AI policy becomes an accessibility barrier, in its section on why institutions restrict AI: “Every restriction has a reason, and the reasons deserve a fair statement before any critique.”
Cisco’s 2024 Data Privacy Benchmark Study shows what those reasons look like. Organizations cited “threats to an organization’s legal and Intellectual Property rights (69%), and the risk of disclosure of information to the public or competitors (68%).” In response, “63% have established limitations on what data can be entered, 61% have limits on which GenAI tools can be used by employees, and 27% said their organization had banned GenAI applications altogether for the time being.” The same study found that 48% of respondents admitted entering non-public company information into GenAI tools. These figures come from Cisco’s own survey of 2,600 privacy and security professionals.
A ban ends sanctioned use, yet Microsoft and LinkedIn’s 2024 Work Trend Index reported that “78% of AI users are bringing their own tools to work,” a pattern the release says leaves organizations “putting company data at risk.”
The working paper draws a sharper conclusion from the stated reasons: “None of these reasons concerns the method by which a worker, author, or student reaches that person’s own capability. Each concerns data, accuracy, authorship, or the integrity of what is being assessed.” That distinction matters for policy design. In the paper’s accommodation context, “Where an employer can offer a secure, approved alternative, that alternative satisfies the stated rationale for a ban, so the rationale alone does not justify denying an accommodation that the alternative could meet.”
What risks does a ban create?
A ban creates three risks that are easy to miss when the policy is written.
Use without a record. When employees use personal AI tools anyway, the organization may have no record of what was entered, what came back, or who relied on it. Basil’s analysis of insurance, The AI Risk Economy, reads current carrier exclusion language as applying to AI use by “any person or entity,” which “captures shadow AI, authorized deployments, and third-party AI embedded in vendor software with equal force.” A ban on paper doesn’t remove exposure from use that happens anyway. The paper is candid about its own limits: “No actuarial evidence validates governance as a pricing factor.”
Barriers for employees with disabilities. A companion working paper on AI as assistive technology argues that “General-purpose AI can function as assistive technology when its use reduces a disability-related functional barrier and increases, maintains, or improves a person’s functional capability.” The accessibility paper explains why a rule applied to everyone can still exclude: “Each rule applies to every person equally, and each can still bar the means through which a particular disabled person does the work.” It classifies an outright ban as a Use Prohibition, in which “The policy denies the assistive means entirely.” Both papers are working papers, and their legal reading is analysis rather than settled law.
Work moving out of view. Basil’s book Governing AI: When Capability Exceeds Control examines prohibition in Chapter 10, “The Path Forward,” whose section on why prohibition approaches face structural challenges argues that bans on dangerous capabilities push development into shadow ecosystems beyond oversight. That chapter concerns bans on AI capabilities rather than workplace rules, so its use here is an analogy, but the pattern carries: what is banned tends to continue where no one is watching.
What governs AI use instead?
Governing the work at defined checkpoints can address the same risks while keeping use visible. Under Checkpoint-Based Governance, a named human holds binding authority where AI output becomes a decision, and “No decision means no move forward, so every checkpoint comes back to accept, modify, or reject before the work proceeds.”
A workable policy built on that idea has four parts:
- Approved tools with enterprise data protections, so employees have a secure alternative to personal accounts.
- Clear rules on what data may never be entered, matched to the confidentiality and intellectual property concerns that drive bans.
- Named reviewers for consequential outputs, such as client deliverables, legal documents, and public statements, with authority to accept, modify, or reject.
- A record of who decided and why, so the organization can show oversight when a client, insurer, or regulator asks.
The checkpoint can also build skill over time. The CBG page lists a developmental mechanism among its four properties: “Reviewing structured AI output repeatedly builds the reviewer.” On that view, a ban forgoes that learning, and a governed rollout turns everyday use into practice in judgment. This is offered as one possible path, and each organization should fit it to its own risks.
For a company weighing a ban against a governed rollout, Puglisi Consulting’s AI Strategy and Readiness Review gives the plan “an independent AI readiness assessment against the facts it rests on and the outcomes it promises to measure.” It is one option among many.
Questions Readers Ask
Is it legal for a company to ban AI at work?
Employers commonly set rules for workplace tools, but a blanket ban can raise questions in specific cases, such as an employee who uses AI as assistive technology and requests an accommodation. Basil’s working papers analyze that exposure under disability law. Any organization considering a ban should review it with qualified counsel first.
What should an AI policy include instead of a ban?
A practical policy names approved tools, sets rules on data that may never be entered, assigns named reviewers for consequential outputs, and keeps a record of who decided and why. It also explains how employees can request new tools or accommodations, so the policy keeps up with real work.
How do we stop employees from entering confidential data into AI tools?
Offer approved tools with enterprise data protections, set explicit rules on what data may never be entered, and train employees on those rules. Cisco’s 2024 study found 63% of organizations limit what data can be entered, a control that addresses the risk directly without banning use altogether.
Does an AI ban protect a company from liability?
Not necessarily. Employees may still use personal tools, and AI is often embedded in vendor software the company already runs. The AI Risk Economy reads current carrier exclusion language as reaching AI use by any person or entity, so a ban on paper may leave real use undocumented and unprotected.
Can a company restrict AI for some tasks but not others?
Yes, and many do, but task restrictions carry their own risk if they block the specific functions an employee needs to do the work. Basil’s accessibility paper calls this a Process Restriction. Defining checkpoints by the consequence of the output, rather than by the tool used, is one way to manage it.
Sources
Cisco. (2024, January 25). More than 1 in 4 organizations banned use of GenAI over privacy and data security risks [Press release]. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m01/organizations-ban-use-of-generative-ai-over-data-privacy-security-cisco-study.html
Microsoft. (2024, May 8). Microsoft and LinkedIn release the 2024 Work Trend Index on the state of AI at work [Press release]. https://news.microsoft.com/source/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/
Puglisi, B. C. (2025). Governing AI: When capability exceeds control (2nd ed.). https://basilpuglisi.com/governing-ai-when-capability-exceeds-control/
Puglisi, B. C. (2026, May 24). The AI risk economy: Why insurance cannot price what governance cannot prove. basilpuglisi.com. https://basilpuglisi.com/ai-risk-economy-insurance-governance/
- W. R. Berkley. Form PC 51380, as quoted in the paper.
Puglisi, B. C. (2026, September 24). When AI becomes assistive technology [Working paper]. basilpuglisi.com. https://basilpuglisi.com/aida-ai-assistive-technology/
Puglisi, B. C. (2026, September 25). When AI policy becomes an accessibility barrier [Working paper]. basilpuglisi.com. https://basilpuglisi.com/ai-policy-accessibility-barrier/
- Cisco. (2024). Cisco 2024 data privacy benchmark study.
Puglisi, B. C. (n.d.). What is Checkpoint-Based Governance? Human authority. basilpuglisi.com. https://basilpuglisi.com/cbg/
Puglisi Consulting. (n.d.). Advisory reviews. https://puglisiconsulting.com/advisory-reviews/
I am not a lawyer, and this site and its advisory reviews do not provide legal advice. This is thought research and governance analysis based on public sources, cited materials, and human-AI review. It is intended to help executives, practitioners, insurers, and governance teams think more clearly about AI risk, liability exposure, and documentation practices. Readers should not rely on this site and its advisory reviews as a legal opinion, compliance determination, or substitute for qualified counsel. Any organization facing a legal, regulatory, contractual, or insurance question should consult its own attorney, broker, or professional adviser before acting.
#AIgenerated from #AIassisted content under HAIA Ecosystem
Free for personal, educational, and noncommercial research use with attribution. Commercial exploitation, paid productization, and enterprise commercialization require separate permission and licensing.
Suggested citation: Puglisi, B. C. (2026). Should my company ban employees from using AI? basilpuglisi.com.
Leave a Reply