ChatGPT and Claude at Work: Ban Them, Sanction Them, or Something in Between?

Your team is already using them

Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 people, reported that 78% of AI users bring their own AI tools to work. LayerX Security's 2025 report, based on browser telemetry from its enterprise customers, found 71.6% of generative AI access went through non-corporate accounts. Both come from organisations with a commercial interest and neither is specific to Singapore, so use them for direction and check your own business by asking.

The usual cautionary tale is Samsung. In 2023 an engineer uploaded internal source code to ChatGPT and the company told staff to stop using generative AI. A pause is sensible. The failure is when the pause becomes the policy and nothing approved replaces it, because the demand moves to personal accounts, where you have no logging, no admin controls and no say over the provider's settings.

Three stances

Most businesses of 20 to 200 people end up in the third column, built on the second: sanction a tool for the bulk of the work and ban only the data they cannot afford to expose.

When a ban is the right call

A ban is defensible when all four hold. If any one fails, you are writing a request, not a control.

• You can name the data that a contract, regulator or privilege rule says may not go to a third-party AI service.
• You control the devices, so the block bites. Ask what happens on a personal phone.
• A sanctioned route exists for everything else. You ban a data class, not a capability.
• Someone owns exceptions and answers within days.

What "sanctioned" actually means

Sanctioning a tool means the business has chosen it, set it up, written down what goes in and out, and can see how it is used. Four guardrails turn permission into a control.

• One or two named tools on company accounts, signed in through Entra ID so access ends when employment does.
• A data rule people can remember. Public content can go into any approved tool, internal content only into sanctioned tools, and client personal data or regulated material only into tools whose terms you have reviewed, or not at all. Give examples: client names, contracts, pricing, NRIC numbers, salaries, source code.
• Business-tier terms: no training on your content by default, admin controls, a data processing agreement, and a written answer on where data is processed. Free and personal plans give you none of these.
• A named owner, a fifteen-minute monthly review and forty-five minutes of training. A rule nobody has been walked through does not change behaviour.

Four routes for a Microsoft 365 business

The choice is not "Copilot or the rest". There are four routes, they can coexist, and the sensible approach is a front door per use case.

US list prices excluding GST, which change often. ChatGPT and Claude seat prices come from a pricing page and third-party trackers, so confirm them before you budget. Singapore dollar figures later use S$1.35 to US$1.

Route 1 is strongest for questions about your own work, such as mail, meetings and files, because Microsoft assembles the context. Routes 2 and 3 earn their place when staff want the vendor's own product, and for document, analysis or writing-heavy tasks. Route 4 is for data you cannot send anywhere else. Most businesses will use one primary route and at most one secondary.

GPT and Claude are already inside paid Copilot

Anthropic models have been in Copilot since September 2025, and OpenAI announced on 9 July 2026 that GPT-5.6 is the preferred model in Word, Excel, PowerPoint, Chat and Cowork. You get both model families under one contract and one admin console. Two things in the admin centre are easy to miss.

The provider settings. In the Microsoft 365 admin centre, Copilot, Settings, "AI providers operating as Microsoft subprocessors" controls Anthropic and OpenAI-operated models. An AI Administrator or Global Administrator sets it, for all users or for specific Entra groups.

• Anthropic is on by default for most commercial tenants outside the EU, EFTA and UK. For a Singapore tenant, assume it is already on.
• OpenAI-operated models started disabled on 9 July 2026 and were scheduled to switch on automatically from 24 July 2026 for eligible customers. Models Microsoft itself runs on Azure OpenAI are not covered by this setting.
• "Models with data retention" are separate. Anthropic acts as an independent processor outside Microsoft's Data Protection Addendum, retains most inputs and outputs for up to 30 days and flagged content for up to two years. They are off by default and need explicit opt-in.

The contract position. Unless a model is labelled "with data retention", Microsoft says its Product Terms, Data Protection Addendum and Enterprise Data Protection apply to Anthropic models in Copilot, and the Customer Copyright Commitment covers them. That is a real protection you do not get from a personal account. What it does not give you is a location. Microsoft states that Anthropic models are excluded from the EU Data Boundary and from in-country processing commitments, and does not say where they run.

Work IQ and the IQ layers

The strongest argument for Route 1 is context rather than the model. Work IQ is Microsoft's shared intelligence layer over your mail, meetings, chats and files from Microsoft Graph, alongside Fabric IQ for business data in OneLake and Foundry IQ for authoritative documents. Independent analysis in September 2026 notes the Fabric and Foundry layers are a mix of generally available and preview features, so check before you plan around them.

• Licensing. Copilot-licensed users get Work IQ in Copilot experiences. The APIs became generally available on 16 June 2026 and are billed in Copilot Credits when custom or third-party agents call them. A tool call is listed at 0.1 credits, with no published dollar price.
• Governance. Every request runs as a specific user, honours sensitivity labels and access policies, and is logged.
• Other agents. Work IQ is exposed through an agent-to-agent endpoint, a remote MCP server and a REST API. The documentation we read does not name Claude or ChatGPT as supported clients, so verify with a single-user pilot and watch credit consumption.

We have not benchmarked the three routes. Run the same five real tasks through each in a pilot and compare.

Connecting corporate data to ChatGPT or Claude safely

A connector does not move your files to the vendor. It lets the vendor's service read what a user can already read, on demand, and whatever is retrieved is processed by the vendor. Before you switch one on, ask what it can reach and where it is processed. This section covers the first, and the next covers the second.

How the Microsoft 365 connectors work

Both use delegated Microsoft Graph permissions: the service acts as the signed-in user and SharePoint and OneDrive permissions are not bypassed. Both need Entra consent, which in most tenants means an administrator. The differences below are where the control sits.

Does Claude need Enterprise? Not to connect to Microsoft 365: the connector works on every plan. Enterprise adds the audit, compliance and retention layer, at US$20 per seat plus usage at API rates, which is where the comparison with Copilot becomes a question of consumption per active user.

What you need in place first

What an MSP would check before enabling a connector. Treat it as a gate.

• Permissions that mean what you think. A connector inherits every user's access, so an overshared SharePoint site becomes an overshared AI answer. Review sharing on sensitive sites first, and decide whether labelled content is excluded.
• Two different people: an administrator who consents in Entra, and a separate owner of the vendor workspace.
• A named pilot group of five to ten, assigned in Entra, not the whole tenant on day one.
• Read-only first. Retrieved emails and documents can contain instructions aimed at the model, and with write tools on that can become action.
• Conditional Access that does not break it. Claude's documentation notes you may need to exclude Anthropic's published IP range from sign-in frequency or location policies, though not device compliance. Test in the pilot.
• Signed terms, a known audit trail and a leaver step: a data processing agreement, the vendor's processing location in writing, and removal from the AI workspace at offboarding.

Connection readiness check

Tick what is already true in your organisation. The result tells you whether to proceed to a pilot or fix the gaps first. It runs in your browser and nothing is stored.

Where is the data processed?

Two questions are easy to blur. Where is content stored at rest, and where is it processed when a model reads it? Contracts and regulators often care about only one. The table records what each vendor documents as of October 2026, so get the position you rely on in writing.

Is US processing already a problem?

Not under the PDPA by itself. The Transfer Limitation Obligation allows personal data to go overseas when the recipient is bound by enforceable obligations giving comparable protection, and a data processing agreement is the usual way to do that. It becomes a blocker when a client contract or sector rule requires data to stay in-country, when the data is in a class you have already carved out, or when your own risk appetite is lower than the vendor's terms. Read any restriction closely, because stored in Singapore, processed in Singapore and accessed only from Singapore are different things. Many contracts say stored.

For a use case that genuinely needs Singapore-only processing, the documented options are narrow: build on in-region inference, or keep that data out of AI tools. Ask each vendor for a written commitment rather than relying on a marketing page.

Find your stance and route in two minutes

Eight questions give you a stance, the routes to look at first, and whether your data location requirement can be met. It runs in your browser, stores nothing, and is a starting point rather than a verdict or legal advice.

Once you have a stance, the written version is a one-page policy, and our AI policy guide has a fill-in template for it. This guide is about the decision. That one is about the document.

Technical controls in Microsoft 365

Policy tells people what to do. Controls make the right thing easy and the wrong thing visible. Each layer has a licence implication that is easy to miss.

Controls stop where your management stops. Microsoft's own guidance notes that organisation-level blocking covers managed network connections, so a personal phone on mobile data bypasses every layer. That is why a good sanctioned tool is a security control as well as a productivity tool: it is the only thing that reaches the devices you cannot manage.

Singapore: the PDPA and the regulators

The PDPA applies whichever stance you choose. Personal data a member of staff pastes into an AI tool is personal data your organisation is responsible for.

PDPC guidelines. The PDPC's Advisory Guidelines on the Use of Personal Data in Generative AI (20 July 2026) say deployers bear primary responsibility for ensuring the systems they choose can meet PDPA obligations (paragraph 9.1), should educate end users on what personal data may be entered (9.3), and are encouraged to keep written policies and review safeguards regularly (9.4 and 9.5). They do not specifically address staff using consumer tools. Our reading, and only our reading, is that a business with no rule, no approved tool and no view of what staff paste would struggle to show it took responsibility. A sanctioned tool, a written rule and training are the evidence those paragraphs describe.

Overseas processing and incidents. The Transfer Limitation Obligation requires appropriate steps to ensure an overseas recipient gives comparable protection, and a contract does that. If staff do paste a client file into a personal account, treat it as a possible data breach: assess it promptly, and if it is notifiable the PDPC expects notification within three calendar days of that assessment.

Financial institutions. MAS issued its Guidelines on AI Risk Management on 7 October 2026. They set supervisory expectations scaled to the institution, including an accurate inventory of AI use and accountability for third-party AI, with governance and inventory expected from 7 October 2027 and lifecycle controls by 7 October 2028 (per Allen & Gledhill's summary). You cannot inventory use you do not know about, and suppliers to financial institutions should expect client questions on the same point. That is our inference, not MAS's wording.

General information, not legal advice. Speak to your data protection officer or a Singapore-qualified lawyer about your own position.

What each route costs

Licences are the easiest cost to model: zero if Copilot Chat is your default, a flat seat price for paid Copilot and the team plans, and a seat plus metered usage on Enterprise tiers. A ban is not free either, with block lists, exceptions and a workforce quietly on personal accounts. We have not put a figure on a data incident because any single number would be invented. The calculator covers what can be calculated: cost per person who actually uses each route, and the time they must save for it to pay back.

If you buy seats for everyone and half the team uses them weekly, the real price per user getting value is double the sticker price, and on an Enterprise tier usage sits on top. That is the case for a pilot group first, and for pricing the Enterprise route from your own consumption data.

A four-week path that brings usage into the open

Find out, offer a better route, then close the old one.

• Week 1, find out and decide. Ask staff with an amnesty, check expense statements, run Defender's Generative AI discovery if you have it, pick a stance and name the owner.
• Week 2, pick and set up. Choose one default tool, turn on single sign-on and the admin settings (including Copilot's provider settings), confirm the data terms, and write the one-page rule using the AI policy guide template.
• Week 3, pilot. Five to ten people across two or three teams, including a sceptic. Collect real use cases and adjust the rule.
• Week 4, launch and close the old path. Run the training, publish the rule, then block free alternatives on managed devices, in warn mode first. Review monthly and revisit the stance quarterly.

Frequently Asked Questions

Is our Copilot data kept in Singapore?

Probably in Microsoft's Asia Pacific region, but not by a commitment that names Singapore. Microsoft operates Singapore datacentres, and Copilot Studio maps Singapore to the Southeast Asia Azure region. Singapore is not on the country list for Copilot's at-rest commitment or Advanced Data Residency, or in the in-country processing programme, and Microsoft says model calls go to the closest datacentres in the region but can go to other regions when capacity is limited. If a client contract needs it in writing, ask Microsoft to confirm your tenant's position.

Are Claude and OpenAI models already switched on in our Copilot?

Possibly. Microsoft documents Anthropic as a subprocessor that is on by default for most commercial tenants outside the EU, EFTA and UK, and OpenAI-operated models were scheduled to be switched on automatically on 24 July 2026 for eligible customers. Check Copilot, Settings, AI providers operating as Microsoft subprocessors in the Microsoft 365 admin centre, and scope each provider to the groups that should have it.

Where does Claude process our data, and is the US a problem?

Anthropic states that data for its commercial products is stored in the US and that traffic may be routed to select countries in the US, Europe, Asia and Australia. No Singapore option is documented for the Claude apps, although Claude Sonnet 5 on Amazon Bedrock supports in-region inference in Singapore. Under the PDPA, overseas processing is allowed when the recipient gives comparable protection, usually through a contract, so the US is not a problem by itself. It becomes one if a client contract or sector rule requires in-country storage or processing.

A client contract says we cannot use AI on their data. What do we do?

Treat that client's data as a banned class, and say so in your rule. Read the clause carefully, because some forbid any third-party processing while others only forbid training on the data. Tell the people on that account, record who can approve an exception, and if the clause is unclear, ask the client or your lawyer rather than guessing.

Related Guides

• How to Write an AI Policy for Your Company: The written version of the decision: data tiers, approved tools and a fill-in one-page template.
• Your AI Readiness Checklist: 10 Things to Sort Before You Deploy: The data, vendor and staff checks that sit underneath either stance.
• Microsoft Copilot for Business: Is It Worth the Extra Cost?: What the different Copilot products are, how they are licensed and where grants apply.
• Microsoft 365 Licensing Demystified: Which plan includes Conditional Access, Intune and the data protection controls mentioned above.