27% of Enterprises Ban ChatGPT Usage - The Frontline of AI Security Risks and Countermeasures

In 2025, as enterprise AI adoption rapidly advances, shocking survey results have emerged. According to the Cisco 2024 Data Privacy Benchmark Study, over 27% of enterprises have banned the use of GenAI (generative AI)¹. Major companies including JPMorgan Chase, Amazon, Bank of America, and Samsung have successively announced ChatGPT usage restrictions. Notably, Samsung experienced three confidential information leaks in just one month, sending shockwaves through the industry. This situation highlights the serious dilemma that exists between AI utilization and enterprise security.

Major Companies Successively Ban ChatGPT Usage

The Samsung Incident’s Industry Impact

In 2024, the confidential information leak incident at Samsung sounded an alarm for enterprise AI usage. The company experienced three confidential data leaks in just one month:

Source code leak
Internal meeting minutes exposure
Hardware-related data breach

Following this incident, Samsung temporarily banned all use of generative AI tools. The company is currently developing its own AI tools.

Financial and IT Giants’ Response Status

JPMorgan Chase restricted access to ChatGPT citing compliance issues. Amazon similarly restricted employee usage. Other companies implementing usage restrictions include:

Bank of America
Citigroup
Deutsche Bank
Goldman Sachs
Wells Fargo
Verizon (blocking workplace access)

These companies are taking strict restrictive measures from the perspectives of confidential information leak risks and regulatory compliance.

Five Security Risks ChatGPT Brings to Enterprises

1. Information Leakage to Training Data

The most serious risk is the possibility that user input data may be used for future model training. For example, if an executive copies and pastes corporate strategy documents into ChatGPT for creating internal presentation slides, that information could potentially be reflected in future responses to other users, including competitors.

2. Data Persistence and Privacy

In the public version of ChatGPT, user inputs are stored and utilized as training data. Many users are unaware of this fact and unconsciously share confidential information.

3. Difficulty in Regulatory Compliance

Italy’s data protection authority temporarily banned ChatGPT due to GDPR violations. Major concerns:

Lack of age verification mechanisms
Mass collection of personal data
Unauthorized use for AI training

4. PII (Personally Identifiable Information) Exposure

ChatGPT may inadvertently generate information containing PII or intellectual property in its responses.

5. Inter-Agent Communication Risks

In the 2025 enterprise environment, AI agents communicate with each other and automatically transfer data. This complex interconnection makes data security management more difficult.

Rapid Expansion of Local AI Adoption - Major Trends in 2025

Rise of Latest Open-Source LLMs

Responding to enterprise security concerns, locally executable LLMs are rapidly evolving:

Llama 3.3: Meta’s latest model. Achieving high performance with 70B parameters Phi-4: Developed by Microsoft. Despite only 2.7B parameters, outperforms 70B-class Llama-2 Gemma 3: Google’s user-friendly lightweight model DeepSeek-R1: Emerging model achieving high performance at low computational cost Mistral Small 3.1: Efficient model specialized for code generation

Benefits of Local Execution

Complete Data Privacy: All processing completed within company servers
Regulatory Compliance: Full compliance with data protection regulations like GDPR
Cost Reduction: Reduced API fees and elimination of network latency
Customizability: Fine-tuning possible with company data

Tools Facilitating Deployment

Ollama: Integrates LLM download, management, and execution. Can operate in air-gapped environments³ LM Studio: Easy execution of Hugging Face models via desktop app LocalAI: Supports large-scale deployment in Kubernetes environments

Gartner predicts that by 2027, half of the GenAI models used by enterprises will be industry-specific.

2025 AI Governance Framework

Essential Implementation Elements

According to the latest reports from IBM and Splunk, effective AI governance requires:

Multi-layered Responsibility Structure
- CEO/Executive: Ultimate responsibility
- Legal Department: Ensuring compliance
- IT Department: Technical implementation
- Business Units: Practical application
Clear Policy Documents
- Definition of permissible business scope
- Data classification and handling standards
- Explicit prohibition clauses
- Violation response procedures
Continuous Monitoring
- Visualization of AI usage
- Early risk detection
- Rapid response to regulatory changes

Preparation for EU AI Act

The EU AI Act, which will be implemented in phases from February 2025, will significantly impact Japanese companies. Key requirements:

Adoption of risk-based approach
Ensuring transparency
Mandatory human oversight
Strengthening data governance

Enterprise Solutions

OpenAI’s Enterprise Options

To address security concerns, OpenAI offers:

ChatGPT Enterprise:

No training on business data
Guaranteed ownership of input/output data
Control over data retention period
SAML SSO authentication
Granular access control

Important Difference: Unlike the public ChatGPT, the Enterprise version does not use user data for model training².

Realistic Hardware Requirements

Recommended specifications for local LLM execution:

GPU: NVIDIA RTX 4090 or higher, or AMD equivalent
RAM: Minimum 64GB (128GB recommended for large models)
Storage: High-speed SSD 1TB or more

Even for SMEs, these requirements are becoming within realistic cost ranges.

Practical Deployment Strategy

Recommended Phased Approach

Pilot Phase (1-3 months)
- Validation with non-confidential data
- Security assessment
- ROI measurement
Limited Deployment (3-6 months)
- Full-scale introduction in specific departments
- Policy adjustments
- Employee training
Company-wide Deployment (6 months onwards)
- Establishment of governance structure
- Continuous improvement process

Use Cases in AEC Industry

In the Architecture, Engineering, and Construction (AEC) industry, local AI enables:

Automated review of project documents
Site report generation
Contract drafting

All executable while protecting confidential information without risk of NDA violations.

Future Outlook: Predictions for Late 2025

Rise of Domain-Specific AI

Gartner predicts that by 2027, half of GenAI models used by enterprises will be specialized for specific industries and operations. These models will primarily be deployed on-premises or in private clouds, allowing enterprises to fully control data flow.

Rapid Changes in Regulatory Environment

2025 marks a regulatory turning point:

EU AI Act: Phased implementation from February
US AI Bill of Rights: Strengthened federal-level regulation
China AI Regulation: Establishment of unique regulatory framework

Enterprises need to build AI governance processes immediately and set standards that exceed regulations.

Key Lessons and Action Items

Three Emergency Measures Enterprises Should Take

Immediate Risk Assessment
- Inventory current AI usage
- Identify data leak risks
- Survey employee ChatGPT usage patterns
Establish Interim Policies
- Clarify definition of confidential data
- List permitted/prohibited tools
- Establish violation response procedures
Validate Alternative Solutions
- Conduct local LLM POC
- Analyze cost-effectiveness of enterprise versions
- Document security requirements

Business Impact

Real Examples of Cost Reduction

Companies using Ollama have improved data management while significantly reducing cloud costs. In addition to reduced API fees, productivity has improved through elimination of network latency.

New Definition of Competitive Advantage

AI governance creates value beyond mere compliance:

Improved AI adoption rates
Enhanced business outcomes
Trust building through transparency
Optimized resource allocation

Enterprises now stand at a crossroads balancing AI innovation with security. Whether to completely ban, transition to local AI, or invest in enterprise versions - the choice varies by company, but one thing is certain: remaining without a strategy means facing risks of serious data breaches, reputational damage, and penalties from regulatory violations.