AI bans are often a blunt response to organisational challenges such as rapid change, data risk, regulatory concerns, and gaps in skills and governance.
On the one hand, AI is taking the world by storm. On the other, many public and private organisations are actively banning its use. Recently, the local government organisation where I serve in my capacity as a councillor announced a total ban on AI within the organisation’s network. My first thought was, “what the heck!” But thinking about it more deeply, there are genuine underlying issues driving the decision to restrict AI access. This is just one example I’ve experienced first-hand, but public and private organisations everywhere seem to be taking the same stance. In my experience, the four points below outline the key reasons why organisations are making these difficult decisions, despite the undeniable benefits.
Adoption that feels too fast
Generative AI developed more quickly than most governance and risk teams could manage, leading many boards to implement the simplest control: blocking it on the network. Recent privacy and security studies show that about a quarter of organisations have temporarily banned generative AI tools, despite recognising their productivity benefits.
Major companies such as JPMorgan Chase, Apple, Northrop Grumman, Verizon, and Spotify have restricted or blocked staff use of public tools like ChatGPT, primarily due to risk concerns rather than a lack of value. In the public sector, New York City’s Department of Education banned ChatGPT on school devices and networks over concerns about academic ethics and overreliance on automated answers. These actions are not anti-innovation but are intended to pause usage until internal controls are established.
Data security and privacy
The primary risk is not the AI model itself, but the information users enter into it. Cisco and other studies report that over a quarter of organisations have banned generative AI because employees were entering internal processes, confidential company data, and customer information into consumer tools. Microsoft research in the United Kingdom indicates that seventy-one per cent of employees have used unapproved consumer AI tools at work, with more than half doing so weekly, often without clear guidance.
For banks, fintechs, or local government bodies holding sensitive citizen data, this poses a serious risk: trade secrets may be included in training data, or case notes and personal details may be stored on third-party servers outside standard controls. Until secure enterprise AI, data loss prevention, and clear usage policies are in place, many organisations consider blocking public AI on the corporate network the safest interim measure.
Regulation and compliance pressure
Generative AI now sits inside a dense regulatory setting. Under data protection rules such as the General Data Protection Regulation, unlawful transfer or misuse of personal data can lead to fines of up to 4% of annual worldwide revenue. The European Union’s AI Act imposes additional obligations on developers and users of higher-risk AI systems and general-purpose models, including risk assessments, documentation, human monitoring, and disclosure of AI-generated content.
Public bodies have additional responsibilities for fairness, accountability, and transparency. European Parliament analysis warns that poorly governed AI can undermine trust in public services. Given unclear case law and the risk of significant penalties, many organisations choose a temporary ban while they conduct impact assessments, map AI use cases, and update compliance frameworks for both staff and third-party tools.
Skills, culture and the prompt gap
Even when tools are available, not all organisations have the necessary skills to use them safely. People management research notes a trend of staff using AI as a substitute for judgment, resulting in output that may appear refined but can be inaccurate, biased, or poorly sourced. Public-sector AI analysts have raised similar concerns, warning that uncritical use of generative models can reinforce historical biases and weaken professional decision-making.
This skills gap extends beyond prompt engineering. It includes computer literacy, critical thinking, and understanding when AI should support rather than replace human expertise. Without practical training and clear data-sharing rules, leaders are concerned about plagiarism, confidentiality breaches, and decisions based on inaccurate output. For both companies and government bodies, a short-term ban can provide time to develop training, set expectations, and define which AI uses are encouraged, restricted, or prohibited.
Across private and public sectors, absolute bans are rarely permanent. Studies and industry commentary indicate a shift from “no AI” to “AI with guardrails,” where organisations approve specific tools, restrict data sharing, and integrate AI policy into daily operations. Experts increasingly argue that banning generative AI drives its use underground, and that clear, accessible policies for safe and ethical use are more effective.
For councils, ministries, banks, and fintech scale-ups, the goal is to turn initial uncertainty into a systematic approach: assess risks, select secure architectures, upskill staff, and transition from blanket bans to confident, compliant adoption. When managed effectively, AI becomes a trusted partner for public and private organisations rather than a tool kept outside the firewall.
About the Author: Suraj Gyawali is the Founder and CTO of Simplified Solutions. If your organisation is facing similar dilemma with AI governance or digital risk, feel free to get in touch via our contact form.
