Are you using the free version of ChatGPT for board work? STOP IT!
A recent study by NHH Norwegian School of Economics on the use of AI among Norwegian non-executive board directors found that 39.6% of the respondents are using free tier applications, mostly ChatGPT, for processing of board documents.
I'm not even sure where to start this rant, so let's skip to the conclusion: STOP IT, RIGHT NOW!
Ok, I've calmed down.
Let's go over a few concrete aspects and arguments:
1) When free tools are (actually) fine
If your use of ChatGPT or similar applications is limited to drafting the board dinner speech and customer event invites, then you're fine to use a free version. Fundamentally, unless you pay to use the tool, YOU are the product. Every bit of information you enter and the corresponding output will be stored for future training. Nobody really cares about your dinner speech or customer event invites, so that's not problematic.
2) Personal licenses: a risky middle ground
A personal license may be sufficient for processing of board documents, only if you actively make sure to TURN OFF default sharing of data AND the information you enter is not personal data or very confidential information. Personal licences (and free licences) do not include data processor agreements. T
he key questions you should ask yourself are:
Do these documents contain personal data?,
Would I cause damage to the company if this information is leaked?
If the answer is yes to any of these, then a personal licence is not sufficient, no matter how much you paid for it.
3) Enterprise is not optional for sensitive data
For anything related to personal data, you have to have an enterprise-level licence. This is the level you need to be on to persistently ensure that data is not shared with the provider for future training and that the security level is sufficient for confidential information. Purchasing enterprise-level licences is surprisingly simple. In the most simple versions they are just a tiny bit more expensive and require a minimum number of seats (= users). Solvable in five minutes.
Governance, libaility, and a bigger probelm
As a non-executive board director, you carry a personal liability given by law. In no courtroom has the argument "I didn't know the law" exonerated a board director from responsibility. AI is indeed a thoughtlessness enabler, on many levels. According to the same report mentioned at the start of this article, over 50% of boards state that there is no specific AI expertise present on the board. So why are most non-executive boards not actively recruiting resources with AI + board work + (information security) competence?
If your board or leadership team would benefit from more constructive and informed discussions about AI, I work with organisations through keynotes and advisory engagements to create clarity and shared understanding.
Feel free to contact me to continue the conversation.
About the Author
Elin Hauge is a keynote speaker, AI strategist, and trusted advisor to business leaders and boards. She specialises in helping organisations make sense of artificial intelligence beyond the hype, connecting technology to strategy, governance, and real-world value. With a multidisciplinary background in physics, mathematics, business, and law, Elin brings both analytical rigour and practical perspective. Her talks and advisory work empower leaders to ask better questions, make wiser decisions, and navigate AI with confidence.
Frequently asked questions:
-
No. Free versions of ChatGPT may store and use input data for training. This creates risks when handling confidential or sensitive board information.
-
Only in limited cases. Personal licenses typically do not include data processing agreements, making them unsuitable for personal data or highly confidential information.
-
An enterprise license is required when handling personal data or sensitive company information, as it provides stronger security, compliance, and data protection guarantees.
-
Risks include data leakage, regulatory non-compliance, lack of data processing agreements, and increased personal liability for board directors.