Best Practices
AI-generated ChatGPT arrived in many companies long ago. Fast. Low-threshold. Effective.
And that is exactly where the problem lies.
Because what starts simply is often used without control - without clear rules, responsibilities or overview.
Here are the 5 most common mistakes we see in practice - and why they can get expensive in the long run.
Mistake 1: “Only marketing uses that”
ChatGPT is often seen as a single tool - used by marketing, HR or individual employees.
The reality: ChatGPT is used across the entire company. Often without the knowledge of management or IT.
Without an overview, nobody knows:
- who is using it
- what it is being used for
- which data is being entered
Problem: No overview = no responsible use.
Mistake 2: No clear rules for usage
Many companies have no clear policy on what is allowed - and what is not.
That leads to uncertainty:
- May I enter customer data?
- Internal documents?
- Drafts? Strategies?
Without rules, everyone decides for themselves. And that is not a concept - that is a risk.
Mistake 3: Responsibility is “somewhere”
Often there is no clear owner for AI tools like ChatGPT.
Typical situation:
- IT doesn’t feel responsible
- Legal isn’t involved
- Departments simply use it
Result: Nobody bears responsibility - but the company is liable.
Mistake 4: GDPR is “somehow” kept in mind
Many assume that standard tools are automatically GDPR-compliant.
The problem: usage decides compliance. Not the tool alone.
Without clear specifications on:
- data types
- purpose
- storage
- access
a data protection risk quickly arises - often unnoticed.
Mistake 5: Thinking it’s a one-time topic
“We sort it out once and then it’s fine.”
Unfortunately, no.
AI keeps evolving. Usage changes. Teams change. Tools are added.
Without structure, a starting project quickly turns back into chaos.
What helps instead
Companies that use ChatGPT sensibly do it differently:
- They create an overview before they regulate
- They define clear responsibilities
- They formulate understandable rules, not bans
- They train teams instead of slowing them down
- They see AI as an ongoing process, not a one-off action
Structure first. Security and speed follow automatically.
Conclusion
ChatGPT isn’t a risk - unclear usage is.
Those who create order now avoid later repair work, unnecessary costs and legal uncertainty.
The question isn’t whether ChatGPT is used - but how.
About the author
Jochen Stier is a co-founder of NADOVO with over 20 years of experience in process management and IT service management. He helps German SMEs implement the requirements of the EU AI Act systematically and pragmatically. The NADOVO Framework with its five phases combines regulatory requirements with practical feasibility, without corporate budgets or complex tools.