ChatGPT

Is ChatGPT safe?

For corporate use, conditional approval under your policy: Tangerin AI places ChatGPT in the moderate exposure band. In the moderate band, exposure depends on the data that goes into the tool, and your policy needs to classify it explicitly.

Facts

Domain

chatgpt.com

Category

Language models

Data exposure

Moderate exposureMeasures the data exposure of using the tool, not the vendor's reputation.

Home country

United States

Does the free version train on your data?

Yes. On the free version, what you submit may be used to train AI models. (source)

Home country is the headquarters of the company behind the tool. It is not a claim about where data is processed or stored: data residency depends on the plan you hold and must be confirmed with the vendor.

What moderate exposure means

In the moderate band, exposure depends on the data that goes into the tool, and your policy needs to classify it explicitly.

What to do about it

Approval conditional on classification. The risk is not in the tool itself, but in the data that goes into it. Classify it as allowed, restricted or prohibited in your policy, communicate that to employees and keep the record. That is the evidence the NIST AI RMF and ISO 42001 ask for.

Here is the distinction almost every company gets wrong in its first audit: almost no framework (NIST AI RMF, ISO 42001, the EU AI Act) requires you to block AI tools; the exception is the EU AI Act's prohibited practices, such as inferring employees' emotions. What all of them require is that you know what is in use and have made a conscious, recorded decision about each item. A high-exposure tool approved under a written policy is compliance; a low-exposure tool in use with nobody aware of it is an audit finding.