How to Block Personal AI Accounts on Firm Devices

Can a firm block personal ChatGPT and AI accounts but still allow approved AI tools?

Yes. The major AI providers now support tenant restrictions: your web proxy or security service adds a header to traffic bound for the AI service, naming the firm's approved workspace or organization. Sign-ins to any other account, including personal ones, are refused on firm devices and networks, while the firm's own licensed workspace keeps working.

This is the control that turns an AI policy line such as "use only firm-approved AI accounts" into something you can show an examiner is enforced. Blocking the AI site outright can push staff toward personal phones. Blocking only personal accounts keeps the approved tool available and the data inside a contract the firm controls.

Why is a personal AI account a compliance problem for advisers and broker-dealers?

Because client information typed into a personal account leaves every safeguard the firm is required to maintain. Regulation S-P, 17 CFR 248.30(a), requires written policies and procedures to safeguard customer information and protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer. With the amended rule's compliance dates now passed for larger and smaller entities alike, examiners can test those procedures against how staff actually work. A Reg S-P data map shows which client data staff are most likely to paste into an AI tool.

The terms differ by account type. OpenAI states that it may use content from individual accounts to train its models unless the user opts out, and that by default it does not train on business products such as ChatGPT Enterprise. A personal account also gives the firm no admin console, no audit log and no way to retrieve the conversation later.

Recordkeeping follows. Advisers must keep certain written communications under Rule 204-2(a)(7), and broker-dealers must preserve business communications under Rule 17a-4(b)(4). For dual-registered firms and FINRA members, Regulatory Notice 24-09 reminds firms that supervision and communications rules apply to generative AI like any other technology. Whether a particular AI exchange is a required record depends on its content, and that call belongs to the CCO and counsel. A personal account removes the firm's ability to make it at all. The archiving side is covered in our guide to off-channel communications and AI notetakers.

How do tenant restrictions work for each AI provider?

Each provider uses its own header, injected by a proxy or security service edge platform that can inspect TLS traffic:

• ChatGPT: OpenAI's corporate network controls use the ChatGPT-Allowed-Workspace-Id header with your workspace ID, applied to chatgpt.com. Personal workspaces are filtered out. OpenAI documents this header for ChatGPT Enterprise. On other ChatGPT business plans, web filtering and DLP rules can still tell personal accounts apart from the firm's approved workspace and enforce the difference.
• Claude: Anthropic's tenant restrictions use the anthropic-allowed-org-ids header, which Anthropic offers to Enterprise plans and Console organizations. Users outside the allowlist see an "Access restricted by network policy" message. The restriction covers web, desktop and API access.
• Google Gemini and other Google services: the X-GoogApps-Allowed-Domains header blocks sign-in to Google services with any account outside your listed Workspace domains, including personal Gmail accounts.
• Microsoft: tenant restrictions v2 in Microsoft Entra, available with Entra ID P1 or P2, can block sign-in with personal Microsoft accounts and with other organizations' tenants. It can be enforced through a proxy, Windows Group Policy, or Microsoft's Global Secure Access client.

One firm-wide policy can carry all four headers. If the firm has not licensed a business plan for a given provider, blocking that service entirely is the simpler choice.

What does the setup require?

Three things most small firms need to plan for. First, TLS inspection: every provider above requires the proxy to decrypt and re-encrypt traffic to add the header, which means deploying a trusted certificate to firm devices. Second, coverage off the office network: a cloud security service with an agent on each laptop applies the header at home and on the road, where a proxy in the office does not reach. Third, the apps: OpenAI notes that its desktop and mobile apps use certificate pinning, so firms either distribute their certificates through device management or block the app domains and direct staff to the browser.

Two gaps need their own rules. Logged-out use of ChatGPT does not involve any account, so OpenAI advises blocking URLs beginning with chatgpt.com/backend-anon. Personal phones on cellular data are outside these network controls, so the written policy and attestation still matter.

How do you handle AI tools that have no tenant controls?

Block by category and by data. Many smaller AI tools offer no enterprise header at all. Web filtering can block the generative AI category by default and allow approved services by exception. For data protection on approved and unapproved sites alike, Microsoft Purview can block sensitive text and uploads to unmanaged AI apps in Edge for Business on managed Windows devices, and Endpoint DLP can restrict pasting sensitive content into supported browsers. Account numbers and Social Security numbers are sensible first patterns to enforce.

What evidence should you keep for an examiner?

The SEC's fiscal year 2026 examination priorities named the Regulation S-P amendments, cybersecurity and the use of emerging technology and AI. FINRA's 2026 oversight report lists effective practices that include formal approval of AI use cases and written policies to develop, implement, use and monitor generative AI. A firm that blocks personal accounts should be able to hand over:

• The written AI policy naming approved tools and prohibiting personal accounts for firm business.
• The list of approved workspace and organization IDs and who approved each.
• Configuration exports or screenshots showing the headers and category blocks in force, with dates.
• Block logs showing the control working, reviewed on a set schedule.
• Staff attestations and training records.
• The annual review of the control, filed with the firm's compliance program review.

What to do this quarter

• Decide which AI tools the firm licenses at the business tier and record their workspace or tenant IDs.
• Confirm your proxy or security service can inspect TLS and inject custom headers, and that it covers laptops off the office network.
• Pilot the headers with the compliance team for two weeks, then roll out firm-wide with a notice to staff.
• Block logged-out ChatGPT use and the generative AI web category, with exceptions for approved tools.
• Add DLP rules for account numbers and Social Security numbers on AI sites.
• File the configuration evidence with your Reg S-P safeguards documentation.

How s90 helps

s90 configures AI guardrails for advisers and broker-dealers: tenant restrictions for approved AI workspaces, category blocking for everything else, and DLP rules for client data, all on firm devices wherever staff work. We document each control in a form your CCO can hand to an examiner and review it with you every year. If you want to see which personal AI accounts are in use at your firm today, start with an AI usage review.