AI Governance
What Is BYOAI (Bring Your Own AI)?
- Personal accounts
- Unmanaged tools
- Work data
Short answer
BYOAI, short for Bring Your Own AI, is employees using AI tools and accounts of their own choosing for work, such as a personal ChatGPT subscription, rather than tools their employer provides. The risk is that company data reaches providers the organization never reviewed, under consumer terms.
Maskflare Engineering Updated
What is BYOAI, and how is it different from shadow AI?
A sales manager has a paid personal AI subscription she likes. The company offers an approved workspace of a similar tool, but it is slower to get access to. She uses her own account to summarize call notes. Nothing was hacked and no rule was knowingly broken. That is BYOAI.
Shadow AI is the wider term: any AI use outside IT's knowledge or approval. BYOAI is its most common form, where the unapproved element is the account, not necessarily the tool. The same product can be fine under a company workspace and a problem under a personal login. That distinction is what makes BYOAI hard for a blocklist: you can't just block the domain.
Why do people do it?
- Speed: the personal account works today; the approved one needs a ticket.
- Quality: they prefer a tool the company didn't license, or a more capable plan.
- Gaps: the approved tool doesn't cover their task, such as code, images or transcription.
- Habit: they used it at home first and kept going.
Almost none of this is malicious. It is a signal that the approved route is harder than the risky one.
What are the risks of personal AI accounts at work?
| Risk | Why a personal account makes it worse |
|---|---|
| Personal data disclosure | No data processing agreement between your company and the provider, which is a problem under the GDPR when personal data is involved |
| Retention and training | Consumer settings may keep conversations or use them to improve models; you can't see or set them for the person's account |
| Loss of access and records | If the person leaves, the chat history with company information stays in their account |
| No audit trail | You can't scope an incident or answer a customer questionnaire |
| Regulated data | Patient or card data in a consumer account can breach HIPAA or PCI DSS duties |
Why does banning it rarely work?
A ban on personal AI accounts is easy to announce and hard to enforce. People switch to their phone or home laptop, and you lose the little visibility you had. A better approach is to make the company route as easy as the personal one, say what's allowed, and add controls on the devices you manage.
How do you manage BYOAI?
- Provide a good approved option. If the company workspace is as quick to get as a personal signup, much of the motivation goes away.
- Say which accounts are allowed. Spell out "company workspace yes, personal account no" in your acceptable-use policy.
- Find out how much it happens. Measure before you decide. Use discovery on managed devices.
- Enforce account type where you can. Allow the corporate account, block or restrict the personal one.
- Protect the data either way. Mask personal data and secrets in whichever account is used.
What can Maskflare do about BYOAI?
On managed devices with the desktop agent, AI app discovery tells corporate workspaces from personal accounts in ChatGPT and Claude. You can then choose per app: allow your workspace and block personal accounts, or allow both and mask more strictly on personal ones. A blocked personal account shows a message that points people to the approved alternative and your AI policy link, rather than a bare refusal.
The Workforce agent routes AI traffic through Maskflare, which masks personal data and secrets before they reach the provider so the work still flows. In AI web apps the answer isn't rewritten, so it may show tokens where it refers to masked values. Web apps covered include ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot. Browser protection covers browsers managed without the agent. User coaching can add a warning where a block is too blunt.
What can't it do?
- It can't see personal devices. Phones, home laptops and unmanaged machines are out of reach, which is why the approved route has to be attractive.
- Account detection covers specific apps. It works for ChatGPT and Claude; other apps are handled at the app level.
- It doesn't read prompts during discovery. Discovery records metadata only, never prompts, page addresses or general browsing history.
- It can't undo past use. What was pasted into a personal account before the control existed stays there.
BYOAI is one piece of wider AI usage control.
Frequently asked questions
Is BYOAI the same as BYOD?
No. BYOD is employees using their own devices. BYOAI is employees using their own AI tools or accounts, which can happen on a company laptop as well as a personal one.
Is using a personal ChatGPT account for work always a violation?
That depends on your policy. Many organizations allow only company workspaces for work data. If your policy is silent, that is the first thing to fix.
Can we allow a company workspace but block personal accounts?
Yes, for ChatGPT and Claude on managed devices with the Maskflare desktop agent. Other AI apps are allowed, tolerated or blocked at the app level.
Does Maskflare see what employees type into personal accounts?
Discovery records only metadata. Where masking applies, the content of AI traffic is processed in flight to find sensitive values, but the console shows counts and categories, never the values.
What if employees use personal phones?
Maskflare can't cover them. The practical answer is a policy, training, and an approved tool good enough that people don't reach for their phone.