AI in Your Business: 7 Rules So the Boss Keeps the Wheel (on Chefgeflüster #42)

An employee pastes a quote, customer address included, into the free version of ChatGPT because it is faster. The boss never finds out. That is exactly where the risk begins, and seven simple rules contain it.

With them, you use AI without giving up control. Each rule ends with steps you can take this very week. The occasion is episode #42 of "Chefgeflüster by Lars und Silvio": Alexander Weipprecht, managing director of Provimedia, was a guest there, available to listen to on Spotify.

The rules at a glance

1. No customer data in the free version of ChatGPT.
2. Check AI answers before they go to the customer.
3. Expect incidents at the provider and be prepared.
4. Promote your team's AI literacy and document it.
5. Describe processes before you automate them.
6. Control whether AI searches find your website.
7. Introduce a phone AI only with clear ground rules.

Rule 1: Why does customer data not belong in free ChatGPT?

A private free account is no place for personal customer data if your business has no contract with the provider. This applies to the quote with an address just as much as to the site measurement with names.

• Anyone who has a service provider process personal data needs a data processing agreement under Art. 28 GDPR.
• For ChatGPT Business, Enterprise and the API, OpenAI offers a Data Processing Addendum. For a private free account, there is no such contract with your company.
• For services for individuals, OpenAI may use content for training, according to the help article. This can be switched off in the data controls ("Improve the model for everyone").

What this means for your business:

• Define in writing which AI accounts are allowed.
• List which data never belongs in a free account, such as the names, addresses and orders of your customers.
• Have a business quote checked in advance from a data protection perspective.

Rule 2: Why do I have to check AI answers?

Because training and evaluation reward guessing. The OpenAI study "Why Language Models Hallucinate" (Kalai, Nachum, Vempala, Zhang, September 2025) compares it to a multiple-choice test: a blank answer surely earns zero points, a guessed one at least a chance.

The accompanying post gives an example from a knowledge test. An older OpenAI model abstained in 1% of cases and was wrong in 75%. A newer one abstained in 52% of cases and was wrong in 26%.

The newer model says "I don't know" more often and is wrong less often. An AI that never hesitates is not a good sign. Anyone who has the AI draft the reply to a complaint about defects should therefore never send it unchecked.

What this means for your business:

• Have a person check AI output that concerns customers or contracts.
• Ask for a source for factual statements and open it yourself.
• Keep your price and material calculation as a separate document and let the AI answer from it.

Rule 3: What happens if something goes wrong at the AI provider?

Data can become visible to third parties, even without a hacker attack. The incident of 20 March 2023 was not an attack but a software bug.

During a window of about nine hours, data could be visible to other users for 1.2% of the ChatGPT Plus subscribers active at the time: name, email, payment address, the last four digits of the credit card and the expiry date. Full card numbers were never affected.

What this means for your business:

• Note who in your business examines and reports a data breach.
• Keep a list of the AI services your business uses, so that when a provider reports an incident you know whether you are affected.

Rule 4: What does the AI Act require for AI literacy?

It requires companies to promote the AI literacy of their staff. There is no certificate prescribed by law. Where things stand:

• Art. 4 of Regulation (EU) 2024/1689 has applied since 2 February 2025.
• Since the Digital Omnibus Regulation (in force since 27 July 2026), providers and deployers must "promote" AI literacy; before, it said "ensure".
• The law does not require a particular level of knowledge per employee.
• Since 2 August 2026, the Bundesnetzagentur (Federal Network Agency) has been the supervisory authority in Germany.

Proof of training documents the promotion. One example is our AI literacy training with a participation certificate. Anyone who uses an AI summary at a customer meeting should know what it can and cannot do.

What this means for your business:

• Train your team.
• File the proof with the date, participants and content.
• Name one person who keeps the proof up to date.

Rule 5: Why describe processes first?

Because AI can only automate what someone has described. This also shows in projects at Provimedia: anyone who knows their processes can deploy AI solutions and process automation in a targeted way. With the quote this is especially tangible: from site measurement to dispatch.

What this means for your business:

• Write down a frequently recurring process in individual steps before you hand it to a tool.
• Note who does what with what, and what the result is.
• Mark exceptions where a person has to decide.

Rule 6: How do ChatGPT and others find my business?

Through crawlers that you can control. According to the OpenAI documentation, the OAI-SearchBot makes websites discoverable in ChatGPT search, while the GPTBot collects training data. You control both through robots.txt. If a customer asks the AI about a business in your region, your site should be able to show up. More at SEO and visibility in ChatGPT & Co.

What this means for your business:

• Open yourdomain.de/robots.txt and check whether the OAI-SearchBot is blocked with Disallow; if so, ChatGPT search does not find your site.
• Decide separately whether the GPTBot may use your pages for training.
• Hand this check to your web agency or whoever looks after your website.

Rule 7: What should I watch for with a phone AI?

In the episode, Silvio explains why he abolished his phone AI again. Anyone who wants to introduce one sets the ground rules beforehand, for example for the call of a customer who wants to reschedule their appointment.

What this means for your business:

• Define when the AI hands the call over to a person.
• Decide who listens to conversations on a spot-check basis.
• Tell callers at the start that an AI is speaking.

Frequently asked questions

Is ChatGPT Plus enough for customer data?

No, that should not be assumed. Plus is an offering for individuals. OpenAI offers the data processing agreement for Business, Enterprise and the API.

May I use ChatGPT for quotes if I leave out customer names?

Without personal data, the data protection problem of this kind largely falls away. Note, however, that an address, phone number or an unambiguous description of the building site can also make a person identifiable. If in doubt, have it checked.

Is an internal briefing enough as proof?

Art. 4 requires neither a particular format nor a certificate. What matters is that the promotion takes place and is traceable. Therefore document the date, participants and content.

Does blocking the GPTBot hurt my visibility?

According to the OpenAI documentation, the settings are independent of each other. Anyone who blocks only the GPTBot can still be found in ChatGPT search, as long as the OAI-SearchBot is allowed.

About the episode

Episode #42 of "Chefgeflüster by Lars und Silvio" was released on 11 October 2026 and runs 1:37 hours. The hosts are Lars Piezl (entrepreneur, mentor and speaker) and Silvio Kremzow (master painter), more at chefgefluester.rocks. Alexander Weipprecht has been developing software for about 20 years; for two years, Provimedia has built exclusively AI solutions for companies. The rules follow the topics of the episode; figures and evidence come from the linked sources. What exactly was said in the conversation, you are best off hearing for yourself.

General information, not legal advice.

Sources

• GDPR (Regulation (EU) 2016/679), Art. 28
• OpenAI Data Processing Addendum
• OpenAI Help: Data controls and model training
• OpenAI: Why Language Models Hallucinate
• Kalai et al., Why Language Models Hallucinate (arXiv:2509.04664)
• OpenAI: March 20 ChatGPT outage
• EU AI Act, Regulation (EU) 2024/1689
• OpenAI crawler documentation
• Podcast episode #42 on Spotify
• Chefgeflüster: podcast website

As of: 12 October 2026