Guides
Short, practical answers to the questions companies ask about shadow AI, AI data leaks, EU AI Act AI literacy and privacy-friendly AI governance.
The most reliable way is to measure it where AI is used: in the browser. A browser extension for Chrome, Edge, Safari, Firefox, Brave, Opera, and the other browsers people use shows which AI sites they actually open, so you get a live inventory instead of a one-off survey. With VAHTOR, ChatGPT, Copilot, Claude, Gemini and the rest show up in one registry — without collecting what people type.
Read the answer →Combine a clear rule with a technical control at the point of use. Publish an AI policy that says which data must never go into AI tools, then enforce it in Chrome, Edge, Safari, Firefox, Brave, Opera, and the other browsers people use, where files and text are sent. VAHTOR’s Files rule cancels PDF, Excel and office file attachments to AI tools before they leave the tab, and credentials and secrets are flagged on the device.
Read the answer →Article 4 of the EU AI Act requires companies that provide or use AI systems, including staff using ChatGPT at work, to take measures that support their people's AI literacy. It has applied since 2 February 2025, and national authorities supervise it from August 2026. No certificate is required: keep an internal record of training and guidance.
Read the answer →Govern from usage metadata and on-device checks instead of chat content. To govern AI you need to know which tools are used, whether rules fired and who accepted the policy — not what people wrote. VAHTOR is built that way: prompt text is never collected, and admins see the tool, a detection type and a risk level, not the message.
Read the answer →An AI acceptable use policy tells employees which AI tools they may use, what data must never go into them, and who approves new tools. A usable template covers scope, approved and prohibited tools, data and file-upload rules, human review, AI literacy training, incident reporting and a review date. Record who accepted each version.
Read the answer →Control employee ChatGPT use with three layers: a written AI policy that every employee accepts, a decision for each tool (approve, restrict or block), and a browser-level control that stops sensitive files and secrets before they are sent. Offer an approved company account so staff are not pushed to personal accounts or phones.
Read the answer →You can block file uploads to ChatGPT without blocking ChatGPT itself. There are three methods: a browser data loss prevention rule on managed browsers, a secure web gateway or SSE policy with TLS inspection, or a CASB session policy on your company ChatGPT workspace. Each covers different devices and apps, and none covers personal phones.
Read the answer →An AI register is your company's list of every AI system and tool in use, with its owner, purpose, data, vendor terms, AI Act role, risk category, approval status and review date. The EU AI Act does not require most companies to keep one by name, but it is the practical basis for Article 4, Article 5 and high-risk checks.
Read the answer →Create a workspace, apply a trial code or choose a plan, then connect the extension.
Get started
