Banning AI tools feels like governance. It isn't. It just pushes AI use onto personal accounts where nobody can see it anymore. Companies that give employees an approved alternative see less unauthorized use, not companies that write stricter bans.

Someone at your company already tried an AI tool once. If you blocked it, that didn't stop them. It just moved where they use it, from a monitored corporate account to a personal phone on personal data, somewhere your compliance team can't see.

That's the problem with treating a ban as a governance strategy. A ban is a single action taken once. Governance is an ongoing understanding of what's actually happening. When a company confuses the two, it gets the comfort of having "done something" and loses the visibility it had before.

Why do so many life sciences companies start with a ban?

A ban is fast, cheap, and easy to defend in an audit. Legal can write it in an afternoon. Compliance can point to it as proof they took the risk seriously. For a company that just found out AI tools are already in use, blocking access feels like the responsible move.

It also matches how most policies work in a regulated industry. Life sciences companies are built around rules that say "don't do this." A ban fits that pattern. It's the same shape as a rule about handling clinical trial data or a rule about off-label promotion: a clear line, easy to write down, easy to train on. The problem is that AI tools don't behave like the things those rules were written for. A clinical trial rule governs something that happens inside systems your company controls. AI use happens in a browser tab on a personal phone, five feet from where a rule can reach it. You can block a browser tab on a corporate laptop, but you can't assume the behavior stopped. It just moved.

There's also a timing problem. Most bans get written after someone already noticed AI use happening, not before. By the time the policy goes out, the habit is already formed. Asking people to give up a tool that's already made their week easier is a much harder sell than asking them not to start using it in the first place.

What actually happens after a company blocks AI tools?

People keep using AI. PagerDuty's 2026 Shadow AI Survey, conducted by Wakefield Research among 1,250 office professionals at large companies, found that 66% had used an AI tool at work despite believing it wasn't allowed under company policy. At companies with 1,500 or more employees, that number rose to 72%. More than half who got an informal warning kept using AI anyway, and nearly half who faced formal discipline still didn't stop.

A policy that gets ignored by most of the people it applies to isn't controlling behavior. It's just removing your ability to see it. This isn't unique to AI. We saw the same pattern play out recently when Google had to reverse a mandatory AI health policy after employee pushback made it clear the mandate wasn't landing the way leadership expected. People don't quietly comply with rules that don't match how they actually want to work. They route around them, and once they're routing around a rule, the company that wrote it has no idea what's happening anymore.

Why did Samsung reverse its own ChatGPT ban?

Samsung banned ChatGPT and other generative AI tools for employees in May 2023, after an engineer accidentally leaked sensitive source code by pasting it into ChatGPT. The company's reasoning was straightforward: once data leaves through a public AI tool, you can't easily retrieve or delete it. Samsung wasn't alone. Around the same time, JPMorgan, Amazon, and several major banks put similar restrictions in place, all worried about the same thing: sensitive information leaving the building through a chat window.

Three years later, Samsung reversed course completely. In June 2026, Samsung's DX Division officially adopted ChatGPT, Gemini, and Claude for employees company-wide, after testing all three with roughly 2,500 employees first. Samsung's own explanation was that supporting multiple approved services reflected a deliberate choice to let employees use the best tool for the job, not a one-time policy decision made and forgotten. Notice what changed between 2023 and 2026. It wasn't that the data risk disappeared. It was that Samsung stopped trying to solve the problem with a memo and started solving it with a program: a tested rollout, a defined scope, and a real evaluation of which tools were actually worth trusting. The ban bought time. It didn't solve the underlying problem. Building a sanctioned path did.

Register for the September 24 webinar

What works better than blocking?

Give people a real alternative, and pair it with actual visibility into how it's used. Wolters Kluwer's December 2025 survey of healthcare workers found that among employees who used an unauthorized AI tool, roughly a third pointed to a simple reason: there was no approved option, or the approved option didn't do what they needed. That's not a workforce trying to break the rules. That's a workforce trying to do their job with the tools available to them.

Gartner's own research backs this up at a broader scale: in a survey of cybersecurity leaders, 69% said their organization suspects or has evidence that employees are using prohibited generative AI tools. That's true almost everywhere, ban or no ban. The difference between a company managing that reality and one that isn't comes down to whether they can see it happening.

This is exactly what we argued in the first post of this series: visibility has to come before the framework, not after. Give people an approved tool that's actually good enough to choose over the personal alternative, then build real oversight around what you learn once you can see it. That combination, and not a stricter memo, is what closes the gap. It's also the same principle behind holding AI agents accountable once they're doing more than answering questions, a problem this series covers later.

None of this means life sciences companies should wave AI through without limits. Data handling, patient privacy, and regulatory review still matter, and some uses genuinely do need a hard stop. The distinction is between blocking a category of tool outright and building a program that channels people toward something safer. One removes visibility. The other creates it.

Frequently asked questions

Does banning AI tools stop employees from using them?

No. Most employees who use AI at work despite a ban keep using it, even after getting a warning. A ban mainly removes a company's visibility into that use rather than stopping it.

Why did Samsung reverse its ChatGPT ban?

Samsung banned generative AI tools in 2023 after a data leak, then reversed course in 2026 by testing and officially adopting ChatGPT, Gemini, and Claude company-wide, choosing a managed rollout over an indefinite block.

What should a life sciences company do instead of banning AI tools?

Provide an approved AI tool that's good enough that employees choose it over a personal account, and pair it with real visibility into how AI is actually being used across the organization.

Why do employees keep using AI tools even after a warning or discipline?

Often because no approved alternative exists, or the approved option doesn't do what they need. Employees are usually trying to work faster, not trying to break policy.

Save your seat for "AI Adoption Is Accelerating, But Where Is the Oversight?"