Goldman Sachs bans public AI tools

November 3, 2026

Goldman Sachs bans public AI tools

Overview

In early 2024 Goldman Sachs announced a formal restriction on the use of publicly available generative‑AI services—including ChatGPT, Claude, and similar chat‑based assistants—for any employee‑initiated work. The decision was communicated through an internal memo and later referenced in public statements. While the bank’s exact wording is not publicly disclosed in full, the core of the policy is clear: any AI tool that processes proprietary data outside of Goldman’s controlled environment is prohibited until a compliance review is completed.

For programmers, analysts, and other knowledge workers, the ban raises practical questions:

• Which tools are affected?
• How does the policy intersect with everyday productivity workflows?
• What alternatives are available that satisfy security requirements?

This article breaks down the known elements of the ban, the rationale behind it, and actionable guidance for anyone who works in a regulated environment or simply wants to stay on the right side of corporate AI policies.

Why Goldman Sachs imposed the ban

Data confidentiality

Investment banks handle highly sensitive information: client portfolios, market‑moving research, and confidential deal terms. When an employee copies text into a public AI service, that data may be stored on external servers, used to improve the model, or inadvertently exposed through model outputs. Even if a service claims not to retain user data, the legal and technical guarantees are often limited.

Regulatory compliance

Financial institutions are subject to strict regulations such as the SEC’s Rule 10b‑5 (anti‑fraud), GDPR, and various data‑privacy statutes in the United States and abroad. Using an uncontrolled AI service could be interpreted as a breach of those regulations if the service processes personal data or confidential client information without appropriate safeguards.

Model hallucination risk

Generative‑AI models sometimes produce inaccurate or fabricated content—known as “hallucinations.” In a high‑stakes environment where a mis‑quoted figure or an incorrectly paraphrased legal clause could have material consequences, the risk is deemed unacceptable without thorough validation.

Intellectual‑property protection

Banks invest heavily in proprietary research, trading algorithms, and internal documentation. Exporting any part of that intellectual property to a third‑party model could compromise competitive advantage.

Scope of the policy

Goldman Sachs’ internal memo reportedly defines the ban in three broad categories:

1. Public AI chat services – Any web‑based conversational AI that is not hosted on Goldman’s own infrastructure. This includes free or paid versions of ChatGPT, Claude, Gemini, and similar products.
2. Third‑party code‑generation tools – Services that accept code snippets and return suggestions (e.g., GitHub Copilot, Tabnine) are covered unless they are expressly approved for use on a case‑by‑case basis.
3. AI‑enhanced productivity apps – Features such as AI‑driven summarization, translation, or spreadsheet assistance that rely on external APIs are also prohibited.

The memo emphasizes that “personal” use of these tools on non‑work devices is permissible, provided no Goldman data is involved. However, employees must still avoid using personal accounts to process any proprietary material, as that could be considered a data‑leak incident.

Immediate impact on day‑to‑day work

Coding and code review

Developers often rely on autocomplete or AI‑assisted suggestions to speed up routine tasks. With the ban in place, they must revert to traditional IDE features, static analysis tools, or internally approved plugins.

• Practical tip: Enable the built‑in IntelliSense (VS Code, PyCharm, etc.) and configure it to use only locally stored language servers.

Document drafting and email composition

AI summarizers and email generators have become common for drafting client briefs or internal reports. The ban requires staff to write these texts manually or use approved templates.

• Practical tip: Create a shared library of reusable boilerplate sections stored in a secure internal repository. Use version control to track updates.

Data analysis and visualization

Some analysts use AI to generate quick insights from data frames or to suggest chart types. The policy blocks external services that ingest raw data.

• Practical tip: Leverage open‑source libraries like pandas‑profiling, Sweetviz, or the built‑in describe() methods for exploratory analysis. For chart recommendations, maintain an internal style guide that maps data characteristics to visual types.

Approved alternatives and how to use them

Goldman Sachs has not published a public list of approved tools, but the memo indicates that any solution must meet the following criteria:

• Hosted within the firm’s network – The service runs on internal servers or a vetted cloud environment under Goldman’s control.
• Data residency guarantees – All processed data stays within the firm’s designated data centers.
• Auditable logging – Every request and response is logged for compliance review.

Building an internal “AI assistant”

Many large organizations have responded to similar bans by developing their own language‑model pipelines. For a team looking to replicate some of the productivity benefits without violating policy, the steps are:

1. Select an open‑source model – Options include Llama 2, Mistral, or Falcon. Choose a model size that balances capability with compute cost.
2. Deploy on a secure environment – Use the firm’s Kubernetes cluster or a dedicated VM with restricted network access.
3. Implement data‑filtering – Add a pre‑processing layer that strips or masks any client‑identifiable information before the model sees the text.
4. Add human‑in‑the‑loop validation – Require a reviewer to confirm the output before it is used in any client‑facing material.

Using vetted commercial APIs

If the firm contracts a cloud provider for AI services, the provider must sign a Business Associate Agreement (or equivalent) that outlines data handling responsibilities. In such cases, the API endpoint is typically reachable only through a private network link (e.g., AWS PrivateLink).

• Practical tip: When a vendor offers a “restricted‑access” endpoint, request a security assessment and ensure the endpoint is whitelisted only for approved IP ranges.

Lessons for other organizations

Goldman Sachs’ ban is not an isolated incident; other financial institutions and regulated sectors have issued similar directives. Teams can proactively align with best practices:

• Create a clear AI usage policy – Define which tools are allowed, under what circumstances, and who must approve exceptions.
• Educate employees – Conduct short training sessions that explain the risks of data leakage and the legal implications of using external AI services.
• Provide approved alternatives – Without a convenient substitute, employees may resort to shadow‑IT solutions that bypass controls.
• Monitor for policy violations – Use DLP (Data Loss Prevention) tools that can detect when sensitive text is sent to known AI endpoints.

By addressing the “why” and the “how” early, organizations can avoid the reactive scramble that often follows a high‑profile ban.

How developers can stay compliant

1. Check the tool list – Before installing any extension or using a web‑based AI service, verify its status on the internal approved‑tools registry.
2. Separate work and personal environments – Keep a distinct browser profile or virtual machine for personal AI experimentation. Do not log in with work credentials on personal devices.
3. Sanitize data before sharing – If you must discuss a problem with an external AI (e.g., on a public forum), remove all proprietary identifiers, client names, and confidential numbers.
4. Document usage decisions – When you request