Managing AI subscriptions and access.

Goal

Know every AI tool your team uses, make sure business work runs on accounts the business controls, and remove access cleanly when people leave.

Who it is for

Owners, office managers and Microsoft 365 or Google Workspace admins in New Zealand businesses of roughly 5 to 200 people.

Time

30 minutes.

You need

ChatGPT, Claude, Copilot or Gemini and the fictional tool list below. Later, your own expense records and admin consoles.

You will produce

An AI access register, a list of fixes, and joiner, mover and leaver steps.

Why does AI access need managing?

Because AI tools arrive one credit card at a time. A year after the first subscription, most teams have a mix of business seats, personal accounts on expense claims, free tools, and assistants quietly connected to mailboxes. Nobody has the full list, and nobody removes access when people leave.

The privacy stakes are clear. The Privacy Commissioner’s guidance on working with third-party providers says “Your organisation is responsible for your personal information when stored or processed by a third-party provider.” You cannot meet that duty for tools you do not know about.

How do personal and business plans differ?

The difference is ownership and defaults, not just price. As listed on 19 October 2026:

Exercise: build an access register

The studio and its tool list below are fictional, but every pattern in it is common.

Illustrative tool list. Fictional design and marketing studio,
Nelson, 16 staff. Compiled from a staff survey and expense claims.

1. ChatGPT Business workspace: 5 seats bought, 3 assigned.
   Admin: Tom. Members include Kim, who left in August.
2. Aroha: ChatGPT Plus on her personal card, expensed monthly.
   Uses it for client campaign copy.
3. Ben: Claude Pro personal account, connected to his personal
   Google Drive, where he keeps client briefs.
4. Microsoft 365 Business Standard with Copilot for all 16 staff.
   Admin: Tom.
5. A free AI meeting note-taker added by two staff. It joins
   client video calls automatically through their calendars.
6. Intern uses Gemini on a personal Gmail account for research.
7. Free image generation app used by the design team for mock-ups.

1. Run the register prompt in the worked example below.
2. Check the data column. For each personal account, confirm the training setting on the vendor’s own page rather than trusting the AI’s summary.
3. Find the leaver. Kim still has a seat. Remove her, and check whether any shared projects or connections were in her name.
4. Deal with the note-taker. An unapproved tool recording client calls is the highest risk item here. Pause it until someone decides whether it is allowed and clients are told.
5. Write joiner, mover and leaver steps. Three short checklists: what AI access a new starter gets, what changes when someone moves role, and what is removed on their last day.
6. Book the review. Put a quarterly review in the calendar, owned by one named person.

Worked example: the register prompt

From the tool list below, build an AI access register as a table:
Tool | Plan type (personal / business / free) | Users | Admin owner
| Connected apps or data | Client data involved? | Cost and
renewal | Risk (high / medium / low) | Action

Then list the five most urgent actions in order. Flag any leaver
with access, any unassigned paid seats, and any tool that records
or reads client information outside a business account. Do not
guess vendor data policies; write "check vendor terms" instead.

[paste tool list]

Example output (illustrative and abridged; your tool’s wording will differ):

Meeting note-taker | free | 2 | none | calendars, client calls |
Yes | $0 | High | Pause; decide policy; tell clients if kept

Claude Pro (Ben) | personal | 1 | none | personal Google Drive with
client briefs | Yes | expensed | High | Move briefs to studio
Drive; move work to a business plan

ChatGPT Business | business | 3 of 5 seats | Tom | none listed |
Yes | check renewal | Medium | Remove Kim; assign or drop 2 seats

Urgent actions
1. Pause the meeting note-taker on client calls.
2. Remove Kim from ChatGPT Business today.

Note the unassigned seats. OpenAI’s billing page says you are charged for all seats “whether or not they’ve been assigned to individual members.”

What should joiner, mover and leaver steps cover?

Treat AI access like any other system access, at the same three moments:

• Joiner: create the business AI account through your normal sign-in, add the person to the right workspace or projects, confirm they have read the AI use policy, and record it in the register.
• Mover: review which shared projects, assistants and connections they still need, and remove access that belonged to the old role, especially client-specific projects.
• Leaver: remove the seat on the last day, transfer ownership of shared projects, assistants and prompt libraries they created, disconnect apps they authorised, and reassign or cancel the seat so you stop paying for it.

Where this goes wrong

• Banning without providing. Prohibiting personal accounts without offering an approved tool pushes use underground.
• Offboarding that forgets AI. Add AI workspaces, projects and connected apps to the leaver checklist next to email and Xero.
• Connections nobody reviews. An assistant connected to a mailbox keeps that access until removed. See understanding AI tool permissions.
• Data location ignored. Where a tool processes data matters for client contracts; our engineering guide to data residency for AI systems covers the options.
• A register that is never updated. It must change whenever access changes, or it becomes fiction.

Check your work

• My register lists every AI tool, including free tools and browser or calendar add-ons.
• Every business tool has a named admin owner.
• No leaver still has access to any AI workspace, project or connection.
• Client work is moving off personal accounts, with a date.
• Joiner, mover and leaver steps include AI access.
• A quarterly review is booked with one person responsible.

Where to go next

Next in the pathway: recognising prompt injection, the risk that grows with every connection in your register. To choose the right plans, see choosing business AI subscriptions, and to set the rules people follow, creating a team AI use policy with our AI use policy template. Record which data each tool touches in the AI data inventory template. For larger organisations with many tools and teams, our AI governance advisory sets up ownership and review.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.