Free ChatGPT Plus in Malta: How to Use AI Safely at Work

Malta’s AI for All programme has put a free, year-long AI subscription in the hands of thousands of people, and many of them will bring it to work. That is good news for productivity, but it also means company information is about to flow into personal AI accounts that the business does not control. This guide explains what the programme is, where the risks are, what staff can safely use it for, and how to set simple rules without slowing anyone down. It is general information, not legal advice.

What is the AI for All programme?

AI for All (AI Għal Kulħadd) is a national AI literacy programme led by the Malta Digital Innovation Authority, with course content developed by the University of Malta. Citizens and residents sign in with their eID, complete three core modules on AI fundamentals, everyday use and learning, and then receive a free 12-month subscription to an AI platform.

Take-up has been strong. According to The Malta Independent, more than 29,000 people registered in the first seven weeks, and 15,839 had completed all three courses and received their subscription by early July 2026. Reports describe the subscription as a choice between ChatGPT Plus and Microsoft 365 Personal.

For employers, the important detail is that these are personal subscriptions, owned and managed by the individual, not by the business.

Can employees use their free subscription for work?

They can, and many already do. Nothing in the programme stops someone using their subscription for work tasks, so the decision sits with each employer. Banning it outright is hard to enforce and wastes a useful tool. Allowing it without any rules puts company and client data at risk.

The sensible middle ground is to allow personal AI for low-risk work, keep sensitive information out of it, and provide a business-grade option for anything that needs company data.

What are the risks of using personal AI accounts at work?

Training on your data

On personal ChatGPT plans, including Plus, conversations can be used to improve OpenAI’s models unless the user switches off “Improve the model for everyone” in Settings under Data Controls. ChatGPT Business and Enterprise exclude company inputs and outputs from training by default. Even with training switched off, conversations are still stored by the provider for a period.

Personal data and GDPR

If an employee pastes a client’s name, ID details, health information or financial records into a personal AI account, the business is still responsible for that personal data under the GDPR. It has no contract with the provider covering that use, no control over where the data goes and no easy way to respond if a client asks what happened to their information. In Malta, the Information and Data Protection Commissioner oversees how organisations handle personal data.

No visibility or control

A personal account has no admin console. The business cannot see what was shared, cannot set retention rules, and loses access to everything when the employee leaves, including any useful work that was done in it.

Confidential information

Contracts, pricing, unreleased plans, tender responses and internal figures can all end up in a chat window. Even where training is off, that information now sits outside the business.

What can staff safely use personal AI for?

Use	Examples	Personal account?
General drafting	First drafts of emails, posts and job adverts with no client details	Yes
Learning and research	Explaining a regulation, summarising a public report, learning a spreadsheet formula	Yes
Internal documents	Procedures, meeting notes and plans without names or figures	With care
Client or staff data	Names, ID documents, contact details, health or financial records	No
Confidential business data	Contracts, pricing, accounts, tenders, legal matters	No

A simple test helps: if you would not be comfortable emailing the text to someone outside the company, do not paste it into a personal AI account.

A one-page AI policy for staff

Most businesses do not need a long policy. A single page that everyone reads covers most of the risk. It should say:

1. Which tools are approved for work, and which accounts (personal or business) can be used for what.
2. What never goes in: client and staff personal data, confidential figures, contracts and anything covered by a non-disclosure agreement.
3. Settings to check: anyone using a personal account for work switches off model training in the data controls.
4. Checking the output: AI can be confidently wrong. Facts, figures, legal points and anything sent to a client must be checked by a person.
5. Being open about it: customers should be told when they are talking to an AI, and AI-written content should be reviewed before it is published.
6. Who to ask: one named person for questions, new tools and anything that may have gone wrong.

Writing this down also helps with the EU AI Act, which already expects organisations that use AI to make sure their staff have a sufficient level of AI literacy. Our guide to what the EU AI Act now requires of Maltese SMEs explains this and the other dates that apply. The AI for All course is a good general foundation, but staff still need to know your own rules.

When does a business need its own AI setup?

Personal accounts are fine for general work. Once the useful tasks involve your own documents, clients or figures, a business-grade setup becomes worth it. There are two common routes:

• A business plan from a major provider, such as ChatGPT Business or Enterprise, or Microsoft 365 Copilot for business. These exclude company data from training by default and give you admin controls, shared workspaces and offboarding.
• A private AI assistant built on your own information, such as policies, procedures, product details and past work. Staff ask questions in plain language and get answers with links to the source, while access stays limited by role and the data stays under your control.

We set up both as part of our work to give teams secure AI tools, and for regulated firms we build assistants that let staff ask questions of their own documents safely. Our guide to whether to build, buy or configure AI tools helps decide which route fits.

How to get started this month

1. Ask who is using AI already. A short, no-blame survey usually shows more use than managers expect.
2. Write the one-page policy and share it with everyone, including the list of approved tools.
3. Run a 20-minute session on what is safe to share, how to switch off training and how to check AI output.
4. Pick one or two tasks where AI clearly saves time, and decide whether they need a business plan or a private assistant.
5. Review after a month and update the policy based on what people actually use.

Frequently asked questions

Want your team using AI with your own data, safely? Book a free discovery call with Haystack and we will help you choose the right setup and write the rules around it.