In short
To block AI tools at work, first discover which AI apps, extensions and agents are in use, approve a business-grade tool, then block unapproved apps at the browser and device, not only with DNS or URL lists. Where possible, restrict instead: redaction, warnings and copy and paste limits keep a safe way to use AI.
Get a quote for AI tool blocking and control
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Should you block AI tools at all?
Sometimes, yes. Some AI services have data terms, storage locations or security practices your organisation cannot accept, and blocking them is the right call. But blocking every AI tool rarely works for long:
- People who find AI useful will use it on a personal phone or laptop, where you have no visibility or control
- AI features are now built into many of the SaaS apps you already pay for, so "AI" is not a category you can switch off at the network edge
- The list of AI tools changes every week, so a block list is out of date as soon as you finish it
The approach that holds up is to approve, restrict and block: give people a business-grade tool, restrict others so sensitive data cannot reach them, and block only what carries unacceptable risk. Our page on what is shadow AI explains why the problem exists in the first place.
How to block AI tools: step by step
- Discover what is in use. Before blocking anything, find out which AI apps, browser extensions, desktop apps and agents people use, and for what. Otherwise you block the tool a team depends on and miss the ones that matter. See shadow AI discovery.
- Decide your approved tool. Choose at least one business-grade AI service with suitable data terms, sign-in through your identity provider and admin controls, so people have somewhere safe to go. Our guide to ChatGPT security risks covers what to check in an enterprise plan.
- Classify each tool: allow, restrict or block. Base it on data terms, where data is processed, whether inputs are used for training, and what the tool can access. An AI risk assessment gives you a repeatable way to do this.
- Block unapproved apps where people use them. Enforce at the browser and on the device, not only on the office network, so the block follows people working from home or on the move.
- Restrict rather than block where you can. Redact sensitive data, warn users, limit copy and paste or uploads, and allow read-only use where that is enough.
- Cover desktop apps, extensions and agents. Many AI services also offer desktop apps, and extensions and agents sit outside a simple URL list.
- Tell people, then review. Explain the policy and the approved alternative in your AI acceptable use policy, and review the block list as tools and needs change.
Why DNS and URL blocking alone falls short
DNS filtering, web proxies and firewall URL categories are useful, and they can stop casual use of known AI sites from managed networks. On their own they leave gaps:
| Gap | Why a URL or DNS block misses it |
|---|---|
| Free and business versions of the same service | They often share a web address, so a block cannot tell a personal account from the company workspace |
| AI features inside approved SaaS apps | Blocking the domain would block the whole app, not just its AI feature |
| Desktop AI apps | They may connect in ways a browser-focused list does not cover, and need control on the device |
| AI browser extensions | They run inside an allowed browser and can read the pages people open |
| Coding assistants and agents | They run in editors, terminals and background processes, often calling several services |
| New AI tools | Lists lag behind the tools people find and sign up to |
| Off-network use | Home and mobile connections may bypass office filtering unless traffic is routed back |
| What is actually sent | A URL block is all or nothing; it cannot redact a single customer name from a prompt |
That last gap is the important one. Most organisations do not want to stop people using AI; they want to stop specific data reaching the wrong place. That needs inspection of the prompt, upload or file itself.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How to block ChatGPT and other AI tools in Microsoft Edge
If you need a quick, browser-level block while you put a fuller control in place, Microsoft Edge has a policy called Block access to a list of URLs (URLBlocklist). It is set through Group Policy (Administrative Templates, Microsoft Edge) or the equivalent setting in your device management tool, and you can add exceptions with the matching allow list policy.
Microsoft's own documentation notes some limits worth knowing:
- The block and allow lists are limited to 1,000 entries each; later entries are ignored
- The policy does not stop a page updating dynamically through JavaScript, so a user can still follow a link from an allowed page to a blocked address on the same site, as long as the page does not refresh
- It applies to Edge only, so other browsers, desktop apps and extensions need their own controls
Other managed browsers have similar URL block policies. Treat this as a stop-gap: it blocks by address, cannot tell a personal account from a business one and cannot redact anything. We do not publish step-by-step guides for third-party firewalls; their vendors' documentation is the right source.
How to block free AI tools but keep the business version
This is a common request, and one of the hardest to do with URL blocking, because free and paid versions of a service often use the same web address. The workable approaches are:
- Enforce sign-in to the business workspace through the AI provider's own admin controls and your identity provider, where the provider supports it
- Inspect at the browser, where a control can see which app and session is in use and apply a different policy to managed and unmanaged use
- Protect the data either way, so even if someone uses a personal account, sensitive data is redacted or the upload is blocked
Check Point says Workforce AI Security can apply different policies to managed and unmanaged apps. How that maps to the specific tools and accounts your staff use is something we confirm in a pilot rather than assume.
Is AI tool blocking and control the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Blocking and governing with Workforce AI Security
Check Point Workforce AI Security is built for exactly this approve, restrict and block approach. From Check Point's product material, it can:
- Discover sanctioned and shadow AI apps, tools, extensions and MCPs, with an AI application catalogue and risk scoring
- Block employee access to unauthorised AI apps
- Apply different policies to managed and unmanaged apps
- Restrict copy and paste and in-prompt sensitive data, apply file-based policies and prompt restrictions
- Redact personal data, credentials and other sensitive data inline, replacing it with labelled placeholders, including in files and images using OCR
- Guide users with interactive messages so they understand why something was redacted or blocked
- Block risky agent actions at runtime, and set rules against risky connections between AI tools and corporate resources
Workforce AI Security Essentials covers AI used through web applications with a browser extension. Workforce AI Security Enterprise adds a desktop agent for desktop AI apps, coding assistants and agentic tools, which is where URL blocking struggles most. See how Workforce AI Security works for the detail.
How we help
Forever Systems can help you move from "should we block AI?" to a policy you can enforce. We start with discovery so you see what is really in use, help you agree what to approve, restrict and block, then set up Workforce AI Security in stages: monitoring first, then warnings and redaction, then blocking where it is genuinely needed. Pricing depends on the tier (Essentials or Enterprise), the number of users and the term, so ask us for a quote.
To talk about blocking or controlling AI tools in your organisation, contact us.
How Forever Systems helps you use AI safely
We are an independent UK IT and cyber security provider. We supply Check Point Workforce AI Security and help organisations put sensible, workable rules around AI at work.
- See what is really in use: we can start with a discovery pilot, so you know which AI tools, browser extensions, coding assistants and agents your people use before anyone writes rules
- Policy you can enforce: we help you decide what to approve, restrict or block, and turn your AI acceptable use policy into Workforce AI Security policies
- The right tier: Essentials for browser-based AI, Enterprise when desktop apps, developer code assistants and agents are in the picture, confirmed at quote
- Staged roll-out: from monitoring to warnings, redaction and blocking at a pace your people can absorb, with reviews along the way
- Around the tool: Microsoft 365 permissions ahead of Copilot, device management for the extension and agent, and safe use of AI training for staff
We work with businesses, schools, charities and public sector organisations. Our guides are general information, not legal advice.
Frequently asked questions
How do I block AI tools on work computers?
Discover which AI apps, extensions and agents are in use, approve a business-grade alternative, then block unapproved tools at the browser and on the device so the block applies wherever people work. Browser policies such as Microsoft Edge's URL block list are a quick start, and a dedicated tool such as Workforce AI Security adds discovery, redaction and agent controls.
How do I block ChatGPT on Microsoft Edge?
Use the Edge policy Block access to a list of URLs (URLBlocklist) through Group Policy or your device management tool. Microsoft notes it is limited to 1,000 entries and does not stop a page updating dynamically through JavaScript, and it applies only to Edge, so treat it as a stop-gap.
Can I block free AI tools but allow the paid business version?
Not reliably with URL blocking, because free and business versions often share a web address. You need the provider's admin controls plus a browser-level control that can apply different policies to managed and unmanaged use, and data protection that works either way.
Is it better to block AI tools or restrict them?
Restricting is usually better for approved and moderate-risk tools: redact sensitive data, warn users or limit copy and paste and uploads. Keep outright blocks for tools with unacceptable data terms or risk, and give people an approved alternative.
Does DNS filtering block AI tools?
It blocks traffic to known AI domains from networks that use the filter. It does not see AI features inside approved SaaS apps, what is actually sent, extensions running in an allowed browser, or many desktop apps and agents, so it works best alongside browser and device controls.
Still have a question about AI tool blocking and control?
Ask us and a member of our team will reply by email.