The compliance problem is not that an employee asks an AI assistant to summarize a meeting note. The problem is that the assistant may already be standing in the mailroom, the document library, the calendar, and the chat archive before anyone updates the data map. That is not science fiction. It is tenant administration, which is usually where the interesting privacy work goes to hide. ## The default is an admin decision ZDNET's David Gewirtz reports that Gemini in Google Workspace has access to Gmail, Docs, Calendar, Chat, and more by default, and that administrators can disable it today. Translated into plain compliance language: this is not just a user training issue. If the feature is enabled across a tenant, the relevant question is whether the organization has reviewed what categories of data those services contain, who is allowed to invoke Gemini, and whether the resulting use matches existing privacy, confidentiality, and supplier controls. This does not mean every Workspace tenant has a legal violation sitting in the Admin console. It means the default belongs in the same file as data processing registers, acceptable use rules, records retention, and vendor assessments. If counsel asks whether Gemini can touch regulated support emails, HR drafts, deal documents, or student information, the useful answer is not a slide about productivity. It is a setting, a scope, and a dated decision. ## Google frames Gemini as a managed Workspace service Google Workspace Updates says the Gemini app is now a core service with enterprise-grade data protection for more Google Workspace editions. That matters because core service status is how many organizations separate sanctioned enterprise tooling from consumer AI use. It also means administrators should stop treating Gemini as a side experiment and start treating it as part of the Workspace control surface. Google Workspace Help lists the access management feature for Enterprise Standard and Enterprise Plus, the Teaching and Learning add-on, Education Plus, and Google AI Pro for Education. The same help page is titled around managing access to Gemini features in Workspace services, which is lawyerly enough to be useful. Article 52 this is not, but the obligation rhymes: decide who can use the system, identify which services feed it, and keep evidence that the decision was made by the organization rather than by accident. ## What admins should audit before disabling anything Google Workspace Help points administrators to the Admin console for managing access, while ZDNET reports the access can be disabled today. The first practical step is therefore not panic clicking. It is a short audit: which Workspace services are in scope, which groups hold sensitive data in those services, which editions are covered by the available control, and which business units actually need Gemini enabled. The second step is to separate data access from model mythology. The compliance question is not whether Gemini is impressive, harmless, or inevitable. The question is whether enabling it changes how enterprise data in Gmail, Docs, Calendar, Chat, or related services can be processed inside the tenant. If the answer is yes, the admin decision should be reflected in the risk register, data protection review, and vendor governance notes. For regulated teams, the boring paperwork is the point. If medical, education, finance, or employment data sits in Workspace, AI access becomes part of the same control set as role permissions and data loss prevention. Disable first where the organization cannot yet explain the processing purpose, user population, contractual basis, or review trail. Re-enable later with a reason, not a vibe. ## What changes for builders and learners ZDNET's reporting makes the operational timeline immediate: administrators can act now. Google Workspace Help makes the owner obvious: this is an admin managed feature, not a productivity preference that should be delegated to every user. Builders who create internal automations around Workspace should assume Gemini access is a tenant governance dependency, not merely a UI affordance. For learners and team leads, the takeaway is simpler. Do not ask whether AI is allowed in the abstract. Ask which Workspace services Gemini can reach, which users are enabled, and who signed off. That question will survive the next product rename, which is more than can be said for most AI governance decks. The next thing to watch is whether organizations treat Gemini access as part of routine SaaS administration or discover it during an audit. The former is cheaper and produces better records. The latter produces meeting invitations with legal, security, IT, and procurement on the same line, which is rarely a sign that everyone is relaxed. ## Sources - Google's AI can see your business data by default in Workspace - unless you disable it | ZDNET

Sources