What sorts of guardrails should be considered before making ChatGPT part of your org’s security compliance efforts?

Many vendors are adding OpenAI connectors to their products under the guise that ‘they’re an AI company now’

Check what they’re doing with your data.

Are they issuing new Data Processing Agreements? Do they have your consent to send data to a third party?

When OpenAI has another data breach, what impact will this have on your business?

Is your data being sent back for model training
Is there a reason ChatGPT specifically is being made part of the efforts
What is the nature of the data and who are the users of the chatbot

Definition of standards and policies for reference points in compliance efforts.

Your regulatory environment will inform some of this. Production environments should inform most of the rest. 

For those opposed to hitting ChatGPT with the ban-hammer I think it's likely you will see some sort of structured review and approval process folded into most corporate governance. 

Review existing polices data governance, data protection, acceptable use, infosec, etc.  Communicate reminder on those policies.  Consider a governance committee.