Gemini lands on Windows with Alt+Space: how to control which AI assistants get installed on the PCs of your Mexico operation

On September 10 Google released Gemini, its AI assistant, for Windows 10 and 11, as reported by ADSLZone. It installs like any program, opens from any application with Alt+Space and can look at what is on screen to answer about it.

Add Copilot, the Microsoft assistant already built into Windows, and the staff in your Mexico office now have two AIs one keystroke away. Over contracts, email, the ERP and the customer list. Nobody in IT approved it, and head office probably has not heard about it yet.

What Alt+Space changes

Until now, using AI on a document meant opening a browser, logging into a chat and pasting the text. That small effort stopped most people.

Now the accountant in Monterrey can have payroll open, press Alt+Space and ask ‘summarize this’. Whatever is on screen goes to Google under the account that person signed in with. If it is a personal Gmail, payroll ends up in a history the company cannot see or delete.

This is shadow AI: AI used at work without IT knowing. In our experience it is far more common than malware, and almost nobody does it with bad intent. They just want to finish faster.

The real risk, without drama

Gemini and Copilot are not dangerous by themselves. The problem is the account they run under and what they get shown.

What can happen	Example in a Mexico office
Customer data in personal accounts	Sales asks to summarize an email with a client price list
Contracts leaving the company	Someone asks ‘explain this clause’ with the PDF open
Screens of internal systems	A question about an ERP error includes tax IDs and invoices
History nobody can delete	The person resigns and it all stays in their Gmail

There is a cross-border angle too. Your data commitments to customers in the US or Europe do not stop at the border, but the policies you push from head office often do. PCs joined to no domain, local admins, personal Gmail: we see it every week.

Deciding which AI is allowed

Our view: banning all AI does not work. People use it from their phones and you lose visibility. What works is picking one and giving it a company account.

ProcessBi

The rule we apply with clients is simple:

• If your email runs on Google Workspace, your assistant is Gemini with a corporate account.
• If your email runs on Microsoft 365, your assistant is Copilot with a corporate account.
• Everything else, including Gemini with a personal Gmail, gets blocked or limited.

Then the human part: say clearly what can be pasted (your own email, a manual) and what cannot (customer data, contracts, payroll, passwords). In Spanish, for the local team, not buried in an English policy PDF. Business plans of Workspace and 365 have different terms than the free versions about what happens to what you type; check the ones for your plan.

How to block or allow by policy

Two tools do the heavy lifting. Intune is the Microsoft service for managing devices from the cloud. GPOs are group policies: rules a domain server pushes to every PC on the network. Either one works, as long as the Mexico PCs are actually enrolled.

Measure	How	What it achieves
Users without admin rights	Standard Windows accounts	Nobody installs Gemini or anything else unapproved
Allowed-program list	Intune or GPO with AppLocker	Only what IT approved can run
Sign-in with corporate accounts only	Workspace or 365 policies	Even if the AI opens, personal Gmail cannot log in
Copilot on or off by department	GPO or Intune	Sales yes, accounting no, for example

Removing admin rights is the cheapest measure and the one that solves the most. Many Mexico offices still run with everyone as administrator because it was faster during setup. There, anyone installs anything.

If you also have apps connected to email or AI agents acting on their own, those are separate fronts: see how to audit OAuth apps in Workspace and 365. Most of the enrollment and policy work can be done through remote IT support from Mexico, with a visit only for PCs that were never joined to anything.

Let’s talk

What about your Mexico operation?

Try this today: ask your Mexico office who has installed Gemini or uses Copilot, and with which account. The answer usually surprises head office.

At ProcessBi we do this hardening once and keep it current under a support plan: each month we check what got installed, who asked for exceptions and whether a new AI changed the rules. There will be another one. It starts with a free assessment of your PCs and accounts.

Book your free assessment — we reply the same business day.