Your Employees Are Already Using AI. Here's a One-Page Policy.

If you haven’t set rules for AI in your business, your employees have set their own. Somebody in your office is using ChatGPT today, probably on a free personal account, probably with something from work pasted into it.

That’s mostly a good thing. They’re trying to get their work done faster. The problem is what goes into those tools and where it ends up. A customer list, a contract, a spreadsheet of employee pay, a collections file full of account numbers. On a free consumer account, you have very little control over what happens to that information afterward.

The fix is shorter than you’d think: one page your team will actually read.

Why banning it doesn’t work.

Some owners respond by banning AI outright. It rarely sticks. Surveys keep finding that a meaningful share of employees would keep using AI even if their employer banned it. They just stop telling you. Now you have the same risk with less visibility.

A better approach: approve the right tools, set clear rules about data, and make it easy to do the right thing.

What the policy should cover.

Keep it to one page. Five sections are enough.

1. Approved tools. Name them. “Microsoft Copilot through our company account” or “ChatGPT Team” or “Claude Team.” Business plans from the major vendors generally keep your data out of model training and give you admin control. Free personal accounts don’t give you either. If a tool isn’t on the list, ask before using it for work.

2. What never goes in. Be specific. Customer Social Security numbers, bank and card numbers, medical information, employee personnel files, passwords, anything covered by a client contract or NDA. If your business falls under PCI, the FTC Safeguards Rule, or similar rules, say so here.

3. What’s fine. Drafting emails, summarizing your own notes, cleaning up spreadsheets with no sensitive data, writing first drafts of proposals or job descriptions, brainstorming. People need to know what’s allowed, or they’ll guess.

4. A person checks the work. AI gets things wrong with total confidence. Anything that goes to a customer, a vendor, or a regulator gets read by a human first. Numbers get checked. Names get checked. Nobody sends AI output they haven’t read.

5. Who to ask. One name. The person employees go to with “is this OK to put in?” questions. In a small business, that’s often the owner or office manager, with your IT provider behind them.

A template you can start from.

Here’s the bones of it. Adjust the tool names and the data list to fit your business.

[Company] AI Use Policy

Approved tools: [Tool name] through our company account. Don’t use personal or free AI accounts for company work.

Never enter: customer financial or personal information, employee records, passwords, or anything covered by a client contract.

Fine to use for: drafting, summarizing, editing, brainstorming, and spreadsheet work that doesn’t include the information above.

Review: read and check anything AI helped write before it goes outside the company.

Questions: ask [name] before using AI for anything not covered here.

Have everyone read it and sign it. Put it with your other policies. Revisit it every six months, because the tools change fast.

The part a policy can’t do alone.

A policy tells people what to do. The setup makes it easy. That means business accounts for the approved tools, free accounts blocked or discouraged, and, if you’re rolling out Microsoft Copilot, a check of your file permissions first. Copilot can surface anything a user already has access to, including the payroll spreadsheet somebody shared with the whole company three years ago.

Cyber insurance carriers have also started asking how businesses use AI. A written policy is an easy answer to have ready.

Where to start.

Write the one page this week. If you’d like help picking tools, cleaning up permissions, or showing your team how to get real work out of AI, that’s what our AI for Your Business sessions are for.