Somewhere in your office this week, someone pasted a customer email into an AI chatbot to make the reply sound friendlier. Someone else dropped a spreadsheet in and asked for a summary. Neither of them did anything wrong by the rules you have, because there probably aren’t any rules yet.
That’s normal. The tools showed up faster than anybody’s employee handbook could keep up with. In a survey BlackFog ran in late 2025 of 2,000 employees in the US and UK, 86% said they use AI tools at least weekly for work, and 49% said they use AI tools their employer hasn’t approved (BlackFog, January 2026). Those were people at companies with more than 500 staff. In a small office, where nobody is in charge of saying no, our guess is the share isn’t any lower.
Your team is going to use these tools either way, so the useful thing is to write down how they should use them.
Why a policy and not a ban
Banning AI sounds tidy. In practice the work just moves to personal phones and personal accounts, where you can see even less of it. The same BlackFog survey found 63% of respondents think it’s fine to use AI without IT’s oversight if the company doesn’t offer an approved option. People will use the tool that saves them an hour. A policy gives them a way to do it that doesn’t put client information at risk.
It also protects the employee. Most of the bad outcomes with AI at work come from someone who was trying to be helpful and didn’t know where the line was.
The five parts of a good policy
A useful AI policy for a business of 10 or 50 people fits on one or two pages. If it runs longer than that, people won’t read it. It should answer five things.
1. Which tools are approved, and on which accounts
Name them. “ChatGPT” isn’t specific enough, because a free personal account and a company-managed business account behave very differently with your data. Say which account people should use, and that personal accounts aren’t for company work.
2. What never goes into an AI tool
Be concrete. A list most offices can start from:
- client names together with account numbers, case details or health information
- employee records: pay, reviews, Social Security numbers
- passwords, access codes and anything from your IT admin screens
- financial statements and pricing that aren’t public yet
- contracts and legal documents, unless you’re using an approved tool that’s set up for them
A simple test helps people more than a long list: if you wouldn’t post it on a public website, don’t paste it into a tool the company hasn’t approved.
3. When a person has to check the output
AI gets things confidently wrong. Decide which work always gets a human read before it goes anywhere. Anything sent to a customer, anything with numbers in it, anything legal, and anything that affects a person’s job (hiring, reviews) is a sensible starting set.
4. What to do when something goes wrong
Someone will paste the wrong file one day. Tell people who to tell, and make it clear that reporting it quickly is the right thing and won’t get them in trouble. A mistake you hear about in ten minutes is much easier to deal with than one you find in three months.
5. Who owns the policy
One named person, and a date to look at it again. Six months is reasonable right now, because the tools change that fast.
If you wouldn’t post it on a public website, don’t paste it into a tool the company hasn’t approved.
What it shouldn’t be
It shouldn’t read like surveillance. If the policy sounds like you’re trying to catch people, they’ll stop telling you what they use, and that’s the information you need most. Write it in plain language, go over it in a team meeting, and have new hires read it the same day they get their email login.
It also isn’t a technical control. A policy can tell people not to paste client data into a personal chatbot. It can’t stop them. For that you need an approved tool that’s good enough that nobody wants the personal one. We wrote about that side of it in Is It Safe to Put Company Data Into ChatGPT?
Getting one in place this month
A realistic order of work:
- Ask your team, without judgment, which AI tools they use now and for what.
- Pick the tools and accounts you’re willing to support.
- Write the five sections above, in plain words, on no more than two pages.
- Go over it with everyone and keep a record that they’ve read it.
- Put a date on the calendar to review it.
Where we come in
For our Managed IT customers, writing and keeping IT and security policies up to date is part of the compliance support we already provide, and an AI use policy is one of them. We start from how your business actually works, not from a template. If you’d rather give your team an approved place to use AI, our Secure AI workspace is built for exactly that. Call us at (386) 252-2292 if you want to talk it through.