Key takeaways
- Assume staff already use AI, and give them a safe, approved option
- Classify data first: decide what may never go into an AI tool
- Require human review of anything sent, filed or relied on
- Review the policy as tools and regulations change
Why you need one now
Generative AI arrived in the workplace faster than most policies. When there is no approved option, people use free personal accounts, a pattern known as shadow AI, and client data can end up in services the business has no agreement with.
A policy is not about saying no. It gives staff a clear, safe way to use tools that genuinely save time, and it gives you an answer when clients, insurers or auditors ask how AI is governed.
What the policy should cover
- Approved tools: which AI tools and plans are allowed, using business accounts with data protection terms
- Data rules: what may never be entered, such as confidential client information, health records, financial account data, passwords and personal data
- Human review: output is checked for accuracy before it is sent, filed or relied on
- Disclosure: when clients or colleagues should be told AI was used
- Intellectual property: who owns AI-assisted work and how copyrighted material is handled
- Approval process: how staff request a new tool or a new use
- Accountability: the person using the tool remains responsible for the result
Sort your data into three groups
Public
Marketing copy, published information and general questions. Fine for any approved tool.
Internal
Procedures and everyday business documents. Approved business tools only, signed in with company accounts.
Confidential
Client files, health and financial records, credentials and personal data. Only in tools specifically approved for that data, and often not at all.
Rolling it out
Find what is in use
Ask staff which tools they use and review sign-ins and browser extensions. Expect more than you think.
Pick approved tools
Choose business plans with admin control and terms that exclude your data from model training, often inside tools you already license.
Keep it short
One or two pages that people will actually read, with examples from your own industry.
Train and revisit
Cover it in security awareness training and review it at least once a year as tools and rules change.
Frameworks worth knowing
The NIST AI Risk Management Framework gives a structure for managing AI risk around four functions: govern, map, measure and manage. It is voluntary and written for organizations of any size. CISA also publishes guidance on using and securing AI. For most small businesses, a clear policy plus a short list of approved tools covers the essentials.
How we help
Through vCIO planning we help you choose approved tools, fit them into your Microsoft 365 environment and add AI to your security roadmap. Security awareness training comes with every supported user, the compliance platform add-on offers an AI Compliance framework, and our AI automation and Power BI hosting add-on starts with a review of your business processes, so automation is built on governed tools.
Sources
Information on this page is general and is not legal or compliance advice.