Should your team use ChatGPT at work? A simple AI policy for small businesses

Why this needs a policy, not a ban

Employees are already using AI tools at work, whether or not there's a policy for it. Banning them outright usually just pushes the activity out of sight, using personal accounts on personal devices where there's no oversight at all. A short, clear policy gives people a safe way to use these tools and tells them exactly where the line is.

What should never be pasted into a public AI tool

• Customer names, account numbers, or contact details
• Financial records, tax information, or payroll data
• Medical or health information
• Passwords, API keys, or other login credentials
• Contracts, legal filings, or anything under a confidentiality agreement
• Anything a customer would be surprised to learn left your systems

Approved tools and business accounts

Business or paid-tier accounts for AI tools often come with better data protections than free personal accounts, including options to opt out of having your data used for training. Pick one or two approved tools, set them up under a business account, and ask employees to use those instead of personal accounts.

Human review of AI output

AI tools can produce text that sounds confident but is wrong. Before anything AI-generated goes to a customer, a client, a regulator, or gets used in a decision about someone, a person should read it, check it, and take responsibility for it. AI drafts. People decide.

Being honest with customers about AI use

If AI plays a real role in how you serve customers, such as an AI chatbot handling support requests, say so. Customers generally accept AI assistance well when they know about it and lose trust fast when they find out it was hidden.

A short starting checklist

• List which AI tools employees are currently using, including personal accounts
• Pick one or two approved tools and set them up as business accounts
• Write down what data can never be entered into an AI tool
• Require a human review step before AI output reaches a customer or client
• Decide how you'll disclose AI use to customers