This isn’t a discipline problem
Picture the usual scene. An office manager needs a client email drafted by 5 p.m. She pastes in the contract terms so ChatGPT can match the client’s tone. It works. She does it again next week.
She isn’t being reckless. She’s being efficient with the only tool she was given, which is the free one in her browser. Nobody told her not to. Nobody told her she could, either.
That silence is the actual problem in most small businesses. Personal AI accounts sit outside anything you administer, so there’s nothing for you to see. Business-tier accounts add admin controls. Personal ones don’t.
What can go wrong
Three things, in ascending order of awkward:
- Sensitive data leaves your control. Contracts, rate cards, client names, financials, credentials. What happens to it next depends on the tool, the plan, and terms most businesses have never read. Those terms also change.
- Wrong answers get treated as right ones. AI drafts are first passes. When nobody’s been told that, they go out as final.
- You can’t answer a simple client question. “Where did our information go?” is hard to answer when you don’t know which tools your team uses.
If you handle health, legal, or financial records, add your regulator or counsel to the list of people who’d like to know. We’re not lawyers. Ask yours.
Why banning it doesn’t work
We say this with affection for anyone who’s already sent the all-staff email: a ban rarely stops the behavior. It moves it to personal phones, where you have even less visibility.
People use AI because their work has a deadline and the tool saves time. Remove the tool without removing the deadline and you’ve created a workaround, not a policy.
Three moves that work
1. Find out what’s in use
Ask your team what they use and what for. Frame it as an amnesty, not an investigation. You’ll learn which tasks people are trying to speed up, and that list is the most useful part. It’s a map of where AI could help your business safely.
Give this two weeks. Keep it to a short conversation per team, not a survey nobody finishes.
2. Write a one-page rule
One page, because a policy nobody finishes reading isn’t a control. It needs four things:
- Which AI tools are approved for work
- Which data never goes into a prompt (client identifiers, financials, health or legal records, credentials)
- Which account type is required (business, not personal)
- Who to ask when a new tool shows up
3. Give people something better
A rule that only says “no” loses to a deadline. The durable fix is a sanctioned tool that’s at least as convenient as the free one.
For anything involving client or company data, that usually means private AI: models that run on infrastructure you or a partner controls, with your data kept out of anyone else’s training. It’s the difference between telling people not to use the public option and handing them one that’s safe to use. We cover what it is, and when it’s worth it, in our guide to private AI for small business.
One caution. Be wary of “AI integrations” that are thin layers over someone else’s API. Your data still takes the same trip. It just has a nicer front door.
What to do next
This week:
- Ask each team lead what AI tools their people use and for what.
- List the three most common tasks. Those are your candidates for a sanctioned tool.
- Draft the one-page rule, and share it with the same conversation you started in step one.
If you’d like a second opinion on which of those tasks are worth building something for, that’s exactly what a first call is for. Book a strategy call and we’ll tell you honestly whether you need a tool at all. Sometimes the answer is just the rule.
Your team is already using AI. Let’s talk about doing it safely.
