Here’s a fair bet. Someone on your team has already pasted something from work into an AI chat tool.
Maybe a tricky email to a customer. Maybe a spreadsheet they wanted summarized. Maybe a patient note or a client contract.
They weren’t being careless. They were trying to get work done faster. But nobody told them what’s okay and what isn’t. So they guessed.
That’s why you need AI rules. Not a long legal policy. One page your team will actually read.
Why it matters for a small business
When you paste something into an AI tool, it leaves your business. Depending on the tool and the settings, it may be stored, reviewed or used to train future models. Free personal accounts and paid business accounts often handle this differently.
For most tasks, that’s fine. For some, it’s a real problem. Customer details, health information, payroll, contracts. If those get out, you’ve got an angry customer at best. At worst, depending on your industry and your state, legal trouble.
A clinic has health privacy rules to follow. A business that takes cards has card security rules. Even a small trade business holds home addresses, phone numbers and gate codes.
What staff can paste in
Keep this list generous. You want people using these tools for the boring stuff.
- Drafting general emails, with names and personal details taken out.
- Rewriting your own marketing copy, website text or job ads.
- Summarizing public information, like a supplier’s product page.
- Making checklists, templates and how-to guides for internal use.
- Brainstorming ideas, headlines or simpler ways to explain something.
What staff can’t paste in
- Customer names with contact details, addresses or account numbers.
- Health, medical or patient information of any kind.
- Payroll, salaries, bank details or tax records.
- Contracts, legal letters or anything marked confidential.
- Passwords, door codes, alarm codes or login details.
A simple test helps. If you wouldn’t pin it on a public noticeboard in your shop, don’t paste it into an AI tool.
A one-page policy you can copy
- Purpose: we use AI to save time on routine work. A person is always responsible for the result.
- Approved tools: the exact tools and accounts staff can use for work. Business accounts only.
- Fine to use for: the green list above.
- Never paste in: the red list above.
- Always check: a person reads every AI draft before it goes to a customer.
- Be honest: if a customer asks whether AI helped, tell them the truth.
- If something goes wrong: tell the owner or manager the same day. No blame for reporting it.
- Who owns this: one named person keeps the tool list and this page up to date.
- Review date: we look at this page again every six months.
That’s it. Print it, put it in the onboarding pack, and talk it through at your next team meeting.
Your team will use AI either way. The only question is whether they’re following your rules or making up their own.
Pick the tools, don’t just ban them
Banning AI rarely works. People just use it on their phones, on personal accounts you can’t see. That’s worse.
Better to pick one or two tools, pay for business accounts, and check the data settings yourself. Find the setting that controls whether your data is used for training, and read it before you sign up. Then tell your team: use these, not the others.
Do this this week
- Ask your team, with no blame, which AI tools they already use for work and what for.
- Pick one approved tool and set up business accounts for the people who need it.
- Copy the one-page outline above and fill in your tool list and owner.
- Go through it at your next team meeting. Ten minutes is enough.
- Put a reminder in your calendar for six months from now to review it.
Then listen to the episode on what’s worth automating. Once the rules are in place, it’s much easier to decide what AI should do next.
BIZPLAYBOOKS
Kevin’s been writing code for thirty years. Now he helps owners use AI to get time and money back, and hosts BizPlaybooks.
