Your Team Already Uses AI. Here's a One-Page Policy
Your team is almost certainly using AI already, approved or not. In a 2025 Anagram survey of 500 US workers, 58% admitted pasting sensitive data such as client records into AI tools, and 45% had used AI tools their employer banned. A one-page AI policy closes most of that gap in an afternoon.
How common is "shadow AI" at work?
Shadow AI is any AI tool your staff use without the business choosing it, setting it up or knowing about it. It is rarely sneaky. Someone has a pile of emails to answer, a free chatbot is open in another tab, and nobody ever said not to.
| Finding | Share of employees |
|---|---|
| Use AI tools at work, even without a clear company policy | 78% |
| Admit pasting sensitive data (client records, financial data, internal documents) into AI tools | 58% |
| Have used AI tools their employer banned | 45% |
| Would knowingly break policy to finish a task faster | 40% |
Source: Anagram national survey of 500 full-time US employees, July 2025.
Small businesses are more exposed, not less. There is usually no IT department, no approved tool list and no one whose job it is to ask the question. The result is that the business's most sensitive information ends up wherever each person's personal account happens to send it.
What can actually go wrong?
Most of the risk is quiet. Nothing breaks on the day it happens. Three problems show up most often:
- Client data leaves your control. Text pasted into a personal, free AI account sits under that person's account settings, not yours. Depending on the tool and the settings, it may be stored or used to improve the service.
- You are still accountable for it. In Canada, PIPEDA's accountability principle means a business remains responsible for personal information it collects, including when that information is handed to a third-party service.
- Wrong answers go out under your name. AI writes confidently, including when it is wrong. A quote, a policy answer or a date that nobody checked is now your mistake.
There is a fourth, slower problem: when an employee leaves, their chat history and every prompt they built leave with them, because it all lived in a personal account.
One page, read together in fifteen minutes, beats a long policy nobody opens.
What goes in a one-page AI policy?
Keep it to one page so people actually read it. Six short rules cover most small businesses:
- Approved tools. Name the one or two AI tools staff may use for work, and require the business account, not a personal one.
- Never paste. Client names with personal details, health information, banking or card numbers, passwords, and anything under a confidentiality agreement.
- Fine to use for. Drafting emails and posts, rewriting your own text, summarizing public information, brainstorming and checklists.
- A person checks before it goes out. Anything that reaches a client, a supplier or the public is read by a human first.
- Be honest when asked. If a client asks whether AI helped produce something, tell them.
- Who to ask. One named person answers "is this OK?" questions, and the policy is reviewed every six months.
That is the whole document. It does not need legal language to work. It needs to be short, specific and known by everyone.
How do you roll it out without slowing people down?
Bans tend to push AI use out of sight rather than stop it, which is exactly the problem you are trying to solve. The rollout that works is the opposite: give people a better, approved option than the one they were using quietly.
| Step | Time it takes |
|---|---|
| Pick one approved tool and set up business accounts | 1 hour |
| Turn on the data and privacy controls the business plan offers | 15 minutes |
| Walk the team through the one-page policy | 15 minutes |
| Build three shared, approved prompts for your most common tasks | 1 hour |
| Review what people are using it for after 30 days | 30 minutes |
The shared prompts matter more than they look. When the approved tool already does the job someone was sneaking a free chatbot for, there is no reason to sneak.
Where can an owner learn the rest, fast?
If you want to see AI used safely and practically in a real small business before you set your own rules, the free AI for Business Summit runs live online October 14 to 16, 11:00 AM to 3:30 PM Eastern each day. Go in with your one-page policy draft and the three tasks your team uses AI for most, and leave with a clearer picture of what to approve.
If you would rather have it set up for you, AI Biz Connect configures approved AI tools, shared prompts and the automations around them inside one connected system, so your team gets the speed without the risk.
Frequently asked questions
Do I need a lawyer to write an AI use policy?
Not for a one-page working policy. The six rules above are operational, not legal. If you handle health, legal or financial records, or you are bound by industry rules, have your advisor review it. For most small businesses, a short policy everyone follows is far better than a long one nobody reads.
Is it safe to use ChatGPT or similar tools for business?
It can be, with the right account and rules. Business and team plans from the major AI providers generally offer stronger data controls than free personal accounts. Read the data terms of the specific plan you choose, turn on the controls it offers, and keep sensitive client details out of prompts regardless.
Should I just ban AI at work?
A ban usually drives AI use onto personal phones and accounts, where you have no visibility at all. The Anagram survey found 45% of workers had already used tools their employer banned. Approving one tool with clear rules gives you control a ban never will.
How often should the policy change?
Review it every six months, or whenever you add a new tool. AI products change their features and data terms often. A short review keeps the approved list current and gives your team a natural moment to ask questions about new uses.
Get the rules right, then get the time back
See safe, practical AI for business, free and live, October 14 to 16.
Want approved AI tools set up for your team? Call AI Biz Connect at 416-727-7111 or
Some links in this post are affiliate links. We may earn a commission at no extra cost to you.
Sources: Anagram, "New data reveals widespread, risky AI use at work," national survey of 500 full-time US employees, July 2025 (anagramsecurity.com). Office of the Privacy Commissioner of Canada, PIPEDA fair information principles, Principle 1: Accountability (priv.gc.ca). AI for Business Summit registration page (go.aiforbusiness.com/summit), checked October 3, 2026.
