--- title: "AI policy for employees: rules for company data that staff follow" description: "Your staff are already using ChatGPT and other AI tools. A one-page AI use policy that protects company data, what to put in it, and why banning AI rarely works." url: "https://northcreektechnology.com/guides/ai-policy-for-employees/" updated: "2026-10-13" audience: "Owners and operations leaders" author: "Andrew Healey" publisher: "Northcreek Technology" --- # An AI policy your staff will actually follow Your staff are already using AI tools, some on personal accounts. Banning them rarely works. Give people an approved tool, a short list of data that never goes in, and one page they can remember. Someone on your team pasted a customer contract into a free AI tool to summarize it. Someone else uses one to write quotes, on a personal account, signed in with a personal email. Nobody told them not to, and the tools really do save time. That's the usual starting point. The goal isn't to stop people from using AI. It's to make sure the company's data and the customer's data stay where they belong. ## Why banning it rarely works A ban pushes AI use onto phones and personal accounts, where you can't see it at all. People keep using it because it helps them do their jobs. A short policy with an approved tool works better, because it gives people a safe way to do what they're already doing. ## What the policy needs to say Keep it to one page. If it doesn't fit, nobody will remember it. **Which tools are approved.** Name them, and say they must be used with a company account. A business account comes with a contract about how your data is handled. A personal account usually doesn't. OpenAI, for example, says it may use content from personal ChatGPT accounts to train its models unless the user opts out, while it doesn't train on business accounts by default. Read the terms for each tool you approve. **What never goes in any AI tool.** Write a short, concrete list: - Customer personal information, such as addresses, Social Security numbers, and birth dates - Bank, card, or account numbers - Health or medical information about anyone - Passwords and access codes - Financial results that haven't been released - Documents marked confidential, and anything covered by a customer agreement - Your own sensitive business information: pricing, formulas, recipes, drawings, or employee files Add a rule for the gray areas: if you're not sure, leave it out and ask. **What's fine.** Drafting emails and documents without that data, summarizing your own notes or public information, rewording and proofreading, spreadsheet formulas, and brainstorming. Saying what's allowed matters as much as saying what isn't. **A person checks the output.** AI tools make things up and sound sure when they're wrong. Anything AI helped write gets read and approved by a person before it goes to a customer, a vendor, or a regulator. **No AI acts on its own.** No tool sends email, makes payments, or changes records without a person approving each action, unless someone with authority approves that use in writing. **Who to ask, and how to report a mistake.** Name a person. Make it clear that reporting a mistake the same day won't get anyone in trouble. You want to hear about it fast. ## Roll it out 1. Find out what people already use. Ask directly and make it safe to answer honestly. 2. Pick one approved tool and buy business accounts for the people who need them. 3. Send the one-page policy, walk through it in a staff meeting, and have the owner sign it. 4. Review it every six months. The tools change quickly. ## Then put AI to work Once the rules are in place, look for the places your team loses hours to manual work: retyping between systems, chasing documents, building the same report every week. Pick one or two fixes worth doing first and measure the time they save. That's the other half of our AI and Automation Review. Sources: [OpenAI, how your data is used to improve model performance](https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance) and [OpenAI enterprise privacy](https://openai.com/enterprise-privacy/). ## Questions ### Is it safe to put company data into ChatGPT? It depends on the account. OpenAI says it may use what people type into personal Free, Plus, and Pro accounts to train its models unless the user turns that off, and it doesn't train on ChatGPT Business or Enterprise data by default. Check the current terms for any tool you approve, and keep the most sensitive data out of all of them. ### Should we block AI tools on the company network? Blocking alone rarely works. People use their phones and home computers instead, and you lose sight of what's being shared. Give them an approved tool and clear rules, then block the tools you've decided against. ### Do we need a lawyer to write the policy? A one-page policy for staff doesn't need to start with one. If it touches employment terms, customer contracts, or regulated data, have your attorney review it. ## Related guides - [How to answer a customer security questionnaire honestly](https://northcreektechnology.com/guides/customer-security-questionnaire.md) - [After a near-miss on a fake vendor payment](https://northcreektechnology.com/guides/vendor-payment-fraud.md) - [Is your cyber insurance application true?](https://northcreektechnology.com/guides/cyber-insurance-application.md) ## Where Northcreek Technology fits AI and Automation Review (AI use policy and automation review): Where your team loses hours to manual work, the two fixes worth doing first, and one page of rules for how your data can be used. https://northcreektechnology.com/services/ai-automation-review/ ## Next step Book a call: https://northcreektechnology.com/contact/