An employee pastes a contract into ChatGPT to make it shorter. Another asks Copilot to summarize a long email thread. Someone installs an AI meeting-notes extension and connects it to the company calendar. None of them thinks they just made a security decision. But each action affects where business information goes and who may be able to access it.
This is not a fringe issue anymore. In August 2026, the National Cybersecurity Alliance reported that nearly 88% of the small-business owners it surveyed already use AI tools. More importantly, 54% said they use AI without formal guidelines or policies.
The answer is not to ban AI. These tools can save time, improve a rough first draft, summarize nonconfidential information, and help employees get unstuck. The answer is to give people clear rules before convenience quietly becomes company policy.
What an AI acceptable use policy actually does
An AI acceptable use policy is a simple permission map. It tells employees which tools and accounts are approved, what information may be entered, what requires permission, and what a person must check before the work is used.
For a small business, this does not need to become a 20-page manual. A useful policy should answer five questions:
- Which AI tools and account types may employees use for company work?
- What information must never be entered or uploaded?
- Which tasks require approval before AI is used?
- Who is responsible for checking the result?
- What should an employee do if sensitive information is shared by mistake?
Treat every prompt like a disclosure
When an employee pastes text, uploads a file, or connects an AI tool to email, a calendar, cloud storage, or a CRM, information is being provided to another service. How that information is stored, processed, retained, or used depends on the exact product, plan, account, settings, and connected apps.
That is why “we use ChatGPT” or “we use Copilot” is not a complete policy. A personal account and a company-managed business account can have different contractual protections and administrative controls. For example, OpenAI says business data from ChatGPT Business, ChatGPT Enterprise, and its API is not used to train its models by default. Microsoft says prompts, responses, and Microsoft Graph data covered by enterprise data protection are not used to train foundation models.
Those protections matter, but they are not blanket permission to upload anything. Your business still has to approve the specific tool and workflow for the information involved. The simplest rule is this: if the tool, account, and type of data have not been approved, do not put the data into AI.
What should stay out of unapproved AI tools
Your policy should use examples that fit the work your employees actually do. For many law firms, accounting firms, medical practices, financial firms, and other professional-services businesses, the restricted list should include:
- Passwords, multifactor authentication codes, recovery codes, API keys, and other credentials
- Social Security numbers, banking details, payment-card information, tax records, and identity documents
- Patient information and other protected health information
- Client-confidential information, legal matter details, and documents covered by confidentiality agreements
- Employee records, performance notes, background checks, and private HR information
- Proprietary source code, internal network details, security documentation, and incident information
- Anything a law, contract, customer agreement, or company policy already restricts
Do not assume that deleting one name makes a document safe. Other details may still identify a person, client, patient, or matter. When AI can do the job with a made-up example or a smaller, sanitized excerpt, use that instead.
Seven AI acceptable use rules you can adopt today
- Use only approved tools and company-managed accounts. Approval should name the product and plan, not just the vendor. Employees should not move company work to a personal AI account because it is faster or already open.
- Share the minimum information needed. Remove names, account numbers, and other identifying details when they are not required. Use a sample document or fictional data when possible.
- Never enter secrets. Passwords, access codes, private keys, and recovery information do not belong in an AI prompt, even in an approved business account.
- A person remains responsible for the result. AI can produce confident, polished answers that are wrong. Check facts, calculations, citations, tone, and attachments before anything reaches a client or affects the business. The NIST Generative AI Profile specifically addresses false output, human oversight, acceptable use policies, privacy, and ongoing review.
- Do not let AI make the final high-impact decision. A qualified person should make legal, medical, financial, lending, hiring, firing, disciplinary, and other consequential decisions. AI may assist with an approved task, but it should not become the unreviewed decision-maker.
- Get approval before adding extensions, agents, or connectors. Permission to use an AI chatbot does not automatically include permission to connect it to company email, files, calendars, accounting software, or the CRM. Each connection expands what the tool can reach.
- Report mistakes quickly. If confidential information is entered into the wrong tool, or an AI result causes a problem, employees should know whom to contact immediately. Fast reporting gives the business the best chance to limit the impact.
A copy-and-paste starting policy
Approved use: Employees may use only company-approved AI tools and company-managed accounts for business work. AI may assist with drafting, brainstorming, summarizing approved material, research, and other authorized tasks.
Restricted information: Do not enter passwords, access codes, personal information, client-confidential information, protected health information, financial records, payment details, employee records, proprietary information, or restricted documents unless the company has specifically approved the tool and workflow for that type of data.
Human review: The employee using AI remains responsible for the work. AI-generated facts, calculations, citations, recommendations, files, and communications must be checked before they are shared, published, sent to a client, or used to make a business decision.
Decisions and integrations: AI may not make final legal, medical, financial, employment, or other high-impact decisions. Employees must obtain approval before installing an AI extension or connecting AI to company email, calendars, files, systems, or customer information.
Reporting: Employees must promptly report accidental disclosure, suspicious output, incorrect information that was used, or any other AI-related concern to the designated manager or IT contact.
This language is a practical starting point, not a substitute for legal or compliance review. Businesses with professional duties, regulated data, union requirements, or customer-specific contracts should have the appropriate adviser review the final policy.
Make the policy easy to follow
A policy hidden in an employee handbook will not change behavior by itself. Keep the first version to one page. Show employees two or three safe examples that match their jobs. Give them one person to ask when they are unsure. Then review the policy whenever you approve a new tool, add an AI connector, or change how sensitive information is handled.
This also works better when employees understand that the goal is safe use, not punishment. If people think every question will get AI banned, they are more likely to use it quietly. Clear approved options make the safer path the easier path.
What to do this week
- Ask employees which AI tools, accounts, browser extensions, and meeting assistants they currently use for work.
- Choose the approved tools and accounts for common tasks.
- Write down the information that must stay out of AI unless a specific workflow is approved.
- Name the person who can approve a new tool or answer questions.
- Spend 15 minutes walking the team through one safe example and one unsafe example.
Iron Core helps small businesses choose practical AI tools, configure company-managed access, and put security around the workflows that save employees time. Learn more about our AI and automation services, our cybersecurity services, and our compliance support.
Not sure what your team is already using? We can help you map it and build sensible guardrails without stopping useful work. Email hello@iron-core.com or call 908-367-4569.