Are you leaking business data through your AI tools?

Everyone, from workers to CEOs, is rushing to leverage AI tools for faster task execution and higher productivity. The media are endlessly bashing us with rhetoric around the current advantages of AI phenomenon (bubble), and that can certainly add to the pressure to get on board with both free and paid subscriptions. Some softwares are even forcing us to use AI whether we like it or not.

As with all new initiatives in a business, it’s usually a good idea to create a plan, and systems and processes around what tools will be used, and how they will be used. Failing to do this can inadvertently end up with multiple problems, one being leaking potentially sensitive company plans, forecasts, strategies and financial data into numerous LLMs.

One of the ways to combat this is through having an AI-use policy, and all team members understanding its importance.

Creating a company AI use policy requires balancing innovation with risk management. Based on current best practices, here is a framework to help you develop one.

Your AI Use Policy

A robust AI use policy should establish three fundamental areas:

1. Permission boundaries
2. Protection protocols
3. Standards for ethical use

These form the foundation for responsible AI adoption across your organisation, ensuring your data is not leaked to the media or worse, your competitors.

1. Permission Boundaries

Define clearly what employees may and may not do with AI tools. Specify whether the policy covers internally built AI, vendor-provided solutions or both. Include a list of approved AI tools and explicitly prohibit unapproved systems from handling sensitive data such as personal identifiers, confidential business information, or proprietary code.

2. Protection Protocols

Establish mandatory data protection measures including encryption of inputs, usage logging, and segregation of restricted data from public or generative models. Require that all AI tools undergo security review before deployment.

3. Ethical Standards

Embed principles of fairness, accountability, transparency, and bias avoidance. Require documented impact assessments for high-risk AI applications.

Essential Sections to Include

Although keeping your AI use policy brief is important, there are quite a few areas that should be unpacked:

• Definitions and Scope – Provide precise definitions of AI-related terminology so employees understand what the policy covers. Clarify applicability to all employees, contractors, and third parties who use, procure, develop, deploy, or manage AI tools.
• Risk Classification – Create a risk-based classification system for AI applications. Distinguish between low risk uses like drafting emails and high-risk uses involving hiring decisions, client delivery, or financial recommendations.
• Employee Responsibilities – Require completion of regular AI training modules. Mandate adherence to documented usage guidelines for each task. Establish procedures for reporting anomalies or unintended outcomes.
• Governance Structure – Form a cross-functional AI oversight committee responsible for reviewing requests, granting approvals, and monitoring ongoing performance. Designate a point of contact for AI-related questions.
• Request and Approval Process – Outline procedures for requesting new AI tools including risk scoring, security review, and approval workflows. Document the designated point of contact for submissions.
• Compliance and Monitoring – Include provisions for continuous monitoring, periodic audits, and scheduled policy reviews at least annually. Address compliance with evolving regulations and legal obligations.
• Consequences and Enforcement – Specify consequences for policy violations and clarify who bears responsibility when AI systems contribute to errors or decision-making issues.

 

How to Implement your AI Use Policy

For most small to medium businesses, you will likely need to spend 3 months setting up the policy and reviewing usage and policy compliance. If this is priority or considered urgent, then it could also be done within 8 weeks.

Phase 1: Assess and Draft (Weeks 1–3)

The goal here is to identify risks and create a baseline policy.

Week 1: The Audit

• Hold a meeting with Sales, Marketing, HR, and Ops department heads to list every AI tool currently in use. Even include unofficial ones like personal ChatGPT accounts.
• Identify sensitive data: Customer identifiable information, financial records, proprietary code, or trade secrets. Focus on the top 3-5 tools that handle sensitive data.

Week 2: Draft the Core Rules

• Write the policy document. Keep it to 2-3 pages max.

A typical policy document includes:

• Background and purpose statement
• Scope and applicability section
• Definitions of key terms
• Approved and prohibited uses
• Data protection requirements
• Employee responsibilities and training
• Governance and oversight structure
• Request and approval procedures
• Monitoring and audit processes
• Review schedule and update mechanisms
• Contact information and support resources

If you are looking for some inspiration and examples of policies, you can find some here.

Week 3: Leadership Sign-off

• Get the business owner or CEO to sign off – leadership endorsement is the strongest enforcement mechanism.
• Briefly consult a legal professional, even a one-hour review, to ensure you aren’t violating local employment or data laws.

Phase 2: Rollout and Training (Weeks 4–7)

The goal of phase 2 is to get everyone on board without slowing down productivity.

Week 4: Communication

• Send a clear, friendly email explaining why the policy exists – protecting the business and clients, not policing employees.
• Publish the policy on your internal wiki or shared drive.

Week 5: Training

• Run a 30-minute session (record it) covering: how to spot an approved vs. unapproved tool, What happens if you accidentally paste sensitive data, How to request a new tool. Use real examples from your industry.

Week 6: Soft Launch

• Allow a 1-week grace period where employees can self-report any unapproved tools they are using without penalty.
• Update the approved list based on this feedback.

Week 7: Formal Enforcement

• The policy is now active and managers should start checking that AI usage aligns with the rules.

Phase 3: Stabilisation and Futureproofing (Weeks 8–12)

The goal here is to embed the policy and prepare for 2026 regulations.

Week 8: First Mini-Audit

• Check if the sensitive data is still being protected.
• Review any new tool requests that came in during the soft launch.

Week 9-10: Vendor Contract Review

• If you use SaaS AI tools, check their Terms of Service. Ensure they don’t claim ownership of your data or train on it without consent.
• Add a simple clause to future vendor contracts regarding data privacy.

Week 11-12: Have EU clients? Prepare for Compliance

• With the EU AI Act and other global regulations coming into force in August 2026, start documenting your risk assessments for any high-risk AI uses (e.g. hiring tools, customer credit scoring).

It is a good idea to set a calendar reminder for a policy review every 6 months, given the speed of AI tool rollouts.

Your AI tool budget

There are no freebies in this world, and AI tools could become expensive in the future, so keeping an eye on the AI tool spend is critical. The budget should not be managed by individual employees or scattered across departments. Instead, it should be centrally governed to ensure security, cost control, and compliance.

AI tool expenditure is normally budgeted for in the IT Department, with sign off from the CTO, CIO, or CEO (for smaller businesses).

A common but risky scenario is employees subscribing to free or cheap versions of tools (like a free tier of a chatbot) to get work done because the company hasn’t provided one. Employees should not pay for AI tools used for work purposes, especially if those tools involve company data.

This is usually the number one cause of data breaches as free tiers often sell data or use it for training.

Your AI use policy should explicitly prohibit using personal subscriptions for work tasks involving company data. If a tool is needed for work, the company must provide it.

It is likely that AI will continue to impact workplaces in the near future, and making robust preparations to deal with the technology, is the best way to deal with this potential business opportunity and threat.