Your Team Is Already Using AI. You Need a Policy.
Your staff are already using AI tools. ChatGPT for first drafts. Claude for research. Gemini for image work. Probably without your knowledge, definitely without a policy that says what is and is not OK. This is the reality across small and mid-sized businesses in Toronto right now. We hear it on every discovery call. The current MSP “bangs on about AI” in their newsletter but never actually helps the client write a usage policy. Leadership does not ask for one. The person whose job is to keep the company out of harm’s way feels exposed.
If you are in that position, you are not alone. Every organization we work with is experiencing some level of shadow AI right now. The question is not whether to acknowledge it. The question is what to do about it.
This is a brief, practical guide to building an AI usage policy for small businesses where staff are already using ChatGPT, Claude, and Gemini without governance. We cover narrowing to one approved platform like Copilot, what a one-page policy needs to include, responsible AI training, and the honest limits of what any policy can do against shadow AI.
Why AI Is Different from Other Software
AI tools do not stay where you put them. They are not contained by an admin password or a permission control. If a staff member opens ChatGPT in a browser tab and pastes a client document into the prompt, that data has left your environment. You cannot get it back. You cannot audit who saw it. You cannot prove to a vendor security questionnaire that your data was not used to train someone else’s model.
There is currently no tool that locks down AI use the way you can lock down file sharing or external email. The tools to fully contain AI inside a small business do not exist yet. This is genuinely emerging technology. It is the wild west.
What you can do is set expectations, narrow the surface area, and make AI use visible to leadership instead of invisible. That is what an AI usage policy does. It will not solve every problem, because nothing solves every problem with AI right now. But it moves you from flying blind to flying with instruments.
What an AI Policy Actually Needs to Do
Three things make a real AI policy work, regardless of which template you start from.
First, narrow your team to one platform. If everyone is using whatever they happen to like, ChatGPT this week, Claude next week, Gemini for images, a new tool somebody saw on LinkedIn, you have no logs, no monitoring, no ability to recover from a mistake. For businesses already in the Microsoft ecosystem, we recommend Copilot as the single approved platform. If your team strongly prefers Claude, Claude can be accessed through Copilot, which keeps the data inside your tenant. Using a slightly less capable tool inside a contained environment is a worthwhile trade for the ability to log and monitor what is happening. This is what Adam in our office calls “containing the blast radius.”
Second, write a policy that staff actually read. Most AI policies are written by lawyers, run six pages long, and get skimmed once during onboarding. A working AI policy fits on one page. It names which tools are approved and which are not. It names the categories of data that must never be pasted into any AI tool. Client data. Financials. Personal information. Anything covered by a confidentiality agreement. It says what to do if you think you may have pasted something you should not have. It says that AI-generated outputs need to be reviewed by a person before being sent externally. That is the working minimum.
Third, train the team on responsible AI use. This is the part most policies skip and most failures come from. AI is genuinely powerful. In skilled hands, it adds real value. In the hands of someone who does not understand the failure modes, it can hallucinate a fake source into a client deliverable, summarize a contract incorrectly, or generate copy that looks right and is wrong in a way nobody catches.
The welder analogy holds here. An experienced welder picks up the tool and does the job with skill and precision. A layperson can pick up the same tool and do real harm to themselves and everyone around them. AI is the same. The tool is not the problem. The policy and the training are how you make sure your team is the welder.
What a Policy Cannot Do
Before going further, the honest part. An AI policy does not stop AI misuse. It reduces it. It surfaces it. It gives leadership something to point at when something goes wrong. It does not guarantee that nobody on your team will ever paste a client document into a free chatbot at 11pm on a deadline.
This is the human element, and no policy controls it perfectly. Your team uses personal phones, personal laptops, and personal accounts. Shadow AI does not require company infrastructure to happen. It needs a person with a problem and a free tool. A policy gives them a clear answer when they pause to think about it. It does not stop the moments when they do not pause.
A policy is the floor, not the ceiling. The real protection is the combination of the policy, the training that explains why the policy exists, and a culture where people feel comfortable asking “is this OK?” before they hit paste.
When Leadership Does Not Want a Policy
This is the harder part of the conversation, and it is the situation a lot of operations leaders find themselves in. You are the one whose job description says “protect the company.” Leadership is not asking for a policy. Sometimes they are actively pushing back.
The honest case to make is this. Without a policy, AI use is shadow IT. The company has the liability without the visibility. If a staff member pastes a client deliverable into a free AI tool, the company is exposed. If somebody acts on an AI-generated output that turned out to be wrong, the company is exposed. If a vendor or client asks during a procurement screening how the business governs AI use, “we do not have a policy” is not a defensible answer in 2026.
Leadership reluctance often comes from a fear that a policy will slow people down or sound bureaucratic. It does not have to. A one-page policy plus a single approved platform plus light training is achievable in a few weeks, not a year, and the work usually surfaces a more productive way for the team to use these tools than what was happening before.
If you are stuck on this conversation inside your organization, we are happy to join it. We can bring the operational reality, not the sales pitch. We work with leadership teams across Toronto and the GTA who are in exactly this position right now.
Next Steps
When exploring your AI usage policy for small business, you can also tackle these additional IT policies for small business. As you explore policies, remember;
If you would like to also discuss cybersecurity controls for your business, book a free consultation. We’ve been helping small business teams since 2003.
