Your team is already using AI. Someone is drafting proposals in ChatGPT, someone else is summarising meeting notes in Copilot or Gemini, and a developer is pasting code into whichever assistant answers fastest. Most of it is genuinely useful. Some of it means customer data, contracts and source code are going into tools the company has never looked at.
Banning AI rarely works; people just stop telling you. What works is a short, clear policy that gives people safe tools and simple rules. This post explains the risks and gives you a one-page template you can adapt.
The risks, in plain terms
- Data leaving the company. Free and personal AI accounts may keep your chats and use them to improve the service unless the user switches that off. Business and enterprise plans of the major tools generally don’t train on your data by default, but only if people actually use the company account.
- Personal data and privacy law. Pasting customer or employee details into an AI tool is processing personal data. Under India’s DPDP Act and privacy laws in the US, you are responsible for where that data goes.
- Wrong answers that sound right. AI tools can invent facts, figures, legal clauses and references with complete confidence. If nobody checks, the mistake goes to a customer with your name on it.
- Confidentiality and intellectual property. Client documents may be covered by an NDA. AI-generated text, images and code can raise questions about ownership and copyright.
- AI with access to your systems. Assistants and “agents” that can read your mailbox, files or calendar, and browser extensions that promise to help, can be tricked by hidden instructions in a web page or document (so-called prompt injection) into revealing data or taking actions.
- Fake voices and faces. The same technology makes convincing fake calls from your CEO possible, which is why payment checks matter more than ever (see our post on fake invoice e-mails).
A simple rule for data: green, amber, red
| Category | Examples | Rule |
|---|---|---|
| Green | Public information, your own first drafts, general questions, published marketing material | Any approved AI tool |
| Amber | Internal documents, non-personal business data, internal code | Only approved tools, signed in with your company account |
| Red | Customer or employee personal data, passwords and keys, financial results before release, health data, client-confidential documents | Never, unless a tool has been specifically approved for that data |
Your one-page AI usage policy (template)
Adapt the words in brackets, and keep it to one page.
1. Purpose. [Company] encourages the use of AI tools to work faster and better, in a way that protects our customers, our people and our business.
2. Approved tools. Use only the AI tools on the approved list [list, e.g. Microsoft 365 Copilot with your work account], signed in with your company account. Ask [IT contact] to add a tool; don’t sign up with your work e-mail on your own.
3. What never goes in. Never enter Red data in any AI tool: personal data about customers or employees, passwords or access keys, unreleased financial information, health information, or documents a client has asked us to keep confidential.
4. Check everything. You are responsible for anything you send, publish or ship, including AI-assisted work. Check facts, figures, names, legal wording and code before use.
5. Be open. Tell your manager or client when AI has played a significant part in work they rely on, where that matters to them.
6. People decisions. AI may help prepare, but a person makes and owns decisions about people, such as hiring, performance and pay.
7. Connections and agents. Don’t connect AI tools, plug-ins or browser extensions to company e-mail, files or systems without approval from [IT contact]. AI must not send messages or make payments on its own.
8. Mistakes. If you think you’ve put Red data into the wrong tool, tell [contact] straight away. Reporting quickly matters more than blame.
9. Review. This policy is reviewed every six months. Owner: [name].
Rolling it out
- Ask first. A two-minute anonymous survey: which AI tools do people use, and for what? You’ll be surprised.
- Give people a good approved tool. A policy that only says no just drives use underground. Choose business accounts where data isn’t used for training, and turn on the right settings.
- Explain it in 30 minutes. Walk the team through the green/amber/red table with real examples from your business.
- Block the obvious risks. Use your Microsoft 365 or Google Workspace settings to stop people granting unknown apps access to company data (we cover this in our Microsoft 365 checklist).
- Review every six months. The tools change quickly; your policy should keep up.
How CATEYE can help
Our virtual CISO service can write and roll out your AI usage policy, choose and configure approved tools, and make sure it fits your DPDP and client obligations. Our cybersecurity services cover the technical controls behind it. Talk to us about using AI safely.
