It happens in almost every busy office. Someone is behind on a report or a quote, so they paste a client file into ChatGPT on their personal account to get it done faster.
The work gets done. But the company now has client data sitting in an account it doesn't own, under settings nobody checked.
The answer isn't to ban AI. Your team will keep using it either way. The answer is to give them the right account and a few clear rules.
The real risk: personal accounts
When each person signs up on their own, you have no say over any of it:
- Who owns the chats. If someone leaves, their history leaves with them.
- Which data settings are on. On some personal plans, what you type can be used to improve the vendor's models unless the user turns that off.
- What gets pasted in. Nobody has said what's fine to share and what isn't.
None of this means the tools are unsafe. It means nobody set them up for a business.
Step 1: move the team to a business plan
ChatGPT, Claude, Gemini and Copilot all offer business plans. On those plans:
- Your company owns the workspace. You add and remove people, and you can see who has access.
- Chats aren't used to train the models by default. That's what the vendors say for their business plans. Check the current terms for the plan you pick, because policies change.
- You control the settings in one place, instead of hoping every employee found the right toggle.
Which tool fits usually depends on what you already use. Teams on Microsoft 365 often start with Copilot, and Google Workspace teams with Gemini.
Step 2: write a one-page usage policy
A policy doesn't need to be long. It needs to answer three questions your team actually has:
| Question | Example answer |
|---|---|
| What's fine to paste in? | Drafts, internal notes, public information, anonymized examples |
| What isn't? | Anything you're not allowed to share, like health information, or what a client contract says you must keep private |
| Who do I ask when I'm not sure? | One named person, not "IT" |
Keep it short enough that people read it. Revisit it when you add a new tool.
When a business plan isn't enough
Some work needs more than a chat window. If the answer depends on thousands of your own files, or on live data from your CRM, a custom build that runs in a private environment for your company may be the better fit. That's rare as a first step. Most teams get a lot further with the right plan, a policy and some training.
We help teams set this up as part of Adopt: the business plan, the data settings, a plain-English policy, and training using your team's real work. You can also read how we handle your data for each service.
Not sure where your team stands? Book a free 20-minute call and we'll tell you what to fix first.