The never-paste list
What never goes into a public AI tool: customer details, payment information, employee records, unpublished pricing, anything under NDA. Written, posted where work happens.
Somebody on your team already pastes work into ChatGPT.
The AI-Use Policy Checklist: the one-page set of rules that draws the line before something leaks. For owner-operators with 5 to 50 employees. Email in, PDF in your inbox.
The tool is not the risk. The missing rules are. Most small teams adopted AI the same way: one person started, it spread, and nobody ever wrote down what is allowed. That works right up until customer data, payroll numbers, or a client's contract ends up inside a free chatbot account nobody controls.
You do not need a 40-page policy from a law firm. You need one page your team has actually read. This checklist is that page. Work through it with your team in about an hour, sign it, done.
The five rules it sets
The approved-tools list
Which tools, which accounts, who signs off on new ones. Business accounts for business work, training-on-your-data turned off where the setting exists.
Client-data rules
When client material may touch an AI tool, what your contracts already say about it, and the answer you give when a client asks "do you use AI on our work?"
Review before send
Nothing AI-drafted reaches a customer without a human read. The sender owns the words, and every fact and number gets verified before it goes out.
The bad-day plan
What counts as an incident, why reporting one has to be safe, and the four steps that contain it. The cheap incident is the one you hear about in the first hour.
Who it is for
Owner-operators running 5 to 50 people. You are the one who answers for it when something leaks, and you do not have an IT department to write the rules for you. This is the page I walk business owners through in the "AI at Work Without Getting Burned" workshop, in PDF form, free.
These rules are not theory. I run my own business on AI agents, the actual daily plumbing, and rule four on this page is the rule I will not break in my own shop.
Questions people ask
What should an AI use policy include?
Five things: what staff may never paste into a chatbot, which tools are approved, how client data is handled, who reviews AI output before it goes out, and what to do on the day something leaks. Anything longer than one page does not get read, so the checklist keeps it to one page a team can actually follow.
Does a small business need an AI use policy?
Yes, the moment anyone on the team uses a chatbot for work. The risk is not the tool. It is a staff member pasting a client list or a signed contract into a free account with no idea where it lands or who trains on it.
Email below · PDF lands in inbox
Get the AI-Use Policy Checklist.
The PDF lands in your inbox. You also get the Human at Work newsletter, one brief a week.
Already on the list? Grab the checklist PDF directly. The form is for first-time subscribers; the download link works either way.