No buzzwords. This page lists exactly what an AI usage policy covers, what we check in your AI business account, and what the training session looks like, so you know what you're getting.
Three things we find in almost every small business the first time we look.
Staff paste client lists, contracts, and financials into free AI tools on personal logins. Nobody can see it, delete it, or turn it off when they leave.
Six people on six personal subscriptions expensed three different ways. No admin, no usage report, no volume pricing.
When a customer or auditor asks "what's your AI policy," the answer is a shrug. For SOC 2 and HIPAA that's a finding.
The same staff who are a risk could be saving hours a week with one training session and the right tools. Guardrails are what make that safe.
Two to three pages, written in plain language for your staff, not for lawyers. Here's every section.
Which AI products staff may use for work, on which accounts. Everything else is off limits for company data.
What may go into AI (public info, drafts), what may go in only on the business tenant (internal docs), and what never goes in (client PII, health data, credentials, financials).
Business accounts only, SSO where possible, no personal logins for work, access removed at offboarding.
Human review before anything AI generated goes to a client, into a contract, or into code. Who signs off.
How you answer when a customer asks about your AI use, and what you require from vendors who use AI on your data.
Who owns the policy, how questions get answered, and a six month review date so it doesn't rot.
Claude, ChatGPT, Copilot, or Gemini. The business and enterprise plans have admin settings that most companies never open. We do.
| Setting | Why it matters |
|---|---|
| Training data opt out | Confirm your conversations and files are not used to train the vendor's models. Default varies by plan. |
| Single sign on and MFA | Access tied to your identity provider, so offboarding one person removes AI access too. |
| Seat and role management | Who is an admin, who is a member, who left the company three months ago and still has a seat. |
| Data retention | How long chats and uploads are kept, and whether you can set it to match your other policies. |
| Connectors and integrations | Which outside systems (email, drive, CRM) the AI is allowed to read. Usually too many. |
| Usage and spend reporting | Who uses it, how much, and what it costs, so finance gets one invoice instead of twelve expense reports. |
| Project and workspace sharing | Shared chats and projects visible to the right people and no one else. |
| Audit logs | Turned on and exported, so there's a record if a customer or auditor asks. |
Ninety minutes, live, for your whole team or by department. Here's the agenda.
What's allowed, what isn't, and why. With real examples from your business, not generic slides.
Logging in through SSO, projects and shared workspaces, where files go, what the vendor can and can't see.
Role, context, format, examples. The difference between a useless answer and a useful one, hands on.
Picked with you beforehand. Drafting proposals, summarizing meetings, cleaning data, first draft replies. Everyone leaves with something they'll use Monday.
Pasting a client contract, trusting a citation, sharing a chat link publicly. Short and memorable.
Recording and a one page cheat sheet sent afterward. Thirty days of follow up questions included.
Once the guardrails are in place, AI stops being a risk and starts being leverage.
Agents that answer the phone, triage tickets, draft follow ups, or summarize your week, built on your data with your rules.
Intake form to CRM to draft reply, with a person approving at the end. No code on your side.
Usage, spend, new tools worth considering, policy updates. Fifteen minutes with leadership each quarter.
We look at what your staff are using today, what your business account settings look like, and where the gaps are. You get a short written summary either way.
