Somebody on your team pasted a client's information into a free chatbot this week.

Maybe it was your bookkeeper trying to make sense of a messy P&L. Maybe it was your office manager writing a careful email to a customer who's three months late. Maybe it was your newest hire, who's twenty six and hasn't written an email without help since college.

They didn't tell you. And honestly, they're not being sneaky. Nobody ever gave them rules, and they figured if they asked, you'd say no.

So they just did it.

I'm not guessing here. Back in 2024, Microsoft and LinkedIn surveyed thousands of knowledge workers for their Work Trend Index. About three out of four said they were already using AI at work. And of the people using it, close to eight in ten were bringing their own tools. Personal accounts, with settings you've never laid eyes on.

That was two years ago. You know the number's higher now.

My take on this is going to annoy two groups of people at once.

If you're the owner who banned AI, you didn't ban it. You just made sure it happens where you can't see it.

If you're the owner cheering "everybody use AI for everything," you left the keys in a running truck with your client list sitting on the passenger seat.

You both need the same fix. A one page policy in plain English, plus about thirty minutes with your team.

Let me paint the picture of what happens when nobody sets the rules.

Your team is using free consumer accounts. Depending on the tool and the settings, what people type into a free account may be used to train future models. Most of your people have never opened the settings page. They don't know there's a toggle. They definitely don't know which way it's flipped.

Into those accounts goes stuff like this.

Client names, addresses, and phone numbers, because somebody wanted help cleaning up a spreadsheet.

Contracts and proposals with your pricing in them, because somebody wanted a quick summary.

Customer or patient details, because somebody wanted a nicer way to word a hard conversation.

Your own financials, because somebody wanted to understand why cash is tight this month.

Passwords. Yes, really. People paste whole email threads without reading them, and old emails are full of login details.

Back in 2023, engineers at Samsung pasted internal source code into ChatGPT while trying to fix bugs. Samsung ended up restricting the tools across the company. That's an outfit with an army of lawyers and a security department bigger than your whole industry. Your bookkeeper doesn't stand a chance without a few simple rules.

And it isn't only the data going in. It's the stuff coming out.

Somebody's sending AI written emails to your best client in a voice that sounds nothing like your company. Somebody's quoting a "fact" the chatbot made up with total confidence. Somebody's posting AI images on your social accounts that make you look like a stock photo factory.

Nobody's doing any of that on purpose. It's still your problem.

I get the instinct. You read a scary headline, you send an email that says "no AI on company work," and you feel like a responsible adult.

Then nothing changes, except now people hide it.

Your team uses these tools because they work. The email that took forty minutes takes eight. The report that sat on someone's desk for two days gets done before lunch. You hired people to get things done, and they found a faster way to get things done. That's exactly the behavior you want. Punishing it is like writing up the guy who found a shortcut through the warehouse.

Meanwhile, your competitors are figuring out how to do it safely. A year from now, their team of five puts out the work of a team of eight, and you're sitting there wondering how they can afford to underbid you.

So don't ban it. Put some guardrails up and let your people run.

Six sections go on the page, and it stays one page. Longer than that and nobody reads it, and a policy nobody reads is just decoration.

Section one: approved tools.

List the exact tools people are allowed to use for work, and say which accounts. Company accounts only. No personal logins for company work.

This is where a lot of small businesses get stuck, because paying for separate seats on three or four AI tools for every person adds up fast. My shortcut is Galaxy.ai. One subscription gets your team ChatGPT, Claude, Grok, and a pile of other models in one place. You're not paying four bills, and nobody has an excuse to sneak back to their free personal account.

Whatever you pick, the rule is the same. If it's not on the list, it doesn't touch company work.

Section two: the red list.

This is the stuff that never goes into any AI tool. Ever. Put it in bold on the page.

Social Security numbers, bank account numbers, and credit card numbers.

Passwords, API keys, and login details of any kind.

Medical or health information about any customer, patient, or employee.

Anything covered by an NDA or a client contract that says it stays private.

Employee records, pay, reviews, or discipline.

Keep it short. Five to eight items. People remember short lists and ignore long ones.

Section three: the yellow list.

This is the stuff that can go in, but only into a company account with training turned off, and only with the names stripped out.

Client emails and documents. Swap the name for "Client A" before you paste.

Proposals and pricing. Fine in an approved tool. Not fine in some random free app somebody found on Instagram.

Internal financials. Fine for analysis in an approved tool. Don't paste the whole general ledger when a summary will answer the question.

What makes the yellow list work is a habit I call scrub then paste. Thirty seconds of find and replace before anything goes in. Names become roles. Addresses disappear. Account numbers get deleted. The answer you get back is just as good, and you've wiped out a whole category of risk.

Section four: the human sign off.

Anything AI touched that goes to a client, gets posted publicly, or involves money gets read by a human before it leaves the building. Every word.

And I mean actually read, not a quick skim on the way to lunch.

These tools still make stuff up. They do it with a straight face and perfect grammar, which is the scary part. One invented number in a proposal or one wrong policy detail in a customer email costs you way more than the time the tool saved.

Section five: disclosure.

Decide when you tell clients you used AI. My rule of thumb for service businesses goes like this. If a client is paying for your expertise and your judgment, AI can help you do the work, but it can't do the judgment part for you. You don't need to stamp "written with AI" on every email, any more than you'd write "spellchecked by Microsoft." But if a client asks, tell the truth. And if your industry has its own rules, and a few do, those come first.

Section six: who to ask.

One name. The person your team goes to when they're not sure. In most small businesses, that's you or whoever runs operations. The page should literally say "when in doubt, ask Jen," and Jen should know she's Jen.

That's the whole page. Six sections. You can write it in an hour. Or you can have AI write the first draft and spend twenty minutes fixing it, which, if you think about it, is a pretty good test of whether you understood section four.

A policy is great. Settings are better, because settings keep working on the days people forget the policy.

Hand this short list to whoever handles your tools.

Turn off model training on every company account. Most of the major tools have this in their data controls or privacy settings. Check every account, not just yours.

Use business or team plans where it matters. The team and business tiers of the big tools generally come with stronger data protections than the free versions. Read the terms for whatever you pick. If you handle health information, talk to whoever handles your compliance before anyone types a single patient detail anywhere.

Turn on two factor authentication. Same as your email. These accounts now hold a running history of everything your team has asked about your business. That's a nice little file for anyone who gets in.

Kill personal accounts for work. Say it directly. Your personal ChatGPT is for your personal life. Company work lives in company accounts. When somebody leaves, you shut off their access, and their chat history about your clients doesn't walk out the door with them.

Review connected apps once a quarter. A lot of these tools now plug into Gmail, Google Drive, your calendar, and your CRM. Useful. Also a lot of access. Every ninety days, look at what's connected and unplug anything nobody uses.

Rules nobody knows about don't protect anybody. Get the team together for thirty minutes this week. The agenda looks like this.

Minutes zero to five: amnesty.

Open with this, word for word if you want.

"I know a lot of you are already using AI tools at work. That's good. Nobody's in trouble. I want to know what you're using and what it's helping with, so we can do it safely and do more of it."

You have to say the "nobody's in trouble" part out loud. Skip it and you'll get blank stares and zero confessions.

Minutes five to fifteen: show and tell.

Go around the room. Everybody shares one thing they use AI for and roughly how much time it saves. Write it all down.

You'll be surprised. Your front desk person figured out how to summarize voicemails. Your tech uses it to explain repair options to homeowners in plain English. Your bookkeeper built a prompt that sorts expenses in half the time. That list is gold, because those are the uses you're about to standardize for everybody.

Minutes fifteen to twenty five: walk the page.

Go through the policy. Spend most of the time on the red list and the scrub then paste habit. Put it on a screen and do a live example. Take a real client email, scrub it, paste it, get the answer. Watching it once beats reading about it ten times.

Minutes twenty five to thirty: next steps.

Everybody gets a company account login by Friday. Everybody turns off training in their settings before then. Everybody signs the page.

Then follow up a month later. Ask the same question. What are you using it for now? The answers get better every month once people stop hiding.

This is where you go from playing defense to playing offense.

Take that list from show and tell and turn it into a shared prompt library. A Google Doc or a Notion page works fine. For each recurring task, write down the prompt that works best, one example of good output, and a note about what to watch out for.

A few that every service business should have in there.

The tough customer email. "Here's a situation with a customer [scrubbed]. Write a reply that's firm on our policy but warm, under 120 words, in the voice of the two sample emails below." Then paste two emails you actually wrote that sound like you.

The call recap. If you record meetings with Fathom, you already have the transcript and the summary. Add a prompt that turns it into a client follow up email with action items, who owns them, and due dates.

The estimate explainer. "Rewrite this estimate in plain English for a homeowner who doesn't know what any of these line items mean. Keep every price exactly the same."

The review response. "Write a response to this review. If it's positive, thank them for something specific they mentioned. If it's negative, acknowledge it, don't argue, and offer to take it offline."

The meeting prep. "Here are my notes on this client. Give me the three questions I should ask on tomorrow's call and anything I've promised them that I haven't delivered yet."

Every prompt in that library is a little piece of your company's know how, finally written down. New hire starts Monday? They're working with your best people's shortcuts on day one instead of stumbling onto them by month six.

Let's get practical about the upside, because this isn't only about dodging a mess.

Say you've got six people. Each one saves thirty minutes a day by using AI the right way. That's fifteen hours a week across the team. Over a year, somewhere around seven hundred and fifty hours.

That's a part time employee you didn't have to hire, train, or manage.

Now look at what it costs you. A shared AI subscription for the team is a rounding error next to one month of payroll. The policy took an hour. The meeting took thirty minutes. The prompt library builds itself every time somebody finds a better way.

That's about as good a trade as you'll find in a small business. The only way to screw it up is to keep pretending it isn't happening.

Write the one page policy. Six sections. Approved tools, red list, yellow list, human sign off, disclosure, who to ask.

Pick your tools and move everybody onto company accounts.

Turn off training on every account and turn on two factor.

Hold the thirty minute meeting. Lead with amnesty.

Start the prompt library with whatever your team shares in the room.

Your team already made the call on AI. You just get to decide if they follow your rules or make up their own.

Talk Soon,

Dan

Dan Kaufman

Founder, Dead Simple Growth and Pinnacle Masters

P.S. Reply with POLICY and I'll send you the one page AI policy I give clients, ready to fill in with your tools and names. It comes with the red list, the scrub then paste checklist, and the meeting script, so you can run the whole thing this week without starting from a blank page.