Your team is already using AI at work, whether or not anyone’s asked you. A ban won’t change that, but a one-page policy with two colours will.
Walk across any park and you’ll find a worn dirt track cutting the corner off the paved path. Nobody planned it. Enough people wanted to get somewhere faster, so the path appeared. That’s what’s happening with AI in most small businesses right now.
How it starts
Someone has a report due at four. They’ve heard a free chat tool can draft it. They paste in last month’s version, which has three client names and a fee schedule in it, and get 40 minutes of their afternoon back. Nobody told them that was a problem, because nobody told them anything.
The surveys on this land in the same place year after year. Around half of office workers use AI tools their employer hasn’t approved. A fair share of them have put customer data into those tools. In our own conversations with owners, the usual answer to “what’s the team using?” is a guess.
The risk isn’t that people are using AI. It’s that client data is walking into consumer accounts with data sharing left on, under logins nobody in the business controls.
Why a ban makes it worse
A ban moves the same behaviour onto personal phones. You can’t see what’s in use and you can’t set the tools up properly, so the risk stays. Most people, when asked, say they’d rather use AI quietly than be told to stop, and a ban tells them exactly that.
You also lose the upside. The staff member drafting the report in 20 minutes instead of an hour was onto something. The fix is to make that path the official one, with the right account and the right rules.
Green and red, nothing in between
Most AI policies fail because they’re long and they have an amber zone. Amber means “ask first”, and in a busy week nobody asks. So we write two colours only.
Green is what’s fine, using the named tool the business pays for. Drafting and rewriting, summarising documents you own, brainstorming, cleaning up meeting notes, and any client matter with the identifying details taken out first.
Red is what stays out. Client names with their personal details, financial records, health information, passwords and logins, anything under an NDA, and any tool that isn’t on the approved list.
If something isn’t on the green list, it’s red until you decide otherwise. The list grows as you learn what the tools are good at. The whole thing fits on one page, and a new starter reads it in five minutes.
Find out what’s in use without a witch hunt
The fastest way to see the desire paths is to ask, and to make it safe to answer. One team meeting, one question: “show me what you’re using and what it does for you.” Write the answers on a list, with no consequences attached. Anyone who’s found a tool that saves them an hour a day has done you a favour, and you want to know about it.
Then check two places the meeting won’t cover. The company card, for AI subscriptions nobody mentioned. And the admin page of whatever you use for email, which usually lists the apps people have signed into with their work account.
For every tool on the list, decide: green with a proper business account, or off. The green ones get data sharing turned off, one login per person, and two-factor on. That’s the difference between a tool your team found and a tool your business owns.
The Australian bit
The Privacy Act applies to most businesses turning over more than $3 million, and some smaller ones regardless, health providers among them. If it covers you, you’re responsible for personal information your staff put into an AI tool, and a leak may need reporting. The government’s voluntary AI guidance for business asks for what a one-page policy gives you: someone accountable and a human able to step in. None of this is legal advice, but it’s the shape of what’s expected.
Put the policy where the AI can read it
A policy in a drawer gets forgotten. We keep it with the rest of the setup: three plain documents covering who you are, how you work, and what’s happening now. The green and red list goes in “how you work”. Every approved AI tool reads those documents before it does anything, so the rules apply to the software as well as the people. When someone new starts, they read the same page.
That folder belongs to the business, not to whichever app is on the team’s phones this month. Owning your AI setup means you decide what it sees, and you can check.
If you want the setup done with you, set up your own AI Operating System covers the three documents and the policy page. If you’d rather do it with your whole team in the room, work with Brightwaters.