If you have not told your staff what they may and may not paste into an AI tool, they have decided for themselves. Some will be careful. Some will paste a customer list, a contract or a payroll file into a free chatbot because it saves ten minutes. A one-page policy is the cheapest risk control you can put in place.
Why this is a money issue
IBM's 2025 Cost of a Data Breach report put the global average breach cost at $4.44 million and found that a high level of "shadow AI," meaning unapproved AI tools used by staff, added about $670,000 to that average.[1] The same IBM article reported that 63% of organizations surveyed had no AI governance policies to manage AI or prevent shadow AI, and that 97% of breached organizations that had an AI-related security incident said they lacked proper AI access controls.[1] Those are global averages that skew toward large companies, so your exposure is different. The pattern still applies: unmanaged AI use increases risk.
Owners also worry about this. Among small businesses surveyed by Homebase, data privacy and security was the top reason non-adopters gave for holding back (38%), and 37% said evidence that their data is secure would move them to adopt.[2] Bluevine found security and privacy concerns rose from 23% to 33% year over year.[3] A clear policy answers that worry for your staff and your customers.
What the policy should say
1. Which tools are approved
List the specific tools staff may use for work, and say they must use company-managed accounts rather than personal ones. Business-tier plans often include admin controls and different data terms than free consumer versions, so check what each plan does with your inputs before approving it.
2. What data goes in
Use three simple categories:
- Green, fine to use: public information, your own marketing copy, generic questions with no names or numbers attached.
- Yellow, only in approved tools: internal documents, project details, pricing, vendor information.
- Red, never in AI tools without written approval: customer personal information, Social Security or tax ID numbers, payment card data, bank details, medical or insurance records, passwords, privileged legal material and anything covered by a confidentiality agreement.
3. Who reviews the output
Anything that goes outside the company (to customers, vendors, regulators or the public) must be reviewed by a person who takes responsibility for it. AI drafts. Humans send.
4. What AI may not decide
Hiring, firing, pay, discipline, credit, pricing for individual customers and similar decisions should not be made by AI alone. Some of these areas have legal requirements that vary by state and industry, so ask your attorney before using AI in them.
5. How to add a new tool
Give staff an easy request path to a named person, with a short review: what data it touches, what the vendor does with it, what it costs and who owns it. If the route is easy, fewer people go around it.
6. What to do if something goes wrong
Name a contact. Say that reporting an accidental paste is expected and will not be punished. You want to hear about it on day one, not day sixty.
7. Review date
Put a date on it. Review every quarter at first, because the tools change fast.
Questions to ask any AI vendor
- Do you use our inputs to train your models, and can we turn that off?
- How long do you keep our data, and can we delete it?
- Who at your company can see our data?
- What security certifications do you hold, and can we see the reports?
- What admin controls and activity logs do we get?
- Where is the data stored?
Make it usable
A policy nobody reads protects nobody. Keep it to a page, use examples from your own business, walk through it in a 20-minute staff meeting and put it where people will find it. Pair it with approved tools that actually work, because staff turn to shadow tools when the approved ones are worse.
This is a practical outline, not legal advice. Industries with confidentiality rules, such as accounting, insurance, healthcare and legal services, have additional obligations. Have your attorney or compliance adviser review your final policy.
Sources
- IBM, "2025 Cost of a Data Breach Report: Navigating the AI rush"
- Homebase, "2026 Main Street AI Gap Report"
- Bluevine, "2026 Small Business AI Trends Report"
Figures are quoted from the sources above and were reviewed in October 2026. Where a source is a secondary summary of other research, we say so in the text. Survey results reflect each survey's own sample and definitions. Examples labeled as illustrations use made-up numbers to show the method. Nothing here is a forecast or a guarantee of results.
Want this worked out for your business?
Tell us what is wasting your time.