{"course":{"slug":"choosing-your-tools","title":"Choosing and Using the Tools","url":"https://addaly.com/learn/choosing-your-tools","level":"beginner","track":"work"},"lesson":{"slug":"the-work-policy","title":"What your workplace probably has not decided","url":"https://addaly.com/learn/choosing-your-tools/the-work-policy","position":56,"of":76,"minutes":8,"answer":"Check the confidentiality policy, your contract and your client agreements before asking about AI specifically, ask a specific bounded question rather than an open one, and keep a one-page record of which tools you use.","keyIdea":"Check the confidentiality policy, your contract and your client agreements before asking about AI specifically, ask a specific bounded question rather than an open one, and keep a one-page record of which tools you use, for what, and what you never send."},"body":{"format":"markdown","text":"## The gap most people are standing in\n\nA great many organisations have no AI policy, an out-of-date one, or a one-line ban that everybody ignores. Meanwhile the work is being done with these tools anyway. If you are the person doing it, you are making decisions on your employer's behalf, and the useful move is to make them deliberately and write them down.\n\nThis lesson is for the individual in that position, not for a compliance department.\n\n## Find out what already applies\n\nBefore asking anyone about AI specifically, check three documents you have already agreed to:\n\n**The confidentiality or IT acceptable-use policy.** It almost certainly says something about not sending company information to third-party services. That clause covers AI tools whether or not it mentions them, and it is the one people breach without noticing.\n\n**Your contract.** Clauses about intellectual property and about who owns what you produce may bear on work created with these tools.\n\n**Any client agreement you work under.** Increasingly these carry a clause requiring disclosure of AI use, or prohibiting sending their material to third parties. In consulting, legal, publishing and design work this is now common.\n\nThat is fifteen minutes and it usually answers the question. Most \"is this allowed\" situations are settled by a policy that already exists.\n\n## Asking without triggering a ban\n\nIf you ask \"may I use ChatGPT for work\", a cautious answer is no, because no is the safe answer to an unbounded question. A specific one gets a better result:\n\n> \"I want to use an assistant to draft first versions of supplier emails and to summarise public documents. Nothing with client names or personal data. Is that acceptable, or is there an approved tool you would prefer?\"\n\nThat is answerable. It names a use, states a boundary, and offers the organisation the option to direct you somewhere. It is also the paragraph you want on record, which is the real purpose.\n\n## Writing the one-pager\n\nIf you end up drafting something for a small team, the useful version is short and covers five things:\n\n1. **Which tools are approved**, and which tier or account to use.\n2. **What may never be sent**: client identifiers, personal data, credentials, anything under a confidentiality clause.\n3. **What must be checked** before it goes out, and by whom. Anything client-facing, anything with a number in it, anything legal.\n4. **Disclosure.** Whether clients are told, and in what circumstances.\n5. **Who to tell when it goes wrong**, and that reporting quickly is expected rather than punished.\n\nOne page. A longer one will not be read, and this is a domain where a rule nobody remembers is worse than no rule, because it creates the impression of a decision that has not been made.\n\n## The two failure modes\n\n**A blanket ban.** People use the tools anyway, on personal accounts, on personal devices, with no oversight and worse terms. The organisation has traded a manageable risk for an invisible one. This is well documented and entirely predictable.\n\n**A blanket permission.** Everybody sends everything to whichever free tool they found, and the first anyone hears about it is when a client asks.\n\nThe workable position is between them, and it is the one the one-pager describes: named tools, a clear line about what is sensitive, a check before anything goes out, and a route for reporting mistakes.\n\n## The check that has to be a person\n\nOne line in the one-pager does more work than the rest: what must be checked before it goes out. It works only if it names a person and a moment, rather than an intention.\n\n\"Client-facing text is read by the person sending it, before sending\" is a rule. \"We verify AI output\" is not, and it is what most policies say. The distinction matters because the failures in this area are not people ignoring a rule; they are people believing somebody else already checked. Name who, and name when.\n\n## When you are the whole organisation\n\nIf you work for yourself, you are the policy. Write the paragraph anyway (which tools, for what, on what terms, what you never send) and keep it with your business records.\n\nThe reason is not bureaucratic. When a client asks whether you use AI on their material, and they increasingly do, the difference between a considered answer and an improvised one is the difference between reassuring them and worrying them. It takes ten minutes and you write it once."},"check":{"question":"Why does a blanket ban on AI tools often leave an organisation worse off than a narrow permission?","options":[{"text":"The work happens anyway on personal accounts, replacing a managed risk with an invisible one.","correct":true},{"text":"Because competitors adopting the tools gain a productivity advantage the banning organisation cannot match.","correct":false,"tempting":"Argues from competitiveness, which is a business case rather than the risk mechanism the ban actually creates."},{"text":"Because a ban is unenforceable in law, so it exposes the organisation to claims from employees who breach it.","correct":false,"tempting":"Invents a legal exposure; internal policies are ordinarily enforceable as employment terms."},{"text":"Because a ban prevents the organisation from negotiating an enterprise agreement with better data terms.","correct":false,"tempting":"Describes a consequence of not buying rather than the reason the ban backfires, since nothing stops a banning organisation from negotiating."}]},"prev":{"slug":"accounts-sharing-and-devices","title":"Accounts, sharing and devices","url":"https://addaly.com/learn/choosing-your-tools/accounts-sharing-and-devices"},"next":{"slug":"choosing-an-image-tool","title":"Choosing an image tool","url":"https://addaly.com/learn/choosing-your-tools/choosing-an-image-tool"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'What your workplace probably has not decided', in Choosing and Using the Tools. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/choosing-your-tools/the-work-policy (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"What your workplace probably has not decided","courseTitle":"Choosing and Using the Tools","module":{"index":6,"slug":"data-terms-and-law","title":"Data, terms and the law"},"answer":null,"keyIdea":"Check the confidentiality policy, your contract and your client agreements before asking about AI specifically, ask a specific bounded question rather than an open one, and keep a one-page record of which tools you use, for what, and what you never send.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-gap-most-people-are-standing-in","runs":[{"text":"The gap most people are standing in"}]},{"t":"p","runs":[{"text":"A great many organisations have no AI policy, an out-of-date one, or a one-line ban that everybody ignores. Meanwhile the work is being done with these tools anyway. If you are the person doing it, you are making decisions on your employer’s behalf, and the useful move is to make them deliberately and write them down."}]},{"t":"p","runs":[{"text":"This lesson is for the individual in that position, not for a compliance department."}]},{"t":"h2","id":"find-out-what-already-applies","runs":[{"text":"Find out what already applies"}]},{"t":"p","runs":[{"text":"Before asking anyone about AI specifically, check three documents you have already agreed to:"}]},{"t":"p","runs":[{"text":"The confidentiality or IT acceptable-use policy.","b":true},{"text":" It almost certainly says something about not sending company information to third-party services. That clause covers AI tools whether or not it mentions them, and it is the one people breach without noticing."}]},{"t":"p","runs":[{"text":"Your contract.","b":true},{"text":" Clauses about intellectual property and about who owns what you produce may bear on work created with these tools."}]},{"t":"p","runs":[{"text":"Any client agreement you work under.","b":true},{"text":" Increasingly these carry a clause requiring disclosure of AI use, or prohibiting sending their material to third parties. In consulting, legal, publishing and design work this is now common."}]},{"t":"p","runs":[{"text":"That is fifteen minutes and it usually answers the question. Most “is this allowed” situations are settled by a policy that already exists."}]},{"t":"h2","id":"asking-without-triggering-a-ban","runs":[{"text":"Asking without triggering a ban"}]},{"t":"p","runs":[{"text":"If you ask “may I use ChatGPT for work”, a cautious answer is no, because no is the safe answer to an unbounded question. A specific one gets a better result:"}]},{"t":"quote","runs":[{"text":"“I want to use an assistant to draft first versions of supplier emails and to summarise public documents. Nothing with client names or personal data. Is that acceptable, or is there an approved tool you would prefer?”"}]},{"t":"p","runs":[{"text":"That is answerable. It names a use, states a boundary, and offers the organisation the option to direct you somewhere. It is also the paragraph you want on record, which is the real purpose."}]},{"t":"h2","id":"writing-the-one-pager","runs":[{"text":"Writing the one-pager"}]},{"t":"p","runs":[{"text":"If you end up drafting something for a small team, the useful version is short and covers five things:"}]},{"t":"ol","start":1,"items":[[{"text":"Which tools are approved","b":true},{"text":", and which tier or account to use."}],[{"text":"What may never be sent","b":true},{"text":": client identifiers, personal data, credentials, anything under a confidentiality clause."}],[{"text":"What must be checked","b":true},{"text":" before it goes out, and by whom. Anything client-facing, anything with a number in it, anything legal."}],[{"text":"Disclosure.","b":true},{"text":" Whether clients are told, and in what circumstances."}],[{"text":"Who to tell when it goes wrong","b":true},{"text":", and that reporting quickly is expected rather than punished."}]]},{"t":"p","runs":[{"text":"One page. A longer one will not be read, and this is a domain where a rule nobody remembers is worse than no rule, because it creates the impression of a decision that has not been made."}]},{"t":"h2","id":"the-two-failure-modes","runs":[{"text":"The two failure modes"}]},{"t":"p","runs":[{"text":"A blanket ban.","b":true},{"text":" People use the tools anyway, on personal accounts, on personal devices, with no oversight and worse terms. The organisation has traded a manageable risk for an invisible one. This is well documented and entirely predictable."}]},{"t":"p","runs":[{"text":"A blanket permission.","b":true},{"text":" Everybody sends everything to whichever free tool they found, and the first anyone hears about it is when a client asks."}]},{"t":"p","runs":[{"text":"The workable position is between them, and it is the one the one-pager describes: named tools, a clear line about what is sensitive, a check before anything goes out, and a route for reporting mistakes."}]},{"t":"h2","id":"the-check-that-has-to-be-a-person","runs":[{"text":"The check that has to be a person"}]},{"t":"p","runs":[{"text":"One line in the one-pager does more work than the rest: what must be checked before it goes out. It works only if it names a person and a moment, rather than an intention."}]},{"t":"p","runs":[{"text":"“Client-facing text is read by the person sending it, before sending” is a rule. “We verify AI output” is not, and it is what most policies say. The distinction matters because the failures in this area are not people ignoring a rule; they are people believing somebody else already checked. Name who, and name when."}]},{"t":"h2","id":"when-you-are-the-whole-organisation","runs":[{"text":"When you are the whole organisation"}]},{"t":"p","runs":[{"text":"If you work for yourself, you are the policy. Write the paragraph anyway (which tools, for what, on what terms, what you never send) and keep it with your business records."}]},{"t":"p","runs":[{"text":"The reason is not bureaucratic. When a client asks whether you use AI on their material, and they increasingly do, the difference between a considered answer and an improvised one is the difference between reassuring them and worrying them. It takes ten minutes and you write it once."}]}],"check":{"question":[{"text":"Why does a blanket ban on AI tools often leave an organisation worse off than a narrow permission?"}],"options":[{"text":[{"text":"The work happens anyway on personal accounts, replacing a managed risk with an invisible one."}],"correct":true,"tempting":null},{"text":[{"text":"Because competitors adopting the tools gain a productivity advantage the banning organisation cannot match."}],"correct":false,"tempting":[{"text":"Argues from competitiveness, which is a business case rather than the risk mechanism the ban actually creates."}]},{"text":[{"text":"Because a ban is unenforceable in law, so it exposes the organisation to claims from employees who breach it."}],"correct":false,"tempting":[{"text":"Invents a legal exposure; internal policies are ordinarily enforceable as employment terms."}]},{"text":[{"text":"Because a ban prevents the organisation from negotiating an enterprise agreement with better data terms."}],"correct":false,"tempting":[{"text":"Describes a consequence of not buying rather than the reason the ban backfires, since nothing stops a banning organisation from negotiating."}]}],"order":[1,3,0,2],"why":null},"prev":{"slug":"accounts-sharing-and-devices","title":"Accounts, sharing and devices","minutes":7},"next":{"slug":"choosing-an-image-tool","title":"Choosing an image tool","minutes":9}}}