What your workplace probably has not decided

The gap most people are standing in

A great many organisations have no AI policy, an out-of-date one, or a one-line ban that everybody ignores. Meanwhile the work is being done with these tools anyway. If you are the person doing it, you are making decisions on your employer’s behalf, and the useful move is to make them deliberately and write them down.

This lesson is for the individual in that position, not for a compliance department.

Find out what already applies

Before asking anyone about AI specifically, check three documents you have already agreed to:

The confidentiality or IT acceptable-use policy. It almost certainly says something about not sending company information to third-party services. That clause covers AI tools whether or not it mentions them, and it is the one people breach without noticing.

Your contract. Clauses about intellectual property and about who owns what you produce may bear on work created with these tools.

Any client agreement you work under. Increasingly these carry a clause requiring disclosure of AI use, or prohibiting sending their material to third parties. In consulting, legal, publishing and design work this is now common.

That is fifteen minutes and it usually answers the question. Most “is this allowed” situations are settled by a policy that already exists.

Asking without triggering a ban

If you ask “may I use ChatGPT for work”, a cautious answer is no, because no is the safe answer to an unbounded question. A specific one gets a better result:

“I want to use an assistant to draft first versions of supplier emails and to summarise public documents. Nothing with client names or personal data. Is that acceptable, or is there an approved tool you would prefer?”

That is answerable. It names a use, states a boundary, and offers the organisation the option to direct you somewhere. It is also the paragraph you want on record, which is the real purpose.

Writing the one-pager

If you end up drafting something for a small team, the useful version is short and covers five things:

1. Which tools are approved, and which tier or account to use.
2. What may never be sent: client identifiers, personal data, credentials, anything under a confidentiality clause.
3. What must be checked before it goes out, and by whom. Anything client-facing, anything with a number in it, anything legal.
4. Disclosure. Whether clients are told, and in what circumstances.
5. Who to tell when it goes wrong, and that reporting quickly is expected rather than punished.

One page. A longer one will not be read, and this is a domain where a rule nobody remembers is worse than no rule, because it creates the impression of a decision that has not been made.

The two failure modes

A blanket ban. People use the tools anyway, on personal accounts, on personal devices, with no oversight and worse terms. The organisation has traded a manageable risk for an invisible one. This is well documented and entirely predictable.

A blanket permission. Everybody sends everything to whichever free tool they found, and the first anyone hears about it is when a client asks.

The workable position is between them, and it is the one the one-pager describes: named tools, a clear line about what is sensitive, a check before anything goes out, and a route for reporting mistakes.

The check that has to be a person

One line in the one-pager does more work than the rest: what must be checked before it goes out. It works only if it names a person and a moment, rather than an intention.

“Client-facing text is read by the person sending it, before sending” is a rule. “We verify AI output” is not, and it is what most policies say. The distinction matters because the failures in this area are not people ignoring a rule; they are people believing somebody else already checked. Name who, and name when.

When you are the whole organisation

If you work for yourself, you are the policy. Write the paragraph anyway (which tools, for what, on what terms, what you never send) and keep it with your business records.

The reason is not bureaucratic. When a client asks whether you use AI on their material, and they increasingly do, the difference between a considered answer and an improvised one is the difference between reassuring them and worrying them. It takes ten minutes and you write it once.