"The other day, a sales rep was drafting a proposal draft with ChatGPT. When I asked around, accounting was also using it to summarize meeting minutes, and everyone was pasting internal documents using their personal accounts. We see how convenient it is, but we are terrified that company data might be leaking out."—This was a concern recently shared with us by an executive at a company of about thirty employees.
Employees often begin using generative AI on the job before leadership establishes an official stance. Often called "Shadow AI," issuing a strict ban merely pushes usage where oversight cannot reach, while doing nothing risks customer data or trade secrets being absorbed into training models or external servers. Yet an outright prohibition undermines both competitiveness and motivation. What is needed is neither a ban nor passive tolerance, but clear rules for safe usage. In this article, we outline how SMBs can draft and establish generative AI guidelines, drawn from our perspective supporting clients through custom development.
Total bans and total freedom both fail
First, let us examine why both extremes fail to work.
A total ban appears safe on the surface, but in reality, it is the most dangerous. People will not stop using tools that make their work easier. If banned, staff simply use them secretly on personal accounts beyond corporate visibility and control. This creates the least transparent scenario possible, where logs are unavailable and nobody knows what information was submitted.
Conversely, total freedom is equally hazardous. Simply telling employees "feel free to use it as you like" leads to customer personal data and unreleased financial figures being pasted into free-tier chatbots without hesitation. Free versions often use submitted data for model training, and once handed over, that data cannot be reclaimed.
The answer lies in the middle: drawing a clear line on what data can go into which tools and to what extent, and allowing employees to use them openly within those bounds. A guideline is simply the articulation of these boundaries. While internal AI adoption for SMBs is explored in our Internal AI Assistant article and Internal Inquiry AI Automation article, usage rules are an essential prerequisite.
The four pillars every guideline must include
The contents do not need to be complex. An SMB guideline is fully practical if it covers the following four pillars:
1. Boundaries between allowed and prohibited data: Customers' personal data, unannounced financial or HR information, passwords, secret keys, and data covered by non-disclosure agreements with partners must never be entered. Clarify with concrete examples, showing that publicly available information or sanitized content without company or proper names is acceptable. An abstract directive like "do not input confidential information" leaves staff unable to make practical judgments.
2. Approved tools and contract types: Prohibit personal free accounts and limit usage to business-tier plans contracted by the company (configured so inputs are not used for model training). Having the company provide the tools is the fastest way to bring Shadow AI out into the open.
3. Handling of generated outputs: Do not accept AI outputs at face value; require fact-checking and sign-off by a responsible party. Explicitly state that humans bear ultimate responsibility, keeping copyright and misinformation risks in mind.
4. Consultation contact and updates: Specify whom to consult when unsure and define who reviews the rules and when. Generative AI evolves rapidly; publishing a policy once and forgetting it guarantees it will quickly become obsolete.
| Policy | Visual | What actually happens |
|---|---|---|
| Total ban | Appears safe | Unmonitored usage via personal accounts proliferates |
| Total freedom | Appears productive | Confidential data flows into free tiers irrevocably |
| Rulemaking | Appears troublesome | Enables safe usage within company oversight |
Case study: A company that shifted from "banning" to "company-contracted tools plus a one-page rule"
Here is a concrete example. A company (name withheld) that had effectively banned generative AI out of fear of data leaks approached us: "Our staff seems to be using it under the radar anyway. How should we handle this?" In interviews, we found several employees were using personal free accounts to summarize internal documents—the least visible state possible.
We started by having the company subscribe to a business-tier plan, configured it so inputs would not train models, and distributed access across the organization. Simultaneously, we summarized permitted vs. prohibited data, approved tools, output review procedures, and contact points into a single-page A4 guideline, sharing it in a brief briefing session. While discontinuing the use of free tiers for work, we made it clear that employees could openly use the company-provided tool. As a result, the motivation to hide usage disappeared, activity became visible, and incidents involving confidential data entry were averted. What worked was not a thick policy manual, but first providing a safe outlet and then setting clear boundaries with a one-page rule.
Do not draft a thick rulebook right away; start with safe tools and a single A4 page
A word of caution regarding sequencing: SMBs do not need to draft exhaustive AI governance manuals like massive enterprises right from the start. Striving for that often ends in exhaustion, producing documents nobody reads. What you must do first is have the company provide one safe tool, and present permitted data, approved tools, output handling, and consultation points on a single A4 page. These two steps bring the majority of Shadow AI into the light. You can add departmental exceptions and more advanced usage rules as operations evolve. Guiding staff with a safe platform and clear rules yields a far safer and more productive outcome than clamping down with prohibitions.
If you are worried about employees using generative AI without oversight, struggling with whether to ban it, or wanting to prepare rules and environments for safe adoption, please feel free to reach out through GleamHub's free IT and AI consultation. From assessing your current state and selecting business-tier tools to drafting one-page guidelines and supporting rollout briefings, we will partner with you within a manageable scope.
