Your staff are already using AI. Here is the policy you need.

By Keith Myers · August 2026

Survey after survey puts workplace chatbot use above half of all office workers, and most of it happens on personal accounts the company never sees. If you have more than a handful of employees, someone pasted company text into a chatbot this week.

You have three options. Ban it, ignore it, or manage it. Two of these do not work.

Why banning fails

A ban does not stop the behavior, it moves it to personal phones and home laptops where you have no visibility at all. The staff who ignore the ban are usually your most productive people, because they are the ones who found the time savings first. You end up punishing initiative and keeping the risk.

Why ignoring it is worse

Free chatbot accounts often use conversations to train future models unless the user opts out. Your client lists, draft contracts, and financials do not belong in someone's personal account with default settings. When a client asks what your AI practices are, and they are starting to ask, "we have not looked into it" is the wrong answer in writing.

What a working policy contains

One page. Six points. Written for people who will spend 90 seconds reading it.

1. Approved tools. Name the two or three tools the company pays for, with business accounts and training turned off. Paying for proper accounts is the whole game: it gives staff a legitimate place to do what they were doing anyway.
2. What never goes in. Client names tied to their business, financials, health information, credentials, anything under NDA. A short list people can memorize beats a taxonomy nobody reads.
3. Human review. Anything AI-drafted that leaves the building gets read by a person who takes responsibility for it. The sender owns the content, not the tool.
4. Disclosure. When clients or regulators ask whether AI touched the work, everyone gives the same answer. Decide the answer now, not during the call.
5. Who to ask. One named person for "can I use this new tool" so decisions take a day, not a committee.
6. Review date. This field changes every few months. Put a date on the policy and revisit it twice a year.

What to leave out

Definitions of machine learning. Threats of termination. Anything longer than a page. The twelve page version written by outside counsel gets filed and forgotten, and the behavior it was supposed to govern carries on unmanaged. A policy people have actually read is the only kind that works.

The order of operations

Buy the business accounts first, then publish the policy. A policy that only says no, without giving staff a sanctioned tool, is a ban with extra paperwork, and it fails the same way.