My staff are already using AI on their personal accounts with our customer data in it. What is the one-page policy?

Question

Alberta Professional AI School · Accepted Answer

Five lines: which tools are approved, what never goes in, that work happens on business accounts only, that a person checks anything before it reaches a customer, and who to ask when unsure. Write it in plain words, go through it together once, and assume people will keep using AI — the goal is to make the safe way the easy way.

Banning it rarely works. People who found AI useful keep using it, just quietly, which is the worst version for you. A short policy that shows them how to use it safely does more than a long one nobody reads.

Line one: the approved tools, by name, on business accounts. Line two: what never goes in — customer names with contact details, payment or banking information, employee records, anything covered by a confidentiality agreement. Line three: no customer information in personal accounts, ever, because you have no agreement with that provider and no way to get it back.

Line four: a person reads anything AI wrote before it goes to a customer. Line five: who to ask when they are not sure, by name. That is the whole policy.

Then fix the thing that pushed people to personal accounts in the first place — usually that the business never gave them a proper tool. Under Canadian privacy law the business stays accountable for the customer information it holds, so this is cheaper than finding out the hard way.

My staff are already using AI on their personal accounts with our customer data in it. What is the one-page policy?

Other Questions Owners Are Asking