9 Tips for Setting Up AI Rules for Your Staff
Your staff are probably already using AI tools such as ChatGPT, Copilot or Gemini, whether or not you have a policy. That can save real time. It can also leak client information, produce confident mistakes, or create legal headaches. A short, practical set of AI rules lets your team use AI safely.
1. Decide which AI tools are approved
List the tools staff may use for work, and which accounts. Business versions, such as Microsoft 365 Copilot used with work accounts, generally offer stronger privacy commitments and keep your data within your organisation’s controls. Free personal versions may use what you type to improve their products, depending on the provider’s settings and terms.
2. Set clear rules about data
This is the most important rule. Spell out what must never go into a public AI tool:
- Client names and personal information
- Health, financial or legal details
- Passwords, keys and system details
- Confidential contracts, pricing and business plans
If in doubt, staff should remove identifying details or ask first. Australian businesses covered by the Privacy Act must also handle personal information carefully, and that includes what is pasted into AI tools.
3. A human checks everything
AI can be confidently wrong. Anything going to a client, regulator or the public must be checked by a person who understands the subject. Facts, figures, names and legal or technical claims need particular care.
4. Be open about AI use
Decide when your business tells clients that AI helped, for example in reports or advice. Honesty builds trust, and some industries have their own expectations.
5. Respect copyright and ownership
Don’t ask AI to copy other people’s work, and check that images and text you publish don’t reproduce someone else’s material.
6. Watch for bias and fairness
Be careful using AI in decisions about people, such as hiring, performance or customer eligibility. A person should make the final decision and be able to explain it.
7. Keep accounts secure
AI accounts often contain sensitive prompts and files. Use business accounts with MFA, and remove access when staff leave. Our MFA guide explains how.
8. Name someone responsible
Pick one person to answer questions, approve new tools and update the rules. AI changes quickly, so review the policy at least every six months.
9. Train your team, briefly
A 30-minute session covering the approved tools, the data rules and a few good and bad examples is enough to start. Make it easy to ask “is this OK?”.
A one-paragraph AI policy you can start with
“Staff may use [approved tools] with their work accounts to help draft, summarise and research. Never enter client, personal, financial or confidential information into AI tools that are not approved. All AI-assisted work must be checked by a person before it is sent or published. Questions go to [name].”
For more ideas on using AI well, read how to automate daily tasks with AI.
Shadow AI: the tools your team is already using
AI is not just ChatGPT. It is built into browser extensions, writing assistants, design tools and meeting note-takers that join video calls and record everything said. Many of these are installed by individual staff without anyone in the business knowing. Ask your team what they are already using, then add the useful ones to your approved list and remove the rest. Meeting recorders deserve particular care: clients should know when a call is being recorded and transcribed.
Get your data ready before switching on Copilot
Microsoft 365 Copilot can only see what the user signed in can already see. That sounds safe, but in many businesses staff have access to far more than they should, such as old SharePoint sites shared with everyone or Teams files that were never locked down. Copilot makes that information easy to find. Before rolling it out, review who can access sensitive folders, tidy up sharing links and apply sensitivity labels where needed. Our guide to Microsoft 365 Copilot for small business covers this in more detail.
A simple traffic-light guide for staff
- Green (go ahead): drafting general emails, summarising public information, brainstorming ideas, rewording your own writing.
- Amber (approved business tools only): summarising internal documents and meeting notes that contain no personal or client information.
- Red (never in public AI tools): client personal information, health or financial details, passwords, confidential contracts and pricing.
Printing this guide and sharing it in your next team meeting is one of the quickest ways to make your AI policy stick.
Common questions
Do we need an AI policy if we are a very small business?
Yes, but it can be short. Even a three-person business handles client information that should not end up in a public AI tool. The one-paragraph policy above is enough to start, and you can add detail as your use of AI grows.
Is Microsoft Copilot Chat safe for business information?
When staff sign in with their work account, Microsoft says prompts and responses are covered by enterprise data protection and are not used to train its foundation models. That is a big improvement on free personal tools, but your own data rules still apply.
Do we have to tell clients we use AI?
There is no single rule for every business, but if AI tools handle personal information you need to meet your Privacy Act obligations, and your privacy policy may need updating. The Office of the Australian Information Commissioner has published guidance on using commercially available AI products, which is worth a read.
Rolling out Copilot or other AI tools? See our Microsoft 365 services and managed IT security.
Thinking about Copilot or AI tools for your team?
We help Sydney businesses set up Microsoft 365 Copilot and other AI tools securely, with sensible permissions and policies.
Or call 1300 133 770.
