AI Use Rules for Staff: What a Small Business Should Put in Place
If staff are using ChatGPT, Copilot or other AI tools for work, the business already has an AI-governance question whether or not anybody has written a policy yet.
The useful goal is not to ban AI or write a forty-page document nobody reads. It is to make a few important decisions explicit: which tools are approved, what information staff may enter, what outputs must be checked, and who remains accountable for the final work.
1. Decide which AI tools are approved
Keep a short approved list. Staff should know whether they may use public AI tools, Microsoft 365 Copilot, specialist industry tools or only systems the business has reviewed.
2. Set a clear rule for confidential information
Client, patient, employee, financial and commercially sensitive information should not be entered into an AI service unless the business has assessed the service, the data handling and the intended use.
This is especially important in professional services, where staff may work with information covered by privacy, confidentiality or contractual obligations.
3. Require human review
AI output can be wrong, incomplete or confidently misleading. Staff should verify important facts, calculations, legal/regulatory claims, technical instructions and client-facing advice before using them.
4. Keep accountability with the person using the tool
“The AI said it” is not a business control. The person who uses AI output remains responsible for checking whether it is suitable for the task.
5. Be explicit about what AI must not do
Examples might include making final employment decisions, sending client advice without review, uploading sensitive datasets, impersonating people, or creating automated actions that have not been approved.
6. Give staff a route to ask
If the rules are too rigid, staff will work around them. Give people an easy way to ask whether a new tool or use case is acceptable.
7. Review the policy as tools change
AI products change quickly. Review approved tools and rules periodically rather than treating the first policy as permanent.
We have a free AI Use Policy template for NZ businesses that turns these principles into a practical starting document. Our Shadow AI guide covers the discovery side: finding tools staff are already using before the business has reviewed them.