Most small businesses are already using AI, whether the owner planned it or not. Someone on the team pastes an email into a chat tool. Someone asks it to tidy up a quote. It saves time, and it usually goes fine. The trouble starts when nobody has said what’s okay to put in, who owns the account, or who checks the result before it goes out.
You don’t need a long policy. Five rules cover most of it. These are the ones I set up with every client, and why.
1. You own the accounts
Set up every AI tool under a business email address that you control, not an employee’s personal login. If the person who set it up leaves, you still have the chats, the saved instructions, and the billing. It’s the same lesson as with a domain name: ownership matters most when something goes wrong. If you’ve ever tried to get something back from the person who set it up and then left, you already know how that story goes.
2. Turn off training on your data
Whether your conversations help train the AI depends on the plan you’re on. On personal plans it’s usually a setting you can change. ChatGPT’s free and paid personal plans use your chats to improve the model unless you turn off “Improve the model for everyone” under Settings, then Data Controls. Claude’s personal plans have a similar model improvement setting under Privacy.
Business plans work differently. OpenAI says it doesn’t use content from ChatGPT Business, Enterprise or the API for training by default, and Anthropic covers its commercial products under separate terms. Turning a setting off applies to new chats going forward, and the details change, so check the current page for your plan. I’ve listed the pages below.
3. Keep private data out
Some information doesn’t belong in a chat tool at all: card numbers, bank details, Social Security numbers, passwords, and health or legal details about a person. If a task needs real customer information, use a business plan, swap the name for “a customer,” or leave that part to a person.
A good rule of thumb: if you wouldn’t paste it into an email to a stranger, don’t paste it into a chat.
Here’s what that looks like in practice. Say a customer emails a long complaint with their name, address and order details, and you’d like help writing a calm reply. Instead of pasting the whole message, paste it with the personal details removed, ask for a draft, then add the name and details yourself when you send it. You get most of the benefit and none of the exposure.
4. Review before you send
AI drafts. A person decides. It can sound confident and still be wrong about a price, a date or a policy. Anything a customer will read gets read by a human first, and anything with numbers gets checked against the source. The same goes for automations. The safest ones create a draft and wait for your approval instead of sending on their own.
5. Write it down
One page is enough. Which tools your team uses, what stays out of them, who reviews what, and who to ask when something’s unclear. The point is that everyone works the same way, including the next person you hire. Without it, each person makes their own rules, and you find out about the gaps later.
What goes in the one-page guide
- Which AI tools your business uses, and whose account each one is under.
- What never goes in: the list from rule 3, plus anything your industry treats as confidential.
- Who reviews what before it goes to a customer.
- Where your saved instructions and custom assistants live, so they don’t depend on one person’s laptop.
- Who to ask when something’s unclear, and what to do if something goes wrong.
If something goes wrong
Someone pastes something they shouldn’t have. It happens. Don’t panic, and don’t hide it. Delete the chat if the tool lets you, change any password or key that was shared, and write down what was shared and when. If it involved a customer’s personal information, check with your lawyer or insurance about whether you have to tell anyone, because the rules depend on your state and your industry. The sooner someone says “I think I made a mistake,” the easier it is to fix, so make that easy to say.
Questions I hear
Is it okay to use the free version of ChatGPT or Claude for work? For general tasks with no private information, often yes. Once customer details or internal numbers are involved, I’d move to a business plan, or keep that part out, and make sure the training setting is off.
Do I need to tell customers I use AI? There’s no single rule that fits every business, and it can depend on your industry. My habit is simple: a person reads and stands behind everything that goes out, and I’m glad to say so if a customer asks.
Can AI tools read my other files and email? Only if you connect them. When you do, connect only what the task needs, review the access you granted, and remove it when you’re done.
How I handle it
In AI Setup + Training, these rules are part of the setup. I create the accounts in your name, check the data settings on each tool, and write the one-page guide for your team. If you’d rather start with an outside look at how your team uses AI today, an AI Check-up covers that too.
Want a second set of eyes on your setup? Book a free 20-minute call. I’ll tell you what I’d change first.
Sources: OpenAI Help, How your data is used to improve model performance · OpenAI Help, Data controls FAQ · Anthropic Privacy Center, Is my data used for model training? · Anthropic Privacy Center, How do I change my model improvement privacy settings?. Settings and plan terms change often; these reflect each company’s pages in October 2026.
