Employees may encounter ChatGPT, Microsoft Copilot, Claude, or AI features inside products the business already uses. Before a team enters business information, leadership needs to decide which uses are acceptable and who can answer questions.

Start by asking teams which tools, accounts, tasks, and information they use. Then write a short policy around seven decisions.

1. Which tools and accounts are approved?

Name approved tools and account types for specific work. A personal account and a company-managed account can have different administration and data controls. Keep the list accessible and name the person who can approve an exception.

2. What information is off limits?

Use examples employees recognize: client files, personal information, payroll records, contracts, credentials, confidential strategy, or source code. Apply the rule to prompts, uploads, screenshots, meeting recordings, and connected applications. Check client commitments and applicable privacy requirements when setting these boundaries.

3. Which outputs require human review?

Specify who checks factual claims, calculations, citations, customer commitments, and decisions affecting people. Require a qualified person to review higher-impact work before it is used or sent. AI output can help prepare a draft; the responsible person still owns the result.

4. How are new tools approved?

Give staff a simple request path. The reviewer should ask what the tool does, what data it receives, what the vendor says about retention and model training, where data is processed, how access is removed, and whether the business can meet its client and privacy obligations. Record the decision and any usage limits.

5. Who owns the policy?

Assign an accountable role, such as an operations, IT, or privacy lead. That owner keeps the approved-tool list current, reviews higher-risk requests, and sets a review date. The role can be small, but it should be named.

6. What records are needed?

Keep an inventory of approved tools, owners, purposes, data involved, and review dates. For sensitive uses, retain the vendor review, testing decisions, and human oversight requirements that explain why the use was approved.

7. How do people ask for help or report a mistake?

Name a contact for questions and a route for reporting accidental disclosure or unexpected tool behaviour. Make it easy to raise a concern promptly so the business can assess and contain it.

Put the first version to work

A short first version can cover approved tools, prohibited information, human review, new-tool approval, an owner, a reporting path, and a review date. Walk through it with the team using examples from their actual work. Connect it to existing security, privacy, and records policies.

If sensitive client work or Microsoft 365 Copilot is involved, a policy may need supporting permissions, vendor review, and a broader risk assessment. NorthSecure AI's AI governance services include policy development and readiness work for Canadian organizations.

Note: This is practical business guidance, not legal advice. Requirements depend on the organization, jurisdiction, data, and use.