Banning AI at work just hides it. Give your team three rules instead.

Plenty of businesses have dealt with AI by banning it, and felt better for having dealt with it. The reasoning is sound enough: nobody knows where the data goes, so nobody should use it. The difficulty is that a ban only changes what people admit to. If you want to manage AI at work, you need rules people can follow in the open, and I think three is enough to start with.

The ban has already been tried

In spring 2023, engineers at Samsung pasted confidential source code and meeting notes into ChatGPT while trying to get their work done faster. When the company found out, it banned generative AI tools on its devices. It was one of the first big names to do so, and plenty of others followed that year.

It’s a fair reaction to a real leak. But look at what the following year’s research found. Microsoft and LinkedIn surveyed 31,000 people across 31 countries for their 2024 Work Trend Index. Three quarters of knowledge workers said they were using AI at work. Of those, 78% were bringing their own tools, and the figure was slightly higher in smaller companies. A good half said they were reluctant to admit using it for their most important tasks.

So the tools were in use in most workplaces, largely unapproved and largely unmentioned, whatever the policy said. I’ve no reason to think that has gone down since.

Why bans fail

People don’t use these tools to be difficult. They use them because a job that took an hour takes ten minutes. Summarising a long document, drafting a tricky reply, working out a spreadsheet formula, turning notes into minutes. Once someone has felt that difference, telling them to stop is asking them to work more slowly on purpose, while they suspect their competitors aren’t.

And a ban is very hard to enforce. You can block a website on the office network. You can’t block the phone in someone’s pocket, the laptop at home, or the AI assistant that has quietly appeared inside software you already pay for. The email client offers to write the reply. The video call offers to take the notes. The browser offers to summarise the page.

So the work moves somewhere you can’t see it. A personal account on a free plan, on a personal device, with whatever data settings it came with. That’s the worst version of the thing the ban was meant to prevent.

A ban doesn’t stop people using AI. It stops them telling you.

Ashley Adkins, fromIT

What the risk really is

It helps to be specific, because “AI is risky” isn’t something anyone can act on. For most businesses I’d put it in four parts.

Where the data goes. Text pasted into a tool leaves your business and sits on someone else’s servers. On many free and personal plans, conversations can be used to improve the service unless you switch that off. Business plans from the main providers generally commit to keeping your data out of training and give you an administrator’s view of who is using what. That difference between a personal account and a business one is the single most useful thing to understand.

Personal data. If someone pastes in a customer complaint, a CV or a set of payroll figures, your business has shared personal data with another company. Data protection law applies exactly as it would to any other supplier. You’d want a contract in place and you’d want to know about it.

Confidential material. Client documents under a non-disclosure agreement, pricing, tenders, source code, passwords and access keys. This is the Samsung problem.

Wrong answers, confidently given. These tools produce fluent text that is sometimes simply incorrect. If that goes to a customer unchecked, the mistake is yours. So is the awkward conversation.

There’s a fifth that’s growing: AI tools that can act as well as write. Assistants connected to your mailbox, your files or your calendar can be very useful, and they can also see everything that account can see. I’d treat connecting one the same way as giving a new member of staff access. Deliberately, and with someone deciding how much.

Three rules instead

A workable AI policy for most businesses fits on one page. These are the three rules I’d build it around.

1. Use the tools we’ve approved, signed in with your work account. Pick one or two, on a business plan, and say so by name. If your business already pays for Microsoft 365 or Google Workspace, there may be an assistant included or available that keeps data inside your existing agreement. Make the approved route the easy one and most people will take it.
2. Know what never goes in. Passwords and access keys, ever. Personal data about customers or staff, and anything a client has given you in confidence, unless it’s an approved tool and you’ve agreed that use. If in doubt, take the names out or ask.
3. You’re responsible for what comes out. Read it, check the facts and figures, and put your own name to it. If AI did a significant part of something going to a customer, be willing to say so if they ask.

That’s all. It can be read in a minute and remembered without looking it up, which is the test I’d apply to any policy.

Making it stick

The rules are the easy part. A few things decide whether they hold.

• Ask what people already use. Before you announce anything, ask the team, and make it clear nobody is in trouble. You’ll learn which tools are popular and which jobs they help with. That tells you what to approve.
• Name a person to ask. “Can I use this for that?” needs a quick answer from someone. If the answer takes a fortnight, people stop asking.
• Check the settings on what you approve. Training on your data off, history and sharing set sensibly, sign-in through the work account with multi-factor authentication.
• Look at what’s built in. Meeting note-takers, browser extensions and assistants inside other software all count. Decide which are switched on.
• Revisit it every few months. The tools change quickly. A policy written last year will already have gaps.

If your customers send you security questionnaires, expect questions about this. “Do you have a policy on the use of AI tools?” is turning up more and more often, and “we banned it” is a weaker answer than a short policy your team has read and signed. My guide to answering a customer security questionnaire covers how to handle those.

Treat people like adults

Underneath this is a view about how security works in general. Rules that ignore how people do their jobs get worked around, and then you’ve lost sight of what’s happening. Rules that give people a safe, sensible way to do what they were going to do anyway tend to be followed.

Your team is going to use AI. Most of them already are. You can have that happen where you can see it, on tools you’ve chosen, with three rules everyone knows. Or you can have a ban on paper and no idea what’s being pasted where. I know which of those I’d rather explain to a customer.