Someone finds an AI tool that can summarize a document in seconds. Before long, proposals, meeting notes, and customer information are being pasted into it. The employee may be trying to solve a perfectly reasonable problem. The company still needs to know where that information is going and what the tool is allowed to do with it.
A useful AI policy should make approved work easier, not pretend people will never try a new tool. Start with the task, the information involved, and the account or service being used. A personal account and a managed business service can have different terms and controls. Do not assume the word “AI” tells you how either handles your data.
Decide what belongs in the tool
Identify information that needs extra care, such as credentials, personnel records, confidential customer documents, and commercially sensitive plans. Then define permitted uses and who can approve an exception. Removing a name may not remove enough context to make a document safe to share.
Review the actual service terms and settings for retention, access, model training, deletion, and connected data. Product names and paid subscriptions alone do not settle those questions. Your contractual obligations may matter too. Ask the relevant provider or adviser when the answer is unclear rather than letting an employee guess.
Look beyond the chat box
An AI application may connect to email, file storage, or other business systems. That can be useful, but it expands what the application can reach. Review permissions before connecting it. Give it the access required for the approved task and consider who can authorize actions, retrieve data, or share an output.
- Maintain a short list of approved tools and suitable business accounts.
- Explain which information may be entered and which needs approval.
- Review connectors, sharing settings, and administrator controls.
- Provide a route for reporting an accidental upload without blame.
- Revisit the arrangement when the provider, features, or use case changes.
Keep a person responsible for the result
A fluent answer can be wrong. A generated summary can omit a condition that changes the meaning of a contract or a technical instruction. Decide what needs checking before an output reaches a customer, affects a decision, or changes a system. Where consequences matter, use someone qualified to review the substance, not just the grammar.
NIST’s Generative AI Profile discusses risks including unreliable output, privacy, information security, and the way people rely on AI. Those concerns are broader than blocking a website. RIKR’s practical recommendation is to connect the approved use to a review process that someone can actually follow.
Source: NIST AI 600-1, Generative AI Profile
Make room for useful experimentation
You do not have to choose between sending everything to a new service and banning every experiment. A small trial using suitable test data can help you understand the benefit and the controls needed. Record what worked, what did not, and what would need to change before wider use.
RIKR can help put the technology questions in context: identities, device access, cloud administration, and the information a new application can reach. The objective is to help people use a useful tool with a clearer understanding of the tradeoffs.
Related: questions to ask before buying business software
Explore RIKR managed IT support
Written by Joshua Price
Back to the blog