Answer
What should a small business do when staff are already using AI?
Find out what for, before writing anything. A policy written without knowing what is happening gets worked around within a fortnight.
Ask what people are using and for what, without consequences attached to the answer. A policy written against assumptions bans the wrong things, misses the real exposure, and drives everything that remains out of sight.
The situation in most small businesses is that adoption has already occurred, informally, through personal accounts, for tasks nobody described. That is not a discipline problem — people found something that helped and used it — and treating it as one produces the worst available outcome, which is the same usage with nobody saying so. The first move is a conversation whose purpose is information rather than enforcement, and the tone of that conversation determines whether it produces anything true.
What you are trying to establish is specific. Which tools, on which accounts, for what tasks, and with what material. The last of those is the one that matters most: a person using an assistant to rephrase an email has done something different from one pasting in a customer contract, and the difference is what has left the business rather than what tool was used. Most of the answers will be benign and one or two usually are not.
The finding that usually emerges is worth anticipating: the useful uses are real and the exposure is narrow. People are drafting, summarising, rewriting and explaining, and the problematic cases are a small number involving customer information, financial detail or something under a confidentiality obligation. That shape makes the policy easy — permit the general, name the specific exclusions — and it is only available if the conversation happened first.
The policy should then be short and about material rather than about tools. What may not be put into any external service, regardless of which one, is a durable rule. A list of approved products is a document that is out of date within months and that people interpret as permission to paste anything into the approved one. The material rule survives the product changing and is the one that actually protects anything.
Providing a sanctioned option is the part that determines compliance. If the business supplies a tool people can use for the work they were already doing, the policy is a routing instruction rather than a prohibition, and prohibitions without alternatives are the ones that get ignored. This does not need to be expensive and it does need to be at least as convenient as what people found themselves.
Finally, the informal usage is a source of information about what to build. People have already identified the tasks where this helps, at their own initiative, without a discovery exercise. Asking what they use it for most is the cheapest opportunity assessment available, and it is grounded in what actually saves time rather than in what somebody thought would.
You are not deciding whether to adopt this; you are deciding whether to know what is already happening.
Siddharth Sharma, Context Theory
Related questions
What if someone has already put something they should not have into a public tool?
Establish what and when, decide whether anyone needs to be told, and change the arrangement so it cannot happen the same way again. Treating it as a disciplinary matter ensures the next occurrence is not reported, which is a worse position than the first one. The information is worth more than the accountability here.
Should personal accounts be banned outright?
For work involving business material, yes, and the ban only holds if there is a supplied alternative. A prohibition on personal accounts with nothing provided produces either non-compliance or a reduction in how well people do their jobs, and in a small business it usually produces the first.
METHOD
Every figure below carries its source and the date it was verified. Nothing on this page is asserted.
The numbers on this page.
| What | Value | Specific to |
|---|---|---|
| Sub-15-minute compliance — automated routing vs manual only | 62.5% vs 39.1% | Category-wide |
| Firms that never responded to a web enquiry at all | 23% | Category-wide |
2026 speed-to-lead benchmark · verified
Oldroyd, McElheran & Elkington, "The Short Life of Online Sales Leads", Harvard Business Review (March 2011) · 1.25M inbound leads across 2,241 US firms · verified
What is specific to this page.
| Kind | Claim | Check it against |
|---|---|---|
| Constraint | Informal adoption through personal accounts is already the prevailing state in most small businesses, and treating it as a discipline problem produces continued usage with nothing reported, which is a worse position than knowing. | Asking staff what tools they use for work tasks, without consequences attached to the answer. |
| Workflow | What matters is which material left the business rather than which tool was used, so establishing the content involved distinguishes a benign use from an exposure in a way a tool inventory cannot. | Classifying reported uses by what material was supplied rather than by which product received it. |
| Procurement | A policy naming prohibited material survives product changes while a list of approved tools is out of date within months and is read as permission to supply anything to the approved product. | Checking whether an existing approved-tools list still matches what is available and in use. |
| Response | Existing informal usage identifies the tasks where these tools genuinely save time, at staff initiative and without a discovery exercise, which makes asking what people use most the cheapest available opportunity assessment. | Comparing the tasks staff report using assistance for against the automation candidate list. |
Each row would be wrong on another industry's page. Where a sourced figure exists it is in the table above instead; these are the constraints that shape the work and do not happen to be numbers.
Start with the measurement.
Reading about a benchmark is not the same as knowing your own number. The audit produces yours, measured rather than estimated.
$497 · delivered in 5 business days · credited against month one