Your staff are already using ChatGPT and tools like it, whether or not you have a policy. The realistic choice is not use versus no use, it is managed use versus hidden use. Governing everyday AI use well makes your team more productive and keeps you out of trouble, and it does not require banning anything.
Here is how to do it.
Why banning backfires
A ban does not stop the use. It moves it into personal accounts and devices you cannot see, where sensitive data can end up pasted into tools you have no agreement with, and where you have no record if something goes wrong. You lose the visibility and keep all the risk. Managed use is both safer and more honest.
The three things that matter
A clear boundary. One short acceptable use position that says what is fine, what is not, and, above all, what data must never go into a tool that is not approved for it. That single data rule prevents most of the real harm.
Approved tools. A short list of tools people can use freely, ideally business accounts where your data is not used to train models and you have the right terms. Give people a good sanctioned option and they will use it instead of a personal login.
A human check on anything that matters. AI output is a fast first draft, not the final word. Where an output feeds a decision about a person, a customer or money, a person checks it. Say so plainly.
The practical setup
Provide business accounts for the main tools, so use runs through channels you control. Write the one-page boundary and share it so everyone knows the rules. Name someone to own AI decisions and answer the grey-area questions. And do a light check on the higher-risk uses rather than policing everything. That is enough to turn shadow use into managed use without slowing anyone down.
What good looks like
People use approved tools confidently for drafting, research and routine work; sensitive data stays out of anything unapproved; risky outputs get a human check; and you could answer, in a sentence, how you manage staff AI use if a customer or auditor asked. That is a defensible position reached with light-touch effort.
Where ScaleAround fits
Our free AI Governance Starter Kit gives you the acceptable use policy and register to set this up quickly, and our AI governance advisory helps where you want more depth or you are in a regulated sector.
Our founder, Oliver Smith, established and ran an AI and machine learning function in regulated financial services and facilitates sessions at the CDO Financial Services Exchange on the data challenges specific to machine learning. He is a Fellow of the British Computer Society. Our engagements are led by senior practitioners with at least 15 years of relevant experience.
Frequently asked questions
Should we ban staff from using ChatGPT? No. Banning pushes use into personal accounts you cannot see, keeping the risk and losing the visibility. Manage the use instead.
What is the single most important rule? The data line: what must never be entered into a tool that is not approved for it, such as personal, customer or commercially sensitive data.
How do we let people use AI safely? Provide approved business accounts, a one-page boundary, a named owner for decisions, and a human check on outputs that feed real decisions.
Do business AI accounts really matter? Yes. Proper business terms usually keep your data out of model training and give you the agreements a personal login does not.
How much effort is this? Light. A one-page policy, a short approved-tools list and a named owner cover most of it.
Want staff using AI safely rather than in the shadows? Our free AI Governance Starter Kit sets it up, and our AI governance advisory helps where you need more. Book a 30-minute scoping call to talk it through.