Your employees are already using ChatGPT for company work. They paste in customer emails, quotes, fragments of contracts and invoice data. The question isn't "whether" — it's "on how many private accounts" and "what next". An AI usage policy for an SME doesn't need to be thirty pages — one sheet your team won't put down after the first paragraph is enough.
In recent months we've had a few conversations that started with "we want to roll out AI". And then it turned out AI had already been rolled out — just that nobody knew. The employees who were supposed to be supported had supported themselves. From private browsers, private Google accounts, private ChatGPT Plus subscriptions. With the best of intentions. And with company data.
This is not an article about how you should "ban AI" or "adopt a compliance framework". It's about how, in three hours, you can produce something grown adults will actually respect.
What's already happening before you even start
Typical scene in a Polish SME. A salesperson gets a customer enquiry — six paragraphs in German. They paste it into ChatGPT.com and ask for a translation and summary. The bookkeeper gets a PDF with an oddly formatted invoice — drops it into a free "PDF to Excel" service nobody has heard of. The in-house lawyer asks AI to "simplify this NDA clause". The board assistant asks for the CEO's email to be rewritten "so it sounds firmer".
Every one of those actions is reasonable. Every one saves people time. And every one sends company data into a system your company never authorised, on an account you have no access to, under terms nobody read.
At one of our clients — an 18-person law firm in a mid-sized city — a short audit of usage showed that eleven out of eighteen people regularly used ChatGPT.com on private accounts for professional work. On average, for four months. The pasted content included fragments of client contracts, demand letters and one full legal opinion. Nobody intended harm. It just worked.
The three risks that actually matter for an SME
Online "AI compliance" checklists can run to sixty bullet points. For a 25-person company that's absurd. In practice there are three risks you actually have to address.
Customer data leakage. Anything your employees paste into a consumer AI chat can (depending on provider and plan) be used to train models, end up in logs accessible to provider staff, or be exposed in any breach on the provider's side. Under GDPR your company is the data controller — regardless of whether the employee used a corporate or private account.
Hallucinations dropped into a document going to the customer. The model produces a plausible-sounding answer, the employee copies it, the customer reads it. A paragraph number that doesn't exist. A quotation from a standard that doesn't exist. A deadline that's a week off. That's not an "AI error" — it's your company's error, with your stamp on it.
Breach of customer contracts. A growing share of Polish B2B contracts now include clauses like "data processed within the EU only", "no sub-processing outside the approved list" or "no use of AI without written consent". A single paragraph pasted into ChatGPT.com can mean breaking a contract the employee never saw.
The other risks (copyright on the output, IP exposure, bias in hiring) exist too. But if you control those three, you've covered 90% of what actually blows up.
The one-page policy
A policy your team won't read doesn't exist. Goal: one A4 page, in bullets, in the language people actually speak. Here's the skeleton that works for our clients.
- What is allowed. Name the specific tools the company has approved (e.g. ChatGPT Business / Team on a company account, Microsoft 365 Copilot, a local model for summaries). Everything else is, by default, not.
- What is forbidden. Pasting into public AI chats: customers' personal data, contract text, quotes, invoices, customer email content, source code, internal financial documents. A short list, in plain language.
- When a human verifies the AI. Every output that leaves the building (email to a customer, quote, opinion, calculation) must be read by a human. No exceptions. Numbers — checked against the source.
- Who to raise concerns with. One person in the company (typically whoever owns IT or compliance). Email, Teams channel, whatever — as long as everyone knows the address.
- What happens if someone slips up. First incident — a conversation and training. Repeated — employment consequences. No witch hunts, but no pretending nothing happened either.
That's it. One page. Employee signature on the contract or an addendum to the work regulations. Short training for the team — 45 minutes, every six months.
Choosing the tool — consumer vs business
Second step after writing the policy: give employees a tool they can use legally. Because if you ban consumer ChatGPT and offer nothing in return, the policy becomes fiction in three weeks.
The difference between a consumer plan and a business plan is real. On ChatGPT Team / Enterprise, Microsoft 365 Copilot for Business, Claude for Work — data is not used for model training by default, retention can be set to zero, the provider has a signed DPA aligned with GDPR. That's not marketing, it's a contractual difference.
At the law firm above, we did the following. Tool audit: 2 hours. One-page policy: 3 hours of work with the team's lawyer. Migration to ChatGPT Team for 18 people plus Microsoft 365 Copilot for the 6 office staff: total cost roughly 2,700 PLN net per month. Team training: 90 minutes. End to end — from decision to live — in 10 working days. Six months later, private ChatGPT.com accounts in use at work dropped from 11 people to zero, and the internal audit found no new incidents.
The price you pay — a few thousand zloty a month. The price you avoid — a conversation with a customer about why a fragment of their contract appeared in someone else's chat window.
What next
If your company has no AI policy, you probably don't need an "AI strategy" consultant. You need half a day, someone who has done this before, and a decision about which board member won't be woken up on Sunday by an angry customer.
If you'd like, we can walk you through it together: an audit of the team's current habits, a one-page policy, a tool plan, and short training. The first conversation is free and runs for half an hour.
An AI usage policy isn't a legal document. It's an agreement between you and your team that we know what we don't paste into the open internet.