Briefing
Staff at small offices are already pasting emails, documents and spreadsheets into AI assistants. Most of the time it saves time. Occasionally it means client data, patient details or financial records end up in a service the office never reviewed.
A long policy will not be read. A single page that names approved tools, lists what must never be entered and sets an expectation of human review covers most of the risk. The NIST AI Risk Management Framework is a useful reference for larger efforts, but a small office can start much simpler.
The policy works best paired with technical settings: business accounts for approved tools, data protection options turned on, and consumer accounts discouraged on work devices.
What to do
- List approved AI tools and require business accounts, not personal ones.
- State what never goes in: patient or client identifiers, tax and financial records, passwords and anything under confidentiality obligations.
- Require a person to review AI output before it is sent to clients or used for decisions.
- Explain how to request a new tool and who approves it.
- Review the policy every six months as tools change.
How to verify
- Ask three staff which AI tools they use; compare with the approved list.
- Check that approved tools are on business plans with data protections enabled.
- Confirm the policy is signed or acknowledged by all staff.
Sources
Want help putting this in place? Contact Computer Plus or compare our plans.