Does My Company Need an AI Policy?

AI Risks in Business Environments

Artificial intelligence has quickly moved from being an interesting new technology to something employees are using every day.

ChatGPT, Microsoft Copilot, Google Gemini and other AI tools can help staff draft emails, summarise documents, analyse information, write reports, generate ideas and automate repetitive tasks.

For businesses, that can mean significant productivity improvements.

However, there is another side to the story.

What happens when an employee copies a confidential customer email into ChatGPT? What about uploading a spreadsheet containing personal information to an AI tool? Can employees use AI-generated information in reports without checking whether it is accurate?

These are exactly the situations an AI policy should address.

So, Does Your Company Actually Need an AI Policy?

For most organisations, the answer is yes.

That does not necessarily mean producing a 30-page legal document.

A good AI policy can be relatively simple. Its purpose is to establish clear rules around:

  • Which AI tools employees are allowed to use
  • What information can and cannot be entered into AI systems
  • When AI-generated content needs to be reviewed
  • How personal and confidential information should be handled
  • Who is responsible for approving new AI tools
  • What employees should do if something goes wrong

Without those rules, employees will often make those decisions themselves.

And in many businesses, staff are already using AI whether management has officially approved it or not.

The Problem With “Shadow AI”

You may already be familiar with the term “Shadow IT”, where employees use applications or services that have not been approved by the organisation.

The same issue is now appearing with AI.

An employee might create a personal ChatGPT account because it helps them write emails. Someone in finance might upload a spreadsheet to an AI assistant to analyse it. A member of HR might use AI to help summarise CVs.

The intention may be completely innocent.

The problem is that the business may have no visibility over:

  • What information is being uploaded
  • Where that information is being processed
  • Whether conversations are being retained
  • Whether the service has appropriate security controls
  • Whether customer or employee information is being exposed
  • Whether the AI-generated answer is correct

Banning AI entirely rarely solves the problem either.

If employees find AI genuinely useful, there is a good chance some will continue using it regardless. A better approach is normally to provide approved tools and establish clear boundaries around how they can be used.

Confidential Data Is One of the Biggest Risks

One of the most important parts of an AI policy should explain what employees must never enter into public or unapproved AI services.

This could include:

  • Customer information
  • Personal data
  • Passwords or authentication details
  • API keys
  • Financial information
  • Contracts
  • Internal company documents
  • Intellectual property
  • Source code
  • Security configurations
  • Information covered by an NDA

The risk is easy to underestimate because interacting with an AI assistant feels similar to having a private conversation.

From a security perspective, however, information entered into an external AI platform is being shared with another service provider.

Your organisation therefore needs to understand how that provider stores, processes and protects the information.

A Realistic Malicious Scenario: Prompt Injection and Data Leakage

The risks are not limited to an employee deliberately pasting sensitive information into an AI chatbot.

Imagine a company uses an AI assistant that can read internal documents, emails or files to help staff answer questions more quickly.

An attacker sends a carefully crafted document or email containing hidden instructions designed to manipulate the AI system.

Those instructions could attempt to tell the AI to ignore its normal rules, search connected data sources for confidential information and include that information in its response.

This type of attack is known as prompt injection.

A malicious instruction could attempt to make an AI system:

  • Reveal confidential company information
  • Extract data from internal documents
  • Expose customer information
  • Retrieve information from connected systems
  • Ignore security or privacy instructions
  • Perform actions the user did not intend

This becomes particularly dangerous when AI tools are connected to email, SharePoint, cloud storage, internal documentation or other business systems.

For example, an employee might ask an AI assistant to summarise a document received from an external party. Hidden inside that document could be instructions telling the AI to search for sensitive information in connected files and include it in the output.

The employee may never see the malicious instruction at all.

This highlights an important point:

AI systems should never be trusted with unrestricted access to sensitive business data simply because they appear convenient to use.

Access controls, data classification, approved integrations and human oversight still matter.

Data Protection Rules Still Apply to AI

Using artificial intelligence does not remove an organisation’s existing responsibilities around data protection.

The Information Commissioner’s Office provides specific guidance covering AI systems that process personal data, including the need to consider data protection principles, accountability and the risks posed to individuals.

Organisations also need to consider data protection from the beginning of a processing activity rather than trying to address it afterwards.

This becomes particularly important when AI is being used with:

  • Employee information
  • Customer records
  • Health information
  • Recruitment data
  • Financial information
  • Other personally identifiable information

Depending on how AI is being introduced into the organisation, additional assessments such as a Data Protection Impact Assessment may also be appropriate.

AI Can Be Wrong, Very Convincingly

Another reason businesses need an AI policy is accuracy.

Generative AI systems can produce incorrect information while presenting it confidently.

This is sometimes referred to as an AI “hallucination”.

For example, an AI assistant could:

  • Invent a statistic
  • Provide outdated technical guidance
  • Misinterpret a contract
  • Generate incorrect calculations
  • Reference a document that does not exist
  • Produce insecure computer code

That does not make AI useless.

It simply means employees need to understand that AI-generated information should not automatically be treated as fact.

A sensible policy should require appropriate human review, particularly where the output could affect customers, finances, legal decisions, security or other important business processes.

What Should an AI Policy Include?

An effective AI policy does not need to make using AI difficult.

In fact, one of its goals should be to make it easier for employees to understand what they are allowed to do.

At a minimum, businesses should consider covering the following areas.

1. Approved AI Services

Define which platforms employees are permitted to use.

For example, your organisation might allow Microsoft Copilot through managed company accounts while restricting the use of personal AI accounts for business information.

2. Data Classification

Clearly explain what information employees can enter into AI systems.

Staff should know that sensitive, confidential or personal information must not be entered into unapproved services.

3. Human Review

AI-generated content should be checked before it is relied upon.

The level of review should reflect the risk.

Using AI to improve the wording of an internal email is very different from using AI to provide legal, financial, HR or cyber security advice.

4. Account Security

Employees should use company-managed accounts where possible.

Normal security controls should still apply, including strong authentication, MFA, appropriate permissions and account monitoring.

5. Approved Business Uses

Your policy can also provide examples of acceptable AI usage.

These might include:

  • Drafting non-sensitive emails
  • Summarising approved documents
  • Brainstorming ideas
  • Creating meeting agendas
  • Improving writing
  • Generating first drafts of internal documents
  • Assisting with approved software development tasks

Giving employees examples makes policies much easier to follow.

6. Prohibited Uses

Employees should also understand where AI should not be used.

Examples could include:

  • Uploading confidential customer information to public AI services
  • Entering passwords or credentials
  • Making automated decisions about employees without appropriate oversight
  • Creating misleading or deceptive content
  • Using unverified AI output as professional advice
  • Installing unapproved AI applications or browser extensions

7. Prompt Injection and Untrusted Content

Employees should understand that AI-generated responses can be manipulated by malicious content.

If an AI assistant is connected to email, files or other business systems, content from external sources should be treated as untrusted.

Organisations should consider limiting what AI systems can access and avoid giving them more permissions than they need.

8. Incident Reporting

Mistakes will happen.

If an employee accidentally uploads confidential information into an AI platform, or suspects that an AI system has exposed or accessed information it should not have, they should know who to contact.

Early reporting gives your IT, security or data protection team a much better chance of assessing and limiting the impact.

AI Policies Should Not Just Say “Don’t Use AI”

The most effective policies balance security with productivity.

Artificial intelligence can provide genuine benefits to businesses when it is introduced properly.

The goal should therefore be:

Use AI, but use it safely.

Businesses should provide employees with approved tools, appropriate training and straightforward rules.

This is increasingly becoming part of normal cyber security governance.

Your AI Policy Will Need to Evolve

AI is developing extremely quickly.

The tools businesses use today may look very different in 12 months.

New AI functionality is also being introduced directly into software businesses already use, including productivity platforms, browsers, CRM systems and security products.

An AI policy therefore should not be written once and forgotten.

Organisations should periodically review:

  • Which AI platforms employees are using
  • New AI features introduced into existing software
  • Changes to data protection guidance
  • AI-related security incidents
  • Changes to supplier terms and data handling
  • New risks and attack techniques
  • New AI integrations and connected data sources

Where Should You Start?

If your organisation does not currently have an AI policy, you do not need to solve everything immediately.

Start by answering three questions:

What AI tools are our employees currently using?

What company or customer information could employees be entering into them?

Which AI tools do we actually want to approve for business use?

It is also worth asking a fourth question:

What systems and data can those AI tools access on behalf of our users?

From there, you can establish sensible controls and provide employees with guidance.

The worst approach is simply assuming nobody is using AI.

They probably are.

Need Help Managing AI Securely?

AI can provide businesses with significant productivity benefits, but it needs to be introduced with the same care as any other technology that processes company or customer information.

At SA1 Solutions, we help organisations secure their Microsoft 365 environments, protect their users and devices, manage cyber security risks and implement practical security controls.

If your organisation is introducing Microsoft Copilot, ChatGPT or other AI services and you are unsure how to manage the security risks, we can help you understand your current environment and put appropriate safeguards in place.

Speak to SA1 Solutions about securely introducing AI into your business.