Most organizations I talk with ask the wrong first question about AI. They ask which tool to buy. The better question is what their people are already doing. In most organizations of 25 to 300 people, staff are using ChatGPT, Claude, Copilot, or Gemini today. Some use a company account. Many use a personal one. Few have been told what is allowed.
A ban does not fix this. When leaders forbid AI, the use does not stop. It moves to personal phones and personal accounts, where no one can see it and no settings protect the organization’s data. The work still gets done with AI, and the risk grows.
A one-page policy is the better place to start. It will not answer every question, and it does not need to. It tells people what they may use, what they must never share, and whom to ask. That is enough to turn hidden use into visible use, and visible use is what makes every later step possible.
What the page covers
A useful first policy has four parts.
The first part names the approved tools. Pick one or two, and say which account to use. “Use the company Copilot account” is a rule people can follow. “Use AI responsibly” is not.
The second part lists the information that never goes into an AI tool without approval. For most organizations, that list includes client or donor records, personnel files, financial account details, passwords, and anything covered by a confidentiality agreement. Engineering firms may add project drawings under contract. Nonprofits may add information about the people they serve.
The third part explains how a new tool gets approved. Someone will find a new AI feature every month. The policy should name the person who reviews it and set a simple standard for saying yes.
The fourth part names a contact. People will have questions, and a name is more useful than a document.
The settings that matter most
Three choices carry most of the risk, and none of them requires an IT department to understand.
Use business accounts instead of personal ones. Business plans from the major vendors give the organization control over accounts and data, and they generally do not use your content to train their models. Personal accounts often have weaker defaults, and the organization loses all control when someone leaves.
Confirm whether your content is used for training. Every major vendor documents this. Read the terms for the plan you use, check the setting, and write the answer down.
Know how long your data is kept. Retention periods vary by vendor and by plan. You should know the answer before a client asks.
Questions to be ready for
Clients, funders, and insurers have started to ask about AI, and their questions are predictable. Do you use AI on our work? Which tools do you use? Does our information leave your control? Who reviews the output before it reaches us? An organization with a one-page policy can answer each question in a sentence. An organization without one will improvise, and improvised answers rarely build confidence.
What to do this month
You can put a first policy in place in about a month.
In the first week, ask staff which AI tools they use and what they use them for. Make it clear that the question is not a trap. You will learn more from an honest survey than from any vendor demonstration.
In the second week, choose the approved tools and set up business accounts with the right settings.
In the third week, write the page. Keep it to one page. Plain language matters more than completeness.
In the fourth week, walk your staff through the policy in a thirty-minute session, and show them how to use the approved tools well. People follow rules they understand, and they understand rules that come with a demonstration.
After that, review the policy every six months. The tools change quickly, and the policy should keep pace.
Where this leads
A one-page policy is where the work starts. Once people use approved tools openly, you can see which tasks AI handles well, where it saves real time, and where it needs closer review. That knowledge prepares you for the next steps, whether they are AI agents, custom workflows, or deeper governance.
I co-chaired an AI taskforce at a professional services firm where confidentiality set a high bar, and this sequence is the one that worked. We made use visible, set simple rules, and then built on them. If you would like help with any part of it, my AI readiness review produces the policy, the approved tool list, and the staff training.