Write The House Rules

Somewhere in your business right now, somebody is pasting a customer's file into a chatbot.

They aren't doing anything shady. They're trying to get a summary done before lunch, the tool is open and free, and nobody ever told them what's fine. So they guessed.

That guess is your AI policy. If you haven't written anything down, it's the only one you've got.

The big organizations are starting to swing hard the other way. Sweden's Government Offices started blocking ChatGPT and Claude on work computers this past week, citing security. Staff get one approved tool, Microsoft Copilot, because it's the only one that passed their security review.

You don't need to go full Sweden. You do need house rules, though. One page, written this afternoon, that your team can follow without a law degree.

Credit where it's due. Somebody looked at the tools, picked one that cleared their bar, and told everybody.

That's most of what a policy does. It answers the question before an employee has to ask it (or, more likely, doesn't ask and guesses).

Where I'd push back is the ban itself. A ministry has an IT department and locked down laptops. You have a shared printer and a team that works from their phones. Ban the tools your people find useful and they won't stop using them. They'll stop telling you.

That's the worst outcome. The customer data still lands somewhere, only now it's in a personal account you can't see or shut off when that person quits.

I've watched this play out a lot.

Bans push usage into the dark. Same habit, now on a personal phone, with less control.

One bad paste is the whole risk. Forget the hundred tiny slips. Worry about the one spreadsheet with client Social Security numbers, or a vendor contract under NDA. And you won't know it happened until it matters.

Clear rules make your team faster. Owners tend to miss this part. When people know what's allowed, they quit pinging you with "is this okay?" and finally use the tool that saves them an hour.

Six sections below. Copy each block into a doc, swap in your details, and you're most of the way home.

Start with which tools, and which kind of account. The account type matters more than the brand name on it.

A business plan usually comes with an admin console, a way to remove someone when they leave, and terms that say your data isn't used to train the model. A personal free account usually comes with none of that. Read the terms on whatever plan you pick and check the training setting yourself.

A small tell for spotting consumer accounts: ChatGPT only shows ads on its Free and Go plans. Plus, Pro and Enterprise are ad free. So if an employee sees ads in their ChatGPT, they're on a consumer plan, and probably not yours.

That last line tells people you're not the department of no.

Admin settings go in this section too. On Claude, admins can now turn off web fetch for the whole organization and set allowed or blocked domains. Notion is adding an AI Command Center where admins can set spending caps and choose which models are allowed. Whenever a tool gives you a switch like that, write down how you set it.

This is the part your team will actually use. Nobody on your front desk needs to understand privacy law. They need a color.

One warning while we're on red data. OpenAI just rolled out locked chats, which hide chats from history, pinned chats and search behind a 4 digit PIN or device authentication, without deleting them. Nice feature. But a hidden chat still sits in the account with whatever got pasted into it. Locking the drawer doesn't change what's in the drawer.

Assistants pick up new abilities every month, so this section carries more weight than it did a year ago.

The better tools are drawing the same lines. Anthropic's Claude Duet asks for approval before it sends a message, makes a payment, signs a document or deletes anything, and some actions like moving money between accounts are off limits even with approval. When the people building the thing put guardrails in those exact spots, take the hint. (If your agents have their own logins, the Oct 12 edition covers that setup.)

When do you tell customers AI was involved? My rule of thumb is whenever a reasonable person would feel tricked if they found out later.

Running AI phone answering through Go High Level? Put the disclosure in the greeting script on day one. If you use Fathom for meeting notes, the "we record our calls" line belongs in your calendar invite.

AI interviewing is spreading fast. Dayforce is acquiring Ribbon AI, an AI voice interviewer with over 1 million completed screening interviews. A candidate who's talking to software deserves to know that before they start talking.

A policy without an owner is a suggestion.

Put it on the calendar today, recurring, or it'll slide to "next month" forever.

Someone will paste something they shouldn't. Plan for it while nobody's panicking.

Step one carries the whole list. Punish the first person who reports a mistake and you'll never hear about the second one.

You don't have to fill the template by hand. Answer eight questions and let the AI write the first draft. Use a company account and keep red data out of your answers (yes, even here).

The draft will be fine, if a little bland. The gap list at the bottom is where I'd spend my time, because that's where it tells you what you forgot.

Quick note: this isn't legal advice. If you're in healthcare, finance, insurance, law or anything else with a regulator watching, run your final version past counsel. One page is a cheap read for a lawyer, which helps.

Picture a 15 person physical therapy clinic. Three PTs, two assistants, a front desk team, a billing person and an owner who's also treating patients.

Right now the front desk uses a free chatbot to write reminder texts. One PT pastes session notes into a personal account to clean up her documentation. Billing asks AI to explain denial codes. Nobody has said a word about any of it.

The owner sits down Sunday afternoon with coffee and runs the eight question prompt. After an hour of editing, the page says this.

Approved tools: One business plan for the whole team, managed by the office manager. The PTs keep using the documentation tool already built into their clinic software, because that's the one their vendor approved for patient data.

Traffic light: Green covers reminder templates, social posts and exercise handouts. Yellow covers schedules with initials only and monthly revenue numbers. Red covers anything from a patient chart, insurance info and anything with a date of birth. Red never goes into the general chatbot.

Never list: No AI sends a message directly to a patient. No AI touches billing submissions.

Disclosure: The website chat says it's an assistant and offers to have the front desk call back.

Owner: The office manager. First Monday, 15 minutes, right after the staff huddle.

And the PT who was pasting notes into her personal account? Nobody wrote her up. Her habit is the reason the documentation rule exists, and she helped write it.

You get one meeting, thirty minutes tops, before eyes glaze over. I'd run it like this.

Open with the why, in one sentence. "I want you using AI more, and I want us to stop guessing about what's safe."

Hand out the page. Paper, or a shared doc on screen. Don't read it aloud to grown adults.

Walk the traffic light with real examples from your business. Pick five things your team does every week and ask the room what color each one is. It takes ten minutes and sticks better than any training video.

Ask what's missing. Someone will name a tool or a task you didn't think of. Add it on the spot.

End with the reporting rule. Say it out loud: nobody gets in trouble for telling me something went wrong.

Skip the quiz, and please skip the slideshow about the dangers of technology.

Every team has one. Usually your best person, since they noticed it saves time.

Don't punish them. Bring it into the light.

Pull them aside. Ask what they use it for and what kind of data has gone in, then mostly listen. After that, move them to a company account on an approved plan like ChatGPT or Claude, so the work lives somewhere you control.

If something red already went into a personal account, follow the incident steps and keep your voice level. Delete what can be deleted, note what happened, and fix the rule.

Then ask that same person to help roll out the policy. They know which shortcuts are worth keeping, and the team will listen to a coworker faster than they'll listen to the boss.

Copy the six template blocks into a doc and fill in your tool names and owner.

Run the eight question prompt on a company account and compare its draft to yours.

Write five real tasks from your business on a sticky note and label each green, yellow or red.

Check which plan every person on your team is actually using. Ads in ChatGPT mean a consumer account.

Book a 30 minute rollout meeting and a recurring 15 minute review on the first Monday of each month.

Have the private conversation with whoever's already using a personal account. Make them your co author.

Jordan

The AI Newsroom | Practical AI for people with a business to run.