Everyone on your team uses their own ChatGPT on a personal account. A one-page policy, company accounts and clear rules about data fix the essentials.
On an ordinary Tuesday, someone in sales pastes the customer list with phone numbers into their personal ChatGPT to sort it. Someone in accounting uploads a draft contract to get a summary. Nobody meant any harm and nobody told you. You find out three months later, if you find out.
This guide is for owners and managers of small companies whose team already uses AI without a shared method. You will see why it happens, what a one-page policy should say and how to roll it out this week without slowing anyone down.
Why does your team use AI on its own?
Because it works and nobody offered an alternative. Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 knowledge workers in 31 markets (Colombia among them) fielded between February and March 2024, found that 78% of AI users at work bring their own tools (the report calls it BYOAI). It is a vendor survey and not recent, so read it as a sign of the trend rather than a number for your company. What you do know is what you see in your office: if you offer no accounts and no rules, the team works it out alone.
Banning it rarely solves it. In 2023 Samsung restricted generative AI after, according to a memo reported by Bloomberg, engineers accidentally uploaded internal source code to ChatGPT. A large company can afford to restrict. A small one that bans without offering something instead just pushes the use onto personal phones, where you can no longer see it.
What changes between a personal and a company account?
The terms on your data. According to OpenAI's help center (checked in November 2026), content sent to ChatGPT Business, Enterprise, Edu and the API is not used to train models by default. On personal plans (Free, Plus, Pro) training is on by default and you can turn it off under Settings, Data Controls, the option labeled 'Improve the model for everyone'.
Anthropic frames it similarly. In its commercial products (Team, Enterprise and API) it does not use your inputs and outputs for training by default, unless you report feedback or otherwise allow it. On consumer plans (Free, Pro, Max), chats can be used if you enable model improvement in your settings, and thumbs up or down feedback is stored for up to five years, according to its March 2026 privacy page.
These terms change often. Before deciding, read the current page of the provider you pick and note the date you checked. What does not change is the logic: on a personal account the employee owns the settings and takes them along when they leave; on a company account you administer the settings and the history.
Which data can go in and which cannot?
This is the core of the policy. Three levels are enough for a small company:
- Green, can go into the company account: your own text with no personal data, email drafts, ideas, summaries of public documents, code without secrets, general questions.
- Yellow, company account only, and swap names for codes when the task allows it: quotes, contracts, meeting notes, customer lists without sensitive data. Ask whether the task really needs the name or ID number.
- Red, does not go into any AI tool without an explicit decision from you: health data, employment records, bank accounts, keys, tokens, passwords and any data about minors.
There is a legal reason behind it. Law 1581 of 2012 regulates the processing of personal data in Colombia, and sending customer or employee data to an external tool is processing. On 21 August 2024 the Superintendencia de Industria y Comercio (SIC) issued Circular Externa 002, with guidelines for processing personal data in artificial intelligence systems, which stresses that whoever processes data must be able to show how they protect it (known as demonstrated accountability). This is general information and not legal advice: if your business handles sensitive data, consult a data protection lawyer.
What should a one-page policy contain?
You do not need thirty pages nobody will read. One sheet with these seven points covers the essentials:
- Approved tools. Which ones may be used and with which accounts. Everything else stays out of work.
- Company accounts. Who creates them, who administers them and what happens to them when someone leaves.
- Data levels. The traffic light above, with examples from your own business.
- Responsible people. Who decides a doubtful case. A named person, not 'the department'.
- Human review. Nothing generated by AI goes to a customer, an agency or a contract without a person reading all of it.
- What to do after a mistake. If someone pasted something they should not have, report it immediately and without punishment; hiding it is what does the damage.
- Review date. Tools and their terms change, so review the policy every six months.
How do you roll it out this week?
- Monday: ask the team, without scolding, which AI tools they use and for what tasks. It is the best input for the policy.
- Tuesday: pick one tool and a business plan. Read the current data terms and save the date you read them.
- Wednesday: write the one-page policy with the seven points. Use real examples from your business.
- Thursday: create the company accounts, turn on two-step verification and decide who is the administrator and who is the backup.
- Friday: gather the team for 20 minutes, explain the traffic light with two examples and collect questions. Ask everyone to bring one real case they would not know how to classify.
What are the risks and limits of this approach?
- A policy is not a technical control. It says what is expected but does not stop someone pasting data. For very sensitive information, add permissions and restrictions in the tool itself.
- Use out of your sight. Someone will always use a personal phone. You reduce it by offering a better tool and explaining why, not by surveillance.
- Cost. Business plans charge per user and prices change, so ask the provider for a quote rather than relying on numbers in an article. Start with few users.
- Terms that change. What a provider says today can change. That is why the policy carries a review date.
- Legal scope. The policy helps with compliance but does not make you immune under Law 1581. If you process sensitive data or data on many people, get specialist advice.
If you want help defining the policy, choosing the tool and training your team with examples from your own business, I can help.