Can your staff use ChatGPT at work? A simple AI policy for a small business

Yes, if you write the rules down first. Name the AI tools and plans staff may use, on accounts the business owns. List what never goes in, such as passwords, card numbers, employee files and patient details. Name the person who checks AI text before a customer sees it. Then train everyone on that one page.

Are your staff already using AI without rules?

Often, yes. In a 2026 Ipsos poll for the U.S. Chamber of Commerce Foundation, 19% of the employers polled said AI adoption at their business is mostly employee-driven (Chamber Foundation, July 2026).

In public Reddit and Facebook posts by owners and staff that we read in October 2026, nobody described a written AI policy. The risky uses were casual. An HVAC owner in a public Facebook group for HVAC business owners suggested running recordings of every in-home sales visit through ChatGPT for coaching. A med spa worker who held back over HIPAA wrote: "Been wanting to use ChatGPT to help speed up my patient consultation process" (Reddit r/MedSpa, February 2026). Pushback came from peers, not from a written rule.

What goes in a one-page AI policy?

Copy this list and fill in the brackets.

1. Approved tools. Staff use only [tool and plan], on work accounts the business owns, with two-step login on. No personal AI accounts for work.
2. What stays out. Passwords, card and bank numbers, Social Security numbers, employee files and NDA documents. Patient details go only into tools covered by a signed business associate agreement (BAA).
3. Who checks. [Name] reads every AI draft before a customer, patient or inspector sees it, and checks each name, date, price and code reference.
4. Who owns the accounts. [Name] is the admin and removes access on an employee's last day.
5. People decisions. A person makes every hiring, firing, discipline and pay decision. No interview tool uses facial recognition without the applicant's signed waiver.
6. Recording. No tool records or scores calls, visits or staff until staff are told in writing and the law's consent rules are met.
7. Training. Everyone reads this page and practices with [name] before getting an account. We review it every six months.

The SBA tells owners, "Try not to feed any sensitive data or proprietary information," and "Make sure a person assesses all the messages and outreach campaigns that AI generates" (SBA, October 2026).

Part of rule 5 is Maryland law: an employer may not use facial recognition to create a "facial template" in a job interview unless the applicant signs a waiver (Md. Code, Lab. & Empl. § 3-717). It's the only DC, Maryland or Virginia law on AI at work that we found when we checked in October 2026.

Ask a lawyer or HR adviser to read your final version. This is general information, not legal advice.

Is ChatGPT safe for company data?

It depends on the plan and on what staff paste in. OpenAI says it "won't train on your workspace's data" on ChatGPT Business (OpenAI, October 2026). Anthropic says it doesn't train on Claude Team chats by default (Anthropic). On personal plans such as ChatGPT Plus, OpenAI "may use conversations to improve model performance and safety" unless the user opts out (OpenAI).

ChatGPT Business admins "can view, access, export, and delete end user conversations" (OpenAI), and a Claude Team customer "may access and export" its users' data (Anthropic). Say so in your policy. Our first-week guide to ChatGPT and Claude covers setup.

Can you record calls or monitor staff with AI?

Check the law and tell staff first. Maryland allows a recording "where all of the parties to the communication have given prior consent" (Md. Code, Cts. & Jud. Proc. § 10-402). Our AI receptionist guide covers DC and Virginia.

Warning about a vendor's new AI call monitoring, a worker on Reddit's r/HVAC wrote: "This is being sold to your owner as a way to increase profits" (Reddit r/HVAC, June 2026). In a public Facebook group for HVAC business owners, an HVAC employee said they quit rather than use a required AI recording app. Tell staff what any such tool records, who hears it and how long you keep it.

What changes for medical practices and med spas?

Patient information needs a BAA. HHS counts a "Third-party vendor Artificial Intelligence (AI) chatbot" that handles patient information as a business associate (HHS, October 2026), and a HIPAA-covered practice needs a BAA with each one. OpenAI says "we don't offer a BAA for ChatGPT Business" (OpenAI), and Anthropic says Team plans "can't enable HIPAA" (Anthropic).

A made-up example: a family practice in Rockville, in Montgomery County, uses a business AI plan for job posts and the patient newsletter. Its policy keeps patient names, birth dates, photos and chart notes out of that tool. Clinical notes stay in software covered by a signed BAA. The practice manager reads every newsletter before it goes out.

A cash-only med spa may not be covered by HIPAA, but clients still share health details and photos. Keep those out of personal AI accounts.

What changes for trade contractors?

Your policy needs rules for employee files and NDA documents, such as owner drawings. Our guide to AI for trade office paperwork lists what to keep out.

Kenny Electric, a Colorado and Wyoming electrical contractor with more than 300 professionals, went further. In a customer story by Wyecliff, which built it, Kenny's contract and spec review tool uses Anthropic's Claude and "runs on their own isolated infrastructure, so their documents and data never leave their environment." The team accepts or rejects each suggestion (Wyecliff, October 2026).

To keep one paperwork job out of chat tools entirely, our Office Automation service builds a small tool on software you already own.

How do you train staff to use AI?

• Draft with AI, then get an expert check. Ted and Tami Taylor run three restaurants in New Mexico. Ted asked ChatGPT to draft a staff social media policy for their handbook. A professional HR firm later reviewed the handbook and left that section unchanged, says a report by OpenAI, which makes ChatGPT (OpenAI, September 2026).
• Take a course. PayPal and Anthropic offer a free AI Fluency for Small Businesses course (PayPal, May 2026). One lesson has you draft a one-page policy: what you use AI for, what stays human, and how you stay accountable (Claude Academy, October 2026).
• Ask your SBDC. The Maryland SBDC offers one-on-one AI advising at no cost, including help to "vet tools for cost and data safety" (Maryland SBDC).
• Practice on real work. Give each person one real task and check the result together.

Frequently asked questions

Does a team of five need an AI policy?

Yes, but it can be short. A small team still handles customer data and sends quotes. One page naming the approved tool, the data that stays out, the checker and the account owner covers the basics.

What if someone pastes private data into an AI tool?

Tell the account admin the same day. Delete the chat, note what was shared, and check what your plan's terms say about deleted chats. If it was patient information, tell whoever handles HIPAA for your practice right away.