Staff should use AI only through an approved business account, such as your company's Copilot, ChatGPT Business, Claude Team or Gemini in Google Workspace plan. Public and internal material is fine for approved tasks. Client, personal and financial information needs a named approver's sign-off first. Passwords, access keys and anything a contract forbids never go in.
Put that on a one-page summary for staff. Sections 1 to 3 of the outline below are the minimum. The one-page template further down covers them and adds one line each from sections 4, 6 and 7. Fill in the rest of sections 4 to 7 before you connect AI to email or shared files. The outline is a starting point for your own policy. It isn't legal advice, and adopting it doesn't on its own make you compliant with privacy law.
Sort the information first
A public job posting and an employee's performance review need different rules. So do a blank proposal template and a signed client contract. What goes into the tool matters more than which tool it is, so use examples from the work your staff actually do.
| Information | Suggested starting rule | Example |
|---|---|---|
| Public material your company has approved | Use an approved account for an approved task. Check the result before you share it. | Summarize the services on your website. |
| Internal material with no personal or client details | Fine in an approved business account for an approved task. Never in a personal or free account. | Turn a blank meeting agenda into a preparation checklist. |
| Personal, client or commercially sensitive information | Use it only for a task your named approver has signed off in writing. Ask before any exception. | Client contracts, payroll, health information or unpublished financials. |
| Passwords, access keys or anything a contract rules out | Never put it in a prompt or upload. Raise any task that seems to need it. | Login details, or a client's restricted files. |
Your approver can sign off a recurring use in advance by naming the account, the information and the task. Staff only need to ask again when a use falls outside that. Company approval never overrides the law or a client's restrictions.
Removing a name doesn't always hide who someone is. A short client list, a job title or an unusual transaction can still point to one person. For practice, use made-up material.
A policy outline to adapt
Fill in each decision before you share the policy. Staff shouldn't have to guess what “approved AI” means.
1. Approved accounts and tasks
List the exact products and plans, and how staff sign in with their company account. Name the person who approves a new tool, connection or task. A personal paid subscription doesn't count as company approval.
2. Information staff may use
List the information allowed for each task, with examples. Say what needs approval and what must never go in. The same rules apply to pasted text, uploaded files, meeting recordings and connected folders.
3. Who checks the result
Name who checks facts, numbers, tone and client promises before anything is used. For example, a project manager checks a draft client update against the project notes before it goes out. For decisions that affect a person, name who makes the decision and how someone can challenge a mistake.
4. Sending and changing things
Say whether the tool may only prepare drafts, or may also send, update or delete. Name who approves each of those. Reading a folder and changing what's in it are separate permissions.
5. Storage and deletion
Say where approved results are saved, how long records are kept and who handles requests to delete them. Ask IT what your plan keeps. Turning off model training doesn't delete a chat.
6. Mistakes and questions
Give staff one named contact and one way to report a problem. If restricted information goes in by mistake, staff stop the task and report the tool, the information and the time. Then follow your incident process. Staff shouldn't try to delete it themselves or carry on with the conversation.
7. Ownership and updates
Put the policy owner's name, the approval date and what triggers the next review on the page. A new connection, changed vendor terms or a new kind of client information are all good reasons to review it.
A one-page starting template
This sample is built only from the rules above. Fill in the blanks and adapt it with your own advisers. Treat it as a starting template. It isn't legal advice.
| // Template: policy line | Fill in |
|---|---|
| Approved tools | ________ (business plan, company login only) |
| Who approves a new tool, connection or task | ________ |
| Fine for approved tasks | Public material, and internal material with no personal or client details |
| Needs written sign-off first | Client, personal and financial information. Signed off by: ________ |
| Never goes in | Passwords, access keys, or anything a client contract rules out |
| Who checks results before they’re used or sent | ________ |
| What the tool may do | Prepare drafts only / also send or change things, approved by ________ |
| If restricted information goes in by mistake | Stop, and tell ________ the tool, the information and the time |
| Policy owner | ________. Approved on: ________. Next review: ________ |
What Canadian law adds
In December 2023, Canada's federal, provincial and territorial privacy commissioners published principles for generative AI. They say existing privacy laws already apply to organizations that use these tools. The principles cover your authority to use personal information, appropriate purposes, safeguards, accuracy and accountability.
Which law applies depends on your organization and what you do. Start with the federal privacy regulator's business guidance on PIPEDA, the federal law. Some provinces have their own private-sector privacy law, such as BC's Personal Information Protection Act (see the BC privacy commissioner's guidance) and Quebec's.
Quebec. Law 25 updated Quebec's private-sector privacy law. According to the Commission d'accès à l'information du Québec (in French), a business must tell a person when it makes a decision about them based only on automated processing of their personal information, and let them ask a staff member to review it. It must also assess privacy risks before it sends personal information outside Quebec, which matters when an AI vendor processes data elsewhere.
Ontario. Two Employment Standards Act rules apply to employers with 25 or more employees. Since January 1, 2026, a publicly advertised job posting must say so if the employer uses AI to screen, assess or select applicants. Employers must also have a written policy on electronic monitoring that says whether and how they monitor employees. If your AI tool's admin settings let you review what staff do, check that the monitoring policy covers it.
Get privacy or legal advice when a use raises an open question about consent, a client contract, sensitive information or decisions about people.
Test it on three tasks
Try the draft on three everyday tasks. Can staff tell whether they may upload a client file, summarize a meeting and send the email that comes out of it? If the answer takes a debate, improve the example or name who decides.
The AI confidentiality checklist helps you prepare those questions. If you haven't picked the tasks yet, the free AI Opportunity Map shows where AI could fit.
Sidekick writes a staff AI-use policy as part of Solo for Execs, and policy and staff training are part of Fractional AI Leadership. To talk it through, bring one recurring task and the policy question it raises. A description is enough.
Sources checked October 12 and 16, 2026.
