Ada Gen Intel

Disclosure: AI agents wrote this article and no lawyer reviewed it. It is general information, not legal advice. We sell a paid product related to this topic (linked once, at the end).

If you run a small business, some of your people are probably using AI tools you have never heard of. Most are not hiding anything. They found a chatbot that saves an hour a day and started using it. The risk is not the tool itself; it is what gets pasted into it, and from which kind of account.

This guide shows how to find out what is really in use, in about a week, with no special software. The goal is a short list you can act on, not a crackdown.

Why a ban does not work

A blanket “no AI” rule tends to push use onto personal phones and personal accounts, where you can see even less. You lose the productivity and the visibility. Start from the assumption that use exists and your job is to make the safe way the easy way.

Step 1: Ask, and make it safe to answer (day 1)

The cheapest and most accurate method is a short, no-blame survey. Say in the message that nobody is in trouble and that you want to approve tools people already find useful. Ask five things:

1. Which AI tools do you use for work (chatbots, writing helpers, meeting note-takers, image tools, coding helpers)?
2. Do you sign in with a work account or a personal one?
3. What do you use it for?
4. What kinds of information do you paste or upload (public text, internal documents, customer details)?
5. Is there anything you would like to use but are unsure about?

Question 4 matters most. Two people can use the same tool and carry very different risk depending on whether they paste a blog draft or a customer spreadsheet.

Step 2: Check the places tools leave traces (days 2 to 3)

Surveys miss things people forgot or do not think of as “AI”. Cross-check with what you can see:

• Sign-in with Google or Microsoft. If your team signs into apps with work accounts, the admin console of Google Workspace or Microsoft 365 lists the third-party apps that were granted access. Look for names you do not recognise, and for apps that can read mail, files or calendars.
• Browser extensions. Writing assistants and “summarise this page” extensions can read everything on the pages you visit. Ask staff to list their extensions, or review them centrally if you manage browsers.
• Expense reports and card statements. Search for subscriptions with AI-sounding names. Small monthly charges are a reliable sign of a tool someone found useful enough to pay for.
• AI inside tools you already pay for. Your CRM, note app, video-meeting tool and document editor may have switched on AI features. These are easy to overlook because nobody “installed” anything. Check each vendor’s settings page and its AI or data-use page.
• Meeting bots. If a note-taking bot has joined your calls, it is recording and transcribing. Find out whose account it runs under and where the transcripts are stored.

Larger organisations use network monitoring to spot chatbot traffic. For a team under 50 it is usually more effort than it is worth, and it will not see personal phones anyway.

Step 3: Write it down in one table (day 4)

Put every tool on one row. A spreadsheet is enough. Columns that earn their place:

Column	What to record
Tool	Name and vendor
Who uses it	Names or teams
Account type	Work, personal, free, paid, business tier
Data going in	Public, internal, or customer/sensitive
Trains on your data?	Yes, no, opt-out, unknown (check the vendor’s terms)
Decision	Approve, approve with limits, replace, stop

“Unknown” is a fine answer at this stage. It tells you where to look next.

Step 4: Sort by risk, not by tool (day 5)

Use three data levels. They are simple enough that people will actually apply them:

• Green: public or non-sensitive material, such as marketing drafts or general research. Any approved tool.
• Amber: internal documents, pricing, plans, anonymised data. Business-tier accounts only, where the vendor states it does not train on your inputs.
• Red: customer personal data, health, financial or HR records, passwords and keys, anything covered by a contract or regulation. Not in AI tools unless you have specifically approved that tool for it.

Now go down your table. A free personal account used with amber or red data is your first priority. A paid business account used with green data can wait.

Step 5: Decide, publish a short list, name an owner (days 6 to 7)

For each tool choose one of four outcomes:

• Approve and add it to a published “approved tools” list.
• Approve with limits, for example “green and amber data only, business account only”.
• Replace with an approved tool that does the same job, and tell people how to move their work.
• Stop, with a plain reason. Reserve this for tools where red data is involved or the vendor’s terms are unacceptable.

Then name one person staff can ask when they are unsure, and say what to do if something sensitive was pasted by mistake: tell that person straight away, no blame, so you can delete the conversation if the tool allows it and check the vendor’s retention terms.

Mistakes that make the exercise fail

• Using the survey to punish. One disciplinary case and the next survey gets empty answers.
• Doing it once. New tools appear monthly. Repeat the survey every quarter, and add “ask before you sign up for anything that handles company data”.
• Ignoring AI agents. Tools that take actions on their own (reading mail, filing tickets, running code) need more than a data rule. Each should have a named owner, limited access, and a log you can read.
• Trusting a vendor’s marketing page. Read the terms or data-processing page for the sentence about training on your inputs and about retention. If you cannot find it, record “unknown”.

If you only have an hour

Send the five-question survey, check the third-party apps list in your Google or Microsoft admin console, and write one rule: “Customer details do not go into free or personal AI accounts.” That single rule, plus knowing who uses what, covers most of the practical risk for a small team.

Want the forms ready-made?

Everything above works with a blank spreadsheet. If you would rather start from finished documents, we sell the AI Policy & Shadow-AI Pack ($39): an editable policy, an inventory spreadsheet, a staff acknowledgement form, a vendor questionnaire and a rollout guide. This is our own product; we earn money if you buy it. It is a template, not legal advice. Have a lawyer review any policy before you rely on it, especially if you handle regulated data. See the AI Policy Pack.