Write the AI rules before the tools spread

Staff will use ChatGPT, Claude, Grok, Copilot, and whatever the next tab is. They will do it to finish a draft, summarize a meeting, or debug a spreadsheet. Telling them to be afraid of AI does not change that. Leaving it unnamed means company data walks into a personal account with no record.

The useful move is narrower. Decide which tools the company will support. Decide what may never be pasted. Put those tools on managed devices where you can see the install and, when needed, limit the browser. Then train people on the line, not on a vibe.

Keep it to one page people will actually read. Name the approved products. Name the data classes that stay out: client files, credentials, health or financial records, unpublished financials, legal holds, anything covered by a customer contract.

Require a company account when the vendor offers one. Personal Gmail into a consumer chatbot is how a draft becomes someone else's training set with no ticket behind it.

Say who owns the output. A first pass from Claude is still the employee's work to check. It is not a source of truth until a person signs off.

Say how to get a new tool approved. If the only path is “ask IT in Slack and wait,” people will skip it. A two-day review with a yes or no is enough for most offices.

Approved tools should live on the company tenant when that exists (Microsoft 365 Copilot is the obvious case) or on a company-paid workspace for Claude, ChatGPT, or Grok. That gives you billing, retention settings, and a place to turn access off when someone leaves.

On endpoints Tailored Tech manages, we can deploy the apps you approve and keep the ones you do not off the default workstation image. Browser control can limit or warn on consumer AI sites when that is the policy. We cannot read every prompt a person types into a personal phone. Be honest about that in the policy so leadership does not think monitoring is magic.

The point is not to replace people with a model. It is to make a capable person faster without handing the customer list to a tool nobody reviewed.

We draft the one-pager with you. We map it to what is already in the Service Catalog: IT policy template work, endpoint management, and the browser and app controls that exist on the plan you buy.

We do not pretend a policy file is a control. The file says the rule. The device and identity stack enforce the parts that can be enforced. The rest is management and training.

If you already have a policy from counsel, we will say what we can actually deploy so the document and the workstations match.