What Rules Should Staff and Freelancers Follow When Using AI?

The rules that matter day to day

1. 1Use approved tools only — and know where the approved list lives. Anything else needs a quick request, not a quiet workaround.
2. 2Use business accounts, not personal ones. Account ownership determines who controls the data, the settings and the history when someone leaves.
3. 3Know the prohibited information: customer data, employee matters, passwords and secrets, financial details, contracts and anything covered by the confidential-information guide. When in doubt, use placeholders.
4. 4Check output before it is used. Every AI answer is a draft; anything factual, customer-facing or consequential gets verified against real sources.
5. 5Watch for bias — especially in anything touching people: recruitment shortlists, performance wording, customer segmentation.
6. 6Customer communication drafted with AI is read in full by a human before sending. No exceptions for busy days — that is when the errors ship.
7. 7Verify sources: if the AI cites something, open it. If it cannot be opened, it does not exist for business purposes.
8. 8Human approval is named: work that leaves the business has an accountable person, and it is never “the tool”.
9. 9Keep light records for significant uses — which tool, roughly what went in, who checked the output.
10. 10Report mistakes the same day, without blame. A wrongly pasted document or an error sent to a customer gets smaller when reported early and bigger when hidden.

Shadow AI

Shadow AI — tools in use that the business does not know about — is the most common governance gap. It thrives where the approved route is slow or where asking feels risky. The fix is cultural as much as procedural: make requesting a tool fast, say yes where you reasonably can, and treat discovery of an unapproved tool as a prompt to assess it rather than solely as a disciplinary matter. An amnesty (“tell us what you're using, no consequences, this month”) often surfaces more truth than any audit.

Consequences, fairly framed

Staff should understand that these rules connect to existing obligations — confidentiality clauses, data-protection duties and customer contracts — and that serious or repeated breaches can have disciplinary or contractual implications. Framing matters: the aim is protecting customers, colleagues and the business, not catching people out. Any formal disciplinary wording belongs in employment documentation reviewed by a professional, not in an operational rules page.

Freelancers and contractors

• Apply the same information rules: your confidential and customer data does not change character because a contractor is handling it.
• Say so in the engagement: whether AI use is acceptable on your work, with which tools, and whether it must be disclosed.
• Ask how deliverables were produced where provenance matters — copyright and originality questions flow through to you.
• Do not accept 'my own AI stack' as an answer for confidential work without knowing what that stack does with data.

Offboarding

When staff or freelancers leave: remove their access to business AI accounts, transfer ownership of any chats, projects or custom assistants that the business needs, and check that no business data sits in personal accounts. AI tools belong on the leaver checklist alongside email and file access.