Is It Safe to Use ChatGPT and Other AI Tools at a Small Business?

Many employees already use AI tools at work, with or without permission. Ignoring that does not make it safer. A few practical decisions make a big difference.

Summary: safe AI use at a glance

Step	What to do	Why it matters
Approve tools	Pick business plans with admin controls	Data-handling terms can differ from consumer plans
Set data rules	Public / internal / never	Keeps sensitive data out of the wrong tools
Check output	Human review of facts and anything external	AI can be confidently wrong
Fix permissions	Clean up file sharing before connecting AI	AI tools surface whatever users can access
Review apps	Remove unneeded AI apps and extensions	Some request broad access to mail and files
Write a policy	One or two pages, reviewed yearly	Staff know what is allowed
Train staff	Short session with real examples	Rules only work if people know them

What are the real risks?

• Data exposure. Information submitted to an AI tool may be retained or processed under the provider’s terms. Some consumer services allow submitted content to be used to improve models unless the user changes the applicable settings. Business plans may provide stronger contractual protections, but staff still need to follow approved data-handling rules. Review the provider’s data-handling terms before submitting confidential information.
• Wrong answers. AI tools can produce confident, plausible text that is false, including made-up facts and citations. This is often called hallucination.
• Oversharing inside the company. Tools connected to your files, such as Microsoft 365 Copilot, can surface documents to anyone who technically has access, including files that were shared too widely.
• Unvetted tools. Free browser extensions and AI apps may request broad access to email or files.
• Compliance. Patient, financial or client data may be covered by HIPAA, contracts or other rules.

Use business accounts, not personal ones

Consumer and business versions of the same tool can differ in model-training defaults, data retention, administrative controls, contractual protections and compliance options. Business offerings, including ChatGPT Business and Enterprise, Microsoft 365 Copilot, and Gemini for Google Workspace, provide data protections that differ from those of consumer services. OpenAI states that business data is not used to train its models by default, and Google states that qualifying Workspace customers’ data is not used to train generative AI models without permission. Review the specific plan’s terms, available administrative controls and retention settings before approving it. Read the current terms for the plan you choose, because they change. For example, OpenAI describes its business data commitments on its enterprise privacy page, and Microsoft describes how Copilot handles organizational data in Data, privacy and security for Microsoft 365 Copilot.

Providing approved business accounts also gives staff a safe option, which makes it far less likely that they will use personal accounts for work.

Decide what data can and cannot go in

A simple three-level rule is easy for staff to remember:

• Fine to use: public information, general questions, drafting from scratch, rewording your own non-confidential text.
• Approved tools only: internal documents, customer correspondence without sensitive details.
• Never: passwords, patient health information, Social Security numbers, bank or card details, and any information protected by a contract or confidentiality obligation. These must not be entered into an AI tool unless the tool and use case have been explicitly approved and the applicable contractual, security and privacy requirements are met.

Check the output

Treat AI output as a first draft from a fast but unreliable assistant:

• Verify facts, numbers, legal or medical statements and citations against original sources.
• Have a person review anything that goes to a customer or is published.
• Do not let AI make final decisions about hiring, credit or similar matters without human review.

Clean up access before connecting AI to your files

If you plan to use Microsoft 365 Copilot or a similar tool, review SharePoint, OneDrive and Teams permissions first. Microsoft 365 Copilot respects existing Microsoft 365 permissions. If a document is accessible to a broad group, users in that group may be able to retrieve information from it through Copilot. Review sharing permissions and access controls before deployment. Our Microsoft 365 Copilot readiness checklist covers the steps.

Write a short AI use policy

A written AI use policy should cover approved tools, permitted data, output review, access controls, accountability and escalation procedures. Keep it proportionate to the business’s size, industry, risks and legal obligations. Our guide on writing an AI use policy includes an outline you can adapt.

Review the tools staff already use

Before you write rules, find out what is already in use. Ask staff which AI tools, browser extensions and apps they use for work, and check which third-party apps have been granted access to your Microsoft 365 or Google Workspace accounts. In Microsoft 365, administrators can review and restrict which apps users are allowed to consent to. Remove anything that is not needed or that asks for more access than its purpose requires.

Train staff in plain terms

Start with a short training session covering approved tools, data-handling rules, output verification and escalation procedures. Provide additional training when the tools, risks or permitted uses change. Use real examples from your own work, such as drafting a customer email without including account details. Repeat the basics when you add a new tool, and make it easy for staff to ask before they paste something in.

Comparing common options

Tool type	Examples	Typical fit	Watch for
Consumer chat apps	Personal ChatGPT, Gemini or Claude accounts	Personal use and approved non-confidential tasks	Training, retention and privacy controls vary by provider, account type and settings; centralized business administration may be limited.
Business chat plans	ChatGPT Business or Enterprise, Claude for Work	Drafting and analysis across a team	Requires plan management and clear data rules
Built into your productivity suite	Microsoft 365 Copilot, Gemini for Google Workspace	Businesses wanting AI inside email, documents and Teams	File permissions must be cleaned up first
AI features in industry software	Practice management, accounting or CRM add-ons	Task-specific help inside tools you already use	Check the vendor’s data terms and agreements

A framework if you want one

The National Institute of Standards and Technology (NIST) publishes the voluntary AI Risk Management Framework (AI RMF), which helps organizations identify, assess and manage AI risks. Its four functions are Govern, Map, Measure and Manage. NIST is updating the original AI RMF 1.0, so check the current guidance when using the framework. A small business does not need to adopt it formally, but the four functions are a useful way to organize your thinking: decide who is responsible, know where AI is used, check how well it works, and act on problems.

Examples of safe and unsafe use

• Safe: “Draft a friendly email reminding customers our office is closed for the holiday.” No sensitive data, and a person reviews it before sending.
• Safe with approved tools: “Summarize this internal meeting transcript into action items,” in a business plan covered by your policy.
• Unsafe: Pasting a client’s tax return into a free chatbot to ask a question about it.
• Unsafe: Publishing an AI-written article with statistics no one checked.
• Unsafe: Installing a free AI email assistant extension that asks for full access to your mailbox.

What to ask your IT provider or AI vendor

• Is our business data used to train the vendor’s models, and can we turn that off?
• Where is data stored, and for how long?
• Can we manage users and turn off access when someone leaves?
• Will the vendor sign the agreements our industry requires, such as a BAA?
• What do users see when they ask the tool about files, and are our permissions clean?
• Can we see logs of how the tool is being used?

A step-by-step rollout for a small business

1. Ask what is in use. A short staff survey and a review of connected apps shows where AI is already part of the work.
2. Pick one approved tool for general use, on a business plan, and turn on the admin settings that limit data sharing.
3. Write the one-page policy with the three data levels and the review rule.
4. Clean up permissions in SharePoint, OneDrive and Teams if the tool will read company files.
5. Run a pilot with a few staff for a month. Note where it saves time and where it gets things wrong.
6. Train everyone using the examples from the pilot.
7. Review every six months. Tools, terms and prices change quickly, so put a date on the calendar to check that your choices still make sense.

This approach keeps the first step small. You can add more tools, or connect AI to more systems, once the basics are working and staff are comfortable with the rules.

Where AI helps most

AI tools can assist with drafting emails and proposals, summarizing documents and meetings, answering routine internal questions, and preparing initial report drafts. Measure the results in your own workflows, and verify accuracy and quality before relying on the output. The goal is to free your staff for the work that needs judgment.

How Cambium Data can help

Cambium Data has been serving Omaha businesses since 2009, helping them evaluate and implement new technology. We can help you choose AI tools, set them up with the right protections, write a policy and train your staff. Learn more about our AI consulting and integration services, contact us, or call (402) 514-3200.

Sources

• NIST, AI Risk Management Framework
• OpenAI, Enterprise privacy
• Microsoft Learn, Data, privacy and security for Microsoft 365 Copilot

Frequently asked questions

Does ChatGPT keep what I type?

Data retention and model-training practices depend on the provider, account type and settings. OpenAI, for example, states that content from personal ChatGPT accounts may be used to improve models unless the user opts out, while ChatGPT Business and Enterprise data is excluded from training by default. Check the current policy for the specific service you use.

Can we use AI with patient or client data?

Only when the specific AI service, features and configuration are approved for the intended use and meet applicable legal and contractual requirements. For electronic protected health information (ePHI) handled by a cloud service provider on behalf of a HIPAA-covered entity or business associate, a business associate agreement (BAA) is generally required. A BAA alone does not make a use case HIPAA-compliant; verify that the relevant service and features are covered and that your organization meets its own HIPAA obligations. If these requirements have not been confirmed, do not submit patient information. Our HIPAA IT checklist covers the broader safeguards.

Should we just block AI tools?

Rather than relying solely on blocking AI tools, assess which tools employees are using and consider approving suitable tools with defined data-handling rules, access controls and oversight.

TU

Tony Underwood

Founder, Cambium Data

Tony founded Cambium Data in 2009 and still leads the team. A Navy veteran with more than three decades in IT, he helps Omaha businesses run secure, dependable technology and put AI to practical use.

LinkedInsite.tonyunderwood.us