The problem
Tuesday, 4 p.m. An employee pastes an angry customer’s email into ChatGPT, with their name, address and invoice details, to help draft a reply. She means well. But that information just went into a personal account, and you do not know where it is or how long it stays there.
Without rules, everyone decides alone. Some never dare to use AI, others use it carelessly. Either way, you lose.
The solution
A short policy says three things: which tools, for what, and what never leaves the business. Add one golden rule: AI drafts, a person reviews before sending. In Québec, it is also a practical way to respect the spirit of Law 25 on personal information.
Tick your tools and data in the generator: the policy writes itself, ready to copy.