If you haven't rolled out an AI tool, your staff have done it for you. Somebody in the business is summarising emails in ChatGPT, drafting proposals with Gemini, or tidying up a spreadsheet with whatever the browser extension suggested. They're not doing it to be difficult, they're doing it because it's quicker, it's free, and nobody told them not to.
This guide is about getting from "we don't know what's being used" to "we know, we've picked something, and people have been told what's allowed", without spending six months on it.
Short version
- Assume it's already happening. The question is how much and with what data.
- You can see most of it in logs you already have. Firewall, Defender, Entra sign-ins and browser extension reports will tell you which tools are in use.
- Banning it outright pushes people onto their phones. Give them a sanctioned tool instead, then block the rest.
- The data risk is the real one. Free consumer AI tools may use what you paste to train the model, business tiers generally don't. Check the terms, not the marketing.
- Write a one-page acceptable use policy that says what can go in, what can't, and who to ask. Nobody reads a ten-page one.
How do we find out what's in use?
Start with what you've already got. Your firewall or web filter will show traffic to the main AI domains (OpenAI, Anthropic, Google Gemini, Perplexity and so on). If you run Microsoft 365, the Entra sign-in logs show people signing in to third-party apps with their work account, and Defender for Cloud Apps, if you're licensed for it, gives you a discovered apps list with a risk score against each. Browser extension inventories from Intune or your endpoint tool catch the AI writing assistants that sit inside Outlook and Word.
Then ask. A short, non-accusatory survey ("which AI tools do you use for work, and what for?") usually turns up more than the logs, because people will admit to things on a form that they'd never think to mention otherwise. Make it clear nobody's in trouble. You want the information, and the quickest way to stop getting it is to punish the first honest answer.
When I did this at my firm, the discovered apps report in Defender for Cloud Apps told the story in about ten minutes. The top user was me, and the next was another member of the IT team... Beyond that it was scattered use across the business with a handful of people using AI tools heavily, and a long tail of people who'd tried something once. We ended up writing a policy that named the sanctioned apps and set out what kind of data could and couldn't go into them, which is the shape I'd recommend starting with.
Why not just block it?
Because it doesn't work, and because it makes things worse. Block ChatGPT on the corporate network and people use it on their phone, on their home laptop, or through a tool you haven't heard of yet. The data still leaves the building, you've just lost the ability to see it go.
The other problem is that the demand is real. If someone can turn a two-hour task into twenty minutes, telling them they can't is a hard sell, and an organisation that bans AI outright will quietly lose that argument within a year. The job is to channel the demand, not stop it.
The approach that works is: pick one or two tools you're happy with, make them easy to get to, tell people what they can and can't put in them, and then block the rest. In that order. Blocking first and providing later just gives you a few weeks of workarounds you then have to unpick.
What's the actual risk?
Mostly it's where the data goes and what happens to it there.
Free consumer tiers of the big AI tools have, at various points, used what you type to improve the model unless you opt out, and the opt-out isn't always obvious. Business and enterprise tiers generally commit not to train on your data, and Microsoft Copilot used with a work sign-in comes with commercial data protection as standard. The rules change, so check the current terms for whichever tool you're looking at rather than taking a blog post's word for it (including this one).
What counts as sensitive depends on your business, but it's usually obvious once you list it. Customer and client data, anything commercially confidential: pricing, contracts, bids, board papers. Personal data about staff, source code. In my case working in a law firm, it's client correspondence and anything privileged, which is why I take this seriously, but every business has its equivalent. None of it should be going into a tool where you don't know how it's stored, who can see it, or whether it's training something. It's a question a customer, an auditor or an assessor might ask you, and "we didn't know people were doing it" isn't an answer.
The second risk is quality. People paste in a document, get a confident summary and act on it without checking. That's a training problem more than a technology one, but it belongs in the same conversation.
What does a usable policy look like?
Short. If it runs to more than a page, it won't be read, and if it isn't read you don't have a policy, you have a document.
The useful ones cover four things - which tools are approved, what can be put into them, and the short list of what can't (customer-identifiable information, commercially confidential material, personal data about staff, passwords and credentials, etc). The fact that output has to be checked by a human before it's relied on, and who to ask when something isn't covered, because something always isn't.
Review it when the tooling changes, not on an annual cycle. A policy written for ChatGPT in 2024 says nothing useful about Copilot agents in 2026.
If you want a framework to hang it on, ISO 42001 is the AI management standard and it's worth knowing about, even if you never certify. Most organisations don't need the certificate anyway, they need the first few steps: know where AI is used, decide who owns it, and write down the rules.
What about giving them a proper tool?
That's the other half of the answer, and it's the bit that makes the policy stick. If you provide a tool that's covered by the right terms, signed in with a work account and visible in your logs, most people will use it because it's there and it's allowed.
For Microsoft shops that usually means Copilot Chat with a work sign-in as the baseline (included in most business licences) with the paid Microsoft 365 Copilot licence for the people who'll actually use it in Word and Outlook. Others land on ChatGPT Team or Enterprise, or Claude for Work. The choice matters less than the fact that you've made one. What you're buying is the contractual position and the visibility, not the model.
If you want a technical control on top, a secure web gateway or Secure Service Edge product can allow the sanctioned tool and block or warn on the others at the browser level, which is a lot more granular than a firewall rule.
If you only do three things
Pull the firewall and Entra logs for the last 30 days and see what's in use. Write the one-page policy and send it with a sanctioned tool attached, not instead of one. Then block the rest, and tell people you've done it and why.