A Zapier survey of 1,005 US workers at companies with 500 or more employees, reported in September 2026, found that 89% had entered company data into AI tools. 79% had entered especially sensitive information, such as HR records, logins, API keys or customer and employee personal details. Half said they had ignored their workplace’s AI rules.
These were large employers, and many of them clearly had AI rules, since half the workers admitted to ignoring them. A smaller business with no written rules at all should assume the same habits already exist in its own office, mostly among people who are simply trying to get work done faster.
Why banning AI does not work.
The same survey found that 26% of workers had used personal devices to reach AI tools their employer restricted, and 24% had used workarounds to get past blockers. A ban does not stop the use. It moves it to personal accounts and phones, where you cannot see it, cannot set how long data is kept and cannot get the data back.
Training made a visible difference. Among workers who felt confident about what was safe to share, 82% had received formal AI training. Among those who were unsure, only 46% had. People follow rules they understand.
A 30-day plan for a small team.
Find out what is already in use
Ask the team, without blame, which AI tools they use and for what. Then check which AI apps are signed in with company accounts and which have been given access to email, files or calendars.
Choose approved tools on business accounts
Pick one or two tools and use business plans that let you manage users, control how long data is kept and keep your data out of model training. Find where the provider says that in writing, and keep a copy.
Draw three red lines
Never paste passwords, API keys or sign-in codes. Never paste customer or employee personal information, such as Social Security numbers, health or financial details, unless the tool is approved for it. Never put client confidential documents into a personal account.
Train with real examples in 20 minutes
Show what is fine, like drafting a generic email or summarizing a public article, and what is not, like pasting a customer list. Use your own day-to-day work so the rules feel practical, not abstract.
Make the safe path the easy one
Sign people into the approved tool with their work account, put it in their bookmarks and share a few ready-made prompts for common tasks. Risky use often starts because the approved option was harder to reach.
Review it every month
Look for new AI apps, new permissions given to existing ones and questions from staff. Update the approved list and the examples as the tools change.
A one-page AI rule anyone can follow.
You do not need a long policy. You need a short page that every employee has read, that names the approved tools and the red lines, and that tells people who to ask when something new comes along.
The tools people may use, the accounts they must use them with and what each one is for.
The kinds of information that never go into AI, written in plain words with examples.
You can see which AI apps are connected to company accounts and what they can reach.
One person approves new tools and updates the page when something changes.
Questions that reveal the real condition.
- Which AI tools are signed in with our company accounts today?
- Which AI apps have been given access to our email, files or calendars?
- Do our approved tools keep our data out of model training, and where is that written?
- Would we know if someone pasted a password or a customer list into an AI tool?
- Who reviews a new AI tool before our staff start using it?
The practical takeawayThe goal is not less AI. It is AI your business can see, approve and explain.