Although easy to access and use, free AI tools often come with significant privacy and security risks that most users aren’t aware of.

When employees enter business information into an unapproved AI platform, you may lose visibility into:

• Where that data is stored
• Who can access it
• Whether it is used to train future AI models
• Whether it meets regulatory requirements in your industry

Many free AI tools are funded by collecting, using, sharing, and selling entered data, including client details, internal communications, proprietary information, or other confidential business content. A policy should treat unapproved AI tools as a potential data security concern and require employees to use only approved solutions when working with company information.

AI agents are AI tools that can do more than answer questions or generate content. They can take a goal from a user, determine the steps needed, and sometimes take actions inside other systems. Some agents are simple assistants that only suggest next steps, while others can act more independently across business applications.

Because AI agents vary widely, they should be reviewed and addressed independently as they are not all the same. Low-risk agents that only summarize, draft or recommend actions may generally be allowed when used in approved tools and reviewed by an employee. Agents that can access company data, connect to business systems, or take actions on behalf of a user should be restricted until they are reviewed and approved by leadership and IT.

Fully autonomous agents should not be broadly allowed unless clear controls are in place, including approved use cases, limited permissions, human approval, monitoring, and a designated employee responsible for the output.

A practical policy should address five key areas - approved use cases, prohibited activities, data protection requirements, human oversight, and approved tools.

• Define how employees can use AI for legitimate business purposes. Examples include drafting documents, brainstorming, summarizing information, creating presentations, or supporting technical work.
• Clearly identify actions that are not allowed. Examples include entering confidential information into unapproved systems or using AI to create deceptive content.
• Specify what information can and cannot be entered into AI tools and establish security expectations.
• Require employees to review and validate AI outputs before using them. AI should support employee work, not replace employee responsibility.
• Maintain a list of approved AI solutions and require IT approval before adopting new AI tools.

For most small and mid-sized businesses, the process is straightforward:

1. Assess how employees are currently using AI.
2. Identify what types of company data require protection.
3. Determine which AI tools are approved.
4. Define acceptable and prohibited uses.
5. Establish review and accountability requirements.
6. Communicate expectations to employees.
7. Review and update the policy regularly as AI evolves.

The most effective policies are short, practical, and easy for employees to understand.

Yes, we can assist our clients in creating a policy, but it should still be owned and finalized by your organization.  Macatawa Technologies can help by providing a template, answering technical questions, sharing guidelines and recommendations, and helping you think through approved AI tools, data security concerns, and practical implementation steps.

Because an AI acceptable use policy is an internal policy, we recommend that you also involve the appropriate people within your organization, such as leadership, HR, legal, and compliance. Those teams should review and approve the final policy, so it reflects your company’s culture, employment practices, regulatory obligations, and risk tolerance.

You certainly can choose not to implement one, but that decision doesn't stop AI usage, and it will increase risk to your organization.

Now that you have a policy in place, your organization is in a great position to start taking advantage of what AI can do. Our recommended tools for businesses ready to adopt AI are Microsoft Copilot and Hatz. These are two industry leading tools that give your team the ability to work smarter by automating routine tasks and providing insights faster while keeping your data contained and confidential. A business subscription to either platform, guided by the right expertise, can meaningfully change the way your organization operates.

To learn more about secure AI solutions, visit our AI Resources for Businesses page.