Staff paste contracts and customer lists into chat tools and I have no idea
We sort data into three tiers: public, internal, restricted. For each tier we state which tools are allowed and what must never be entered.
An AI usage policy your team will actually read
Your people are already using ChatGPT and similar tools. We write short rules for employees and contractors: which data stays out of AI tools, which tools are approved, and who is responsible. It is the foundation for safely adding AI agents, a CRM or automation later.
Quote and schedule after your brief
Who it's for
- Companies where staff already use AI tools with no rules
- Owners who outsource work and worry about data leaks
- Businesses preparing to roll out AI agents or an AI-enabled CRM
- Companies whose clients ask for a written AI policy in procurement or security reviews
Problems we solve
Freelancers and agencies use AI for copy and code, and I don't know who owns it or whether it's safe
We draft a contractor addendum: whether AI is allowed, what must be disclosed, who checks the output, and who holds the rights to the deliverables.
Policies from the internet run 15 pages and nobody reads them
We write a 2–4 page policy and a one-page cheat sheet, with examples from your own departments.
It's unclear which AI tools are acceptable
We build an approved-tools list with conditions: plan tier, privacy settings, who has access. It is easy to update when tools change.
What's included
- Short interview with managers: which AI tools are used and for what
- Data classification: public, internal, never-in-AI
- List of approved and banned tools with privacy settings
- Main policy document for employees (2–4 pages)
- One-page cheat sheet with do/don't examples
- Contractor and freelancer addendum for your contracts
- Output review rules: who reads text or code before it ships
- Incident steps: who to tell and what to do in the first hours after a leak
- Live team walkthrough, 30–40 minutes online
- Editable files in your Google Docs or Notion, owned by you
Choose the scope
Use a package to describe what you need. We agree on the quote and schedule after reviewing your brief and requirements.
01
Core policy
Small businesses where AI is used without rules
- Manager interview
- 2–3 page policy
- One-page cheat sheet
- Approved tools list
02
Policy + contractors
Companies that work with freelancers, agencies and outside developers
- Everything in Core
- Data classification tiers
- Contractor addendum
- Output review rules
- Incident steps
03
Policy + training
Companies preparing AI agent rollouts or answering client security questionnaires
- Everything in Policy + contractors
- Client-facing summary version
- Online team training (up to 90 minutes)
- 10-question staff quiz
- Six-month review plan
How we work
Brief and requirements
You describe the task and current workflow. We clarify requirements, choose a first stage and prepare a quote.
Interview
We agree on the schedule after clarifying scope and dependencies. We find where AI is already used and where the risk is highest.
Draft
We write the policy and cheat sheet. You get an editable version and comment directly in the document.
Revisions and legal review
We apply your edits. If needed, your lawyer reviews the text. We do not replace legal counsel.
Launch
We run a short walkthrough for your team and hand over all files and access. Payment is in stages.
Scope and limits
- We do not give legal advice. The policy is a working document, not a legal opinion. GDPR or other legal compliance needs your lawyer.
- We do not guarantee nobody will break the rules. We reduce risk, but we do not monitor your people.
- We do not set up technical controls (DLP, tool blocking). That is separate work we can quote separately.
FAQ
Why do we need a policy if we're a small company?
Small teams often carry more risk: everyone picks their own tools and nobody knows what data goes where. One page of rules covers the basics. That is why the core package is built for small businesses.
Can't we just download a template?
You can, but it won't reflect your tools, your data or your contractors. Templates tend to be long and generic. We start from how your team actually works.
What do you need from us?
We agree on the schedule after clarifying scope and dependencies. If you have no list, we build one together during the interview.
Will this satisfy EU or US clients?
The training package includes a client-facing summary that shows you have rules in place. Compliance with GDPR, the EU AI Act or US state laws is a legal question for your lawyer, not something we certify.
How often should the policy be updated?
About every six months, because tools and their terms change fast. The largest package includes a review plan. We can also review the policy for a separate fee when you add new tools.
How does this connect to your other services?
Websites, customer acquisition and automation all handle data: contacts, leads, messages. The policy defines what an AI agent or CRM may process. Clear rules make automation safer to launch.
Start with your task
Describe your business, the outcome you need and your current workflow. We will clarify the requirements and prepare a quote after your brief.