In plain English: Most SMEs have no AI policy at all, so staff quietly paste client data and source code into public chatbots. One page, five rules and a 30-minute rollout fixes most of it — copy the template below.
In April 2023, three separate engineers at Samsung's semiconductor division pasted sensitive internal material into ChatGPT within the space of a few weeks — including source code for a fault-detection tool and a recording of an internal meeting someone wanted turned into minutes. Samsung had briefly lifted an earlier ban on the chatbot on 11 March. Three leaks later, in May, it banned generative AI tools from company laptops, tablets and phones outright, after first capping prompts to 1,024 bytes as an emergency patch (TechRadar).
Nobody at Samsung did anything malicious. An engineer with a buggy fault-detection script wanted a faster way to debug it, so they pasted the code into the nearest helpful chatbot. That's the whole story. No hacker, no disgruntled staffer — just someone trying to get their job done five minutes faster, on a platform that had quietly become part of everyone's workflow before anyone upstairs had decided whether that was allowed.
That's the bit worth sitting with: it wasn't a security failure. It was a policy that didn't exist until after the damage was done.
It's already happening at your company too
You don't need to be Samsung-sized for this to be your problem right now, today, before you've finished reading this sentence.
Microsoft and LinkedIn's 2024 Work Trend Index — a survey of 31,000 workers across 31 countries — found that 75% of knowledge workers already use AI at work, and 78% of those users bring their own tools rather than ones the company issued or approved. Microsoft's own term for it is "BYOAI": bring your own AI. Sixty percent of the leaders surveyed admitted their organisation has no plan at all for rolling AI out deliberately (Microsoft).
Cisco's 2024 Data Privacy Benchmark Study, based on more than 2,600 security professionals across 12 countries, puts a number on what that looks like in practice: 48% admit they've entered non-public company information into a generative AI tool, and 45% have done the same with employee data. Only 27% of organisations had banned GenAI use even temporarily; 63% had set some limit on what data staff could enter, and 61% had limited which tools staff could use at all (Cisco).
Put the two studies together and the picture is blunt: three in four of your people are already using AI tools, most of them picked the tools themselves, and roughly half have already pasted something they shouldn't have into one of them. Not because they're careless. Because nobody told them where the line was.
| What the research found | Figure |
|---|---|
| Knowledge workers already using AI at work | 75% (Microsoft/LinkedIn, 31,000 respondents) |
| AI users bringing their own tools, unapproved | 78% (Microsoft/LinkedIn) |
| Leaders with no plan to roll out AI deliberately | 60% (Microsoft/LinkedIn) |
| Staff who've entered non-public company data into GenAI | 48% (Cisco, 2,600 respondents) |
| Staff who've entered employee data into GenAI | 45% (Cisco) |
| Organisations with any limit on which tools staff can use | 61% (Cisco) |
Why "we'll sort it out eventually" is the expensive option
The usual reason a 40-person company has no AI policy isn't a considered decision against one. It's that writing policy feels like a six-week legal project nobody has the afternoon for, so it slides to "later" indefinitely while the actual usage doesn't wait for permission.
The cost of that delay isn't evenly spread. Catch "someone's pasting client contracts into a free chatbot" in month one, and it's a five-minute conversation and a rule added to a page. Catch it after a client asks why their unreleased pricing sheet showed up word-for-word in a competitor's chatbot-assisted proposal — a plausible way these leaks surface, not a documented case — and it's a client relationship, a lawyer's letter and a very uncomfortable board meeting. Same mistake, wildly different bill, purely a function of how long it sat unaddressed. (Illustrative scenario, not a real client case.)
A written policy doesn't stop every mistake. What it does is turn an invisible grey area — "is this even against the rules?" — into a visible, enforceable one. That's worth doing even if, like most SMEs, you've never had an incident. Especially if you've never had an incident, because that usually means nobody's looked closely enough to have found one yet.
The one-page policy, copy and go
Keep it to a single page. A 40-page AI governance framework is the kind of thing that gets written once, PDF'd, and never read by anyone who actually uses ChatGPT at their desk. Five rules, one page, pinned somewhere people will actually see it, beats that every time.
1. Name the approved tools. List the AI tools staff are allowed to use for work (e.g. "Microsoft Copilot under our business licence", "Claude via the paid team workspace"). Free, personal-account chatbots are where the Cisco and Samsung incidents happened — a business-tier account usually comes with a contractual promise that your inputs aren't used to train the public model.
2. Say exactly what never goes in. Not "be careful" — a concrete list: client names and contracts, unreleased pricing, source code, anything with a customer's personal data, anything under an NDA, and financial figures before they're public. If a sentence would embarrass you read aloud in a client meeting, it doesn't go into a chatbot either.
3. Name one person who approves new tools. Someone your team can message in under a minute when they find a tool that looks useful, rather than just trying it because no one said no. A named owner beats a committee of twelve just as it does in any project — see why software projects fail for the same pattern playing out at Senate-hearing scale.
4. Write down what happens if the rule gets broken. Not a punishment — a process: who gets told, what gets checked, how fast. Samsung's pattern (cap the damage immediately, then fix the policy) is a reasonable model even at a much smaller scale.
5. Put a review date on it. Six months, in the calendar, not "whenever we remember." The tools and the risks both move fast enough that a policy from last year is closer to no policy than people think.
The 30-minute rollout
Writing the page is the easy half. The rule that actually changes behaviour is making sure everyone's seen it.
- Draft the page using the five rules above — fill in your own tool list and owner name. Thirty minutes, including the coffee you'll need.
- Send it in one message, not buried in a handbook update nobody opens. A short email or a pinned Slack post with the one page attached.
- Walk through it live in the next team meeting, five minutes, including the "why" — the Samsung story works well here, because it's a company people recognise making an ordinary mistake, not a scare story about hackers.
- Add it to onboarding for every new hire from this point on, so it stops being a one-off announcement and becomes how the company works.
- Put the review date in a shared calendar right now, while you're thinking about it, because nobody revisits a policy they didn't schedule a reason to revisit.
None of that needs a lawyer or a software purchase. It needs someone to decide, this week, that "later" has arrived.
Where a page stops being enough
Be honest about the limits. A one-page policy is a floor, not a ceiling, and for some companies it genuinely isn't enough on its own:
- Regulated data (health records, payment data, anything under sector-specific rules) needs technical controls, not just a written rule — a determined or careless employee can still paste something they shouldn't, policy or not.
- A policy with no enforcement is a suggestion. If your business tools support it, blocking known public chatbots on the corporate network for anyone handling regulated data is a stronger backstop than a PDF.
- "Approved tools" needs someone to actually vet them — a tool going on the approved list because it's convenient, without anyone checking its data-handling terms, defeats the point of having a list at all.
If any of that describes you, the one-pager is still the right first step — it's just not the last one. A short, practical AI policy, actually enforced, is the kind of guardrail we build in as part of AI agents and assistants work for SME clients: useful tools, on a leash someone actually checked.
Don't know whether your business is already quietly exposed, or ready to use AI properly instead of accidentally? The free Digital Readiness Scorecard takes three minutes and flags gaps like this one before they turn into a story someone writes about you.
Founder & Chief Unicorn Officer at VEONIO. Leads every engagement personally. Still can’t say no to a good idea.