AI Acceptable Use Policy: Stop Pretending Your Team Isn't Using ChatGPT
Posted: May 21, 2026 to Cybersecurity.
The conversation owners aren't having out loud
Every owner I talk to in the Triangle this year wants to know the same two things about generative AI. First: is my team using it? Second: am I going to get burned because of it?
The answer to the first question is yes. Industry surveys throughout 2025 put the share of employees using a personal AI account on a work device somewhere between 50 and 70 percent. In professional services it is higher. If you run a small or mid-sized business in North Carolina and you have not heard about an AI tool in your company in the last six months, the most likely explanation is not that nobody is using one. It is that nobody is telling you.
The answer to the second question is: it depends on whether you have a written AI acceptable use policy that the team has signed, and whether the policy actually reflects how AI works in 2026 rather than how it worked in 2022.
Most don't. That's the problem. And it is fixable in a single afternoon.
A scenario worth thinking about
Let me describe a hypothetical that is built from real patterns we have seen, with the identifying details removed.
A mid-sized professional services firm in the Triangle, around 30 employees, healthy revenue, growing client base. One of the firm's account managers, end of the day on a Tuesday, behind on a client status email. She opens ChatGPT in a personal browser tab on her work laptop. She pastes the firm's full client roster (names, contact information, current engagement notes) into the chat box and asks for help summarizing the week's activity into a professional update to each client.
The AI does an excellent job. She sends the emails. She closes the laptop and goes home.
Now think about what just happened from the owner's chair.
That roster sat in a personal ChatGPT account, in a session whose data retention is governed by the vendor's consumer terms of service, on infrastructure outside the firm's control. The fact that an employee's personal account holds a copy of confidential client data triggers a series of legal and contractual questions that the firm did not know it needed to answer. If any of those clients are subject to GLBA, HIPAA, or a state privacy regime, the firm now has a written-disclosure obligation it doesn't know about. If any client contracts include vendor confidentiality language with disclosure-notice clauses, the same is true. If the firm carries cyber insurance with a "do you have an AI policy" question on the application, the answer "no" now also has to be paired with a "yes, an incident occurred" if the policy renews and the question gets re-asked.
The employee did nothing malicious. She was trying to do her job well, under time pressure, using a tool that everyone she knows uses. The owner had never told her not to. There was no policy. There was no list of approved tools. There was no acknowledgment form to remind her that pasting a client roster into a free ChatGPT account was different from pasting it into the firm's Microsoft 365 account.
This is the shape of the modern AI exposure. It is not a hacker. It is not malware. It is an employee with good intent and no policy.
Why most owners haven't written one yet
I hear the same three reasons.
First, "the rules are changing too fast to commit to anything." The argument is that an AI policy written today will be wrong six months from now, so why write one. The argument is wrong. The mechanics of AI tools are moving fast, but the principles that matter for SMB governance are stable: classify your data, name the tools your business has authorized, require disclosure in certain situations, run an incident reporting process, and get a signature. That is the document. It is durable. The vendor names and version numbers change. The structure does not.
Second, "we don't have time to do it right." The good news here is that "doing it right" for a 30-person firm is a one-afternoon exercise if you start from a template, not a five-month consulting engagement. A working template gets you to a signed, defensible policy by end-of-day Friday.
Third, "we don't want to look heavy-handed." This one is the most interesting. Owners are worried that putting an AI policy in place sends the message "we don't trust you." In practice, the opposite happens. Employees we have talked to during AUP rollouts almost universally say they are relieved. They wanted to know what was okay. They had been guessing.
The framing your policy needs to do
The single biggest mistake in most AI policy templates is treating AI as one category. There are two paths, and a good policy names both.
Path 1: public, cloud-hosted AI. ChatGPT, Microsoft Copilot, Google Gemini, Claude on Anthropic's site. These are remarkable tools and they are not going away. The policy question for Path 1 tools is which categories of data are allowed in, under what contractual terms, with what monitoring. The default for any business with regulated data should be: free consumer tier is prohibited for anything beyond Public-class data; enterprise tier with a no-training agreement is allowed for Internal and Confidential data; nothing in Path 1 ever touches Regulated data.
Path 2: private, in-house AI. A model that runs on your network, on your data, under your governance. No prompts leave the boundary. No outputs become training data for someone else. We design and operate these for North Carolina businesses that need to use AI on data they can't put into a public tool: defense contractors with CUI, healthcare practices with PHI, financial firms with GLBA-covered records, law firms with privileged material. The tooling has matured enormously in 2025 and 2026. What used to be a research-lab capability is now a production-grade option for SMBs. A real policy names Path 2 as the answer for the data classes Path 1 can't handle.
A policy that only addresses Path 1 is a half-measure. It tells employees what they can't do without telling the business what it can do. The good template addresses both.
What "doing it right" actually looks like
The minimum viable AI Acceptable Use Policy has 13 sections. Executive summary. Definitions (public AI, in-house AI, enterprise AI, prompt, output, training data, shadow AI). Scope. Permitted use with named examples. Prohibited use with named examples. Data handling rules with a classification matrix. Account and access rules. Disclosure requirements. IP and confidentiality language. Incident reporting. Enforcement (graduated, not all-or-nothing). Employee acknowledgment form. Customization checklist.
That's it. Thirteen sections, fifteen to twenty pages, fillable in an afternoon. We have published a template that covers all of them, written for a North Carolina SMB owner who has to make this real this quarter, not "someday."
Download the AI Acceptable Use Policy Template
What changes the day after the policy is signed
The single most important thing changes immediately: shadow AI becomes visible. The day the policy is signed, employees know which tools they are supposed to use, which tools they are not, and what to do when they realize they made a mistake. The incident reporting block in Section 10 starts producing reports within the first two weeks of every rollout we have done. Those reports are not bad news. They are the entire point. You can't fix what you can't see.
The second thing that changes is contractual posture. When a regulated client asks "do you have an AI use policy" on their next vendor questionnaire, the answer is yes, here it is. When the cyber insurance renewal hits, the answer is yes, dated, signed, version controlled. When a CMMC assessor asks about information handling, the policy and the signed acknowledgments are the evidence.
The third thing that changes is harder to measure but real: the team's relationship with AI tools shifts from anxious to deliberate. People who were quietly using ChatGPT on the side now have a corporate-licensed enterprise account they can use openly. People who needed to handle Regulated data and were avoiding AI entirely now have a sanctioned path through the in-house tool. The shadow shrinks, the productive use grows.
If you remember nothing else
Three things to take away.
- Your team is already using AI. The policy is not about whether to allow it. It is about which categories of data go to which class of tool, under what authorization, with what disclosure.
- A real policy names both paths: public cloud AI and private in-house AI. A policy that pretends Path 2 doesn't exist will leave the regulated-data category unsolved.
- This is a one-afternoon problem if you start from a template. It is a six-month problem if you start from a blank document.
What to do this week
If you want the working template we use with our clients, the download is here. Free, no obligation, ungated mostly because we'd rather have the right SMBs in the Triangle on a real policy than chase email addresses.
Get the AI Acceptable Use Policy Template
If you want to talk to a Registered Practitioner about how to adopt it properly, including how to scope an in-house AI tool for the data categories Path 1 won't handle, call Penny at (919) 348-4912. Penny is our AI scheduler. She will book your free 15-minute call with one of our CMMC-RP experts. You can also book Blake Rea directly at book.petronella.ai/blake.
An AUP is not the entire AI conversation. But it is the single document that makes the rest of the conversation defensible.
About the author
Craig Petronella is the founder of Petronella Technology Group, Inc., a Raleigh NC cybersecurity firm serving North Carolina businesses since 2002. He is CMMC-RP credentialed and leads a 4-person CMMC-RP team operating as Registered Practitioner Organization #1449.
