Somewhere in your business, someone has probably pasted a customer’s email into an AI chat assistant to get a better reply, or asked one to tidy up a spreadsheet of client details. They were trying to save time, not break a rule. The problem is that without a rule, nobody knows where the line is, and the business cannot see what is leaving it. An AI acceptable use policy fixes that in a page. This guide explains what to include, what to ban, how POPIA fits in, how to roll a policy out without a fight, and a builder that writes a first draft for your business in a minute. IT-Support-SA provides IT support and AI integration from Pietermaritzburg for businesses across KwaZulu-Natal and the rest of South Africa.
The Short Answer
A good AI policy fits on one page and says six things: which tools are approved (business accounts only), what must never go into them (personal information, passwords, confidential documents), that a person checks everything AI produces before it is used, that AI never makes a significant decision about a person on its own, how to tell customers when they are dealing with AI, and who to tell when something goes wrong. Make the approved tools easy to use, explain the reasons in plain words, and review the policy every year.
Why Every Business Needs One Now
Three things have changed:
- AI is already in the building. Chat assistants, built-in features in email and office software, meeting recorders and design tools are a click away. Staff use them whether or not you have said they can, which is sometimes called shadow AI.
- The information is valuable. Customer details, quotes, contracts and financial figures are exactly what ends up pasted into a prompt, and the business loses control of where it goes.
- Others are asking. Clients, tender processes and insurers increasingly want to know how you control AI use. A written policy is a straight answer. See our guide to what cyber insurers ask small businesses to have in place.
What Can Go Wrong Without a Policy
- Personal information leaves the business. A customer’s name, number and account details typed into a tool the business has not checked. Under POPIA that can be a security and compliance problem.
- Confidential material leaks. Draft pricing, a tender response or an unpublished financial result in a tool with unknown data handling.
- Confident mistakes reach customers. AI invents figures, names and references. A quote, a policy summary or a legal-sounding paragraph goes out unchecked.
- Bad decisions get automated. A refund, a credit limit or a shortlist decided by a tool with nobody accountable.
- Customers feel misled. They discover they were talking to a machine, or that their message was run through one, and nobody told them.
- Nobody knows what happened. When something goes wrong, there is no record of which tool was used, by whom, for what.
What a Good AI Policy Contains
1. Purpose and scope
Who it applies to (employees, contractors, temps), on which devices, and why it exists: to protect customers’ personal information, confidential business information and the quality of the work, while letting people use AI where it helps.
2. Approved tools
A short, named list. The key rule is business accounts only. A personal free account sits outside anything you can secure, monitor or switch off when someone leaves. Anything not on the list needs approval first. Different tools handle your data differently, and their terms change, so the person who owns the policy should read the current terms for each tool before approving it.
3. What never goes in
The most important section, and the one to make concrete:
- Personal information about customers, patients, clients or staff: names with contact details, ID numbers, account numbers, medical or financial details.
- Passwords, access keys and security codes.
- Unpublished financial results, unreleased pricing, contracts and tender documents.
- Anything given to you in confidence.
If a task needs that kind of information, do it without AI, or ask for an approved way to do it.
4. Check everything AI produces
AI can be confident and wrong. The person who uses the output is responsible for it. Say when a human must check: always, or at least before anything goes to a customer, is published or is used to make a decision. And say that AI is a drafting aid, not a source of medical, legal, tax or financial advice.
5. Decisions about people
AI must not be the only basis for a decision that significantly affects someone: refusing credit, a refund, a job, a service. A person makes the decision and answers for it. This is also what POPIA’s rule on automated decision-making is about.
6. Customers and AI
If a customer is dealing with AI, tell them plainly and make it easy to reach a person. If you run a customer-facing chatbot or automated replies, say who approves it, what it may answer from, when it hands over to a person and that it keeps a record. Our guide to connecting AI to WhatsApp, email and your business systems explains what a safe set-up looks like.
7. Security and privacy
Use only company accounts with multi-factor authentication on, do not install AI extensions or plug-ins without approval, and do not feed customer lists, databases or recordings into a tool unless it has been approved for that. See our multi-factor authentication guide.
8. Mistakes, questions and review
Who to tell if something is pasted by mistake (and that prompt honest reporting is better than hiding it), who owns the policy and answers questions, what happens if the policy is broken, and a promise to review it at least once a year.
Build Your Policy
Type your business name, choose the tools you want to allow and answer a few questions about checking and customers. The policy rewrites itself as you go, and you can copy it into a document.
The start-up selection describes a typical small business that allows a chat assistant and Microsoft Copilot, checks AI work before it goes to customers and tells customers when they deal with AI. Tick the chatbot option and a section appears covering customer-facing AI. Remove every tool and the policy says that none is approved yet. Treat the result as a first draft: read it, adjust it to how your business really works and have it checked against your own contracts and any rules that apply to your sector.
Notes on Specific Kinds of Tool
- Chat assistants. Insist on business accounts. Read the provider’s current terms on how your inputs are handled, and check the settings that control it.
- Microsoft Copilot and similar tools built into office software. They can surface whatever the user already has permission to see, so if permissions on files and mailboxes are loose, the tool will show it up. Tidy access first. Our comparison of Microsoft 365 Business Premium and Standard covers the security tools that help.
- AI features inside apps you already use. They are easy to miss. Ask what each one does with your data before switching it on.
- Image and video generators. Fine for marketing material, but do not depict real customers, patients or staff without their written permission.
- Meeting recorders and AI note-takers. Tell everyone, and get agreement from external participants before you record or transcribe.
Examples Staff Can Remember
Concrete examples work better than clauses. A short quick-reference card might say:
Fine
- Asking AI to improve the wording of a general email that contains no customer details.
- Brainstorming ideas for a social media post.
- Summarising a public article.
- Drafting a template that a person will fill in and check.
Ask first
- Using an AI feature in a tool you have not used before.
- Anything involving a client’s documents, even with the names removed.
- Using AI output as the basis of a quote or report.
Never
- Pasting a customer’s details, ID number or account number into an AI tool.
- Entering a password or access key.
- Sending AI-written advice to a customer without reading and checking it.
- Letting AI decide a refund, a credit limit or a job application.
POPIA and AI Policies
A policy supports your POPIA duties, it does not replace them. In general terms: you must secure the personal information you hold (Section 19), personal information should only be used for the purpose it was collected for, sending it outside South Africa has conditions, for example when an AI provider processes it abroad (Section 72), important decisions about people must not rest purely on automated processing (Section 71), marketing messages need consent (Section 69), and a possible compromise of personal information must be reported to the Information Regulator and the people affected as soon as reasonably possible (Section 22). Our POPIA IT compliance checklist covers the technical measures, and our guide to what to automate with AI first goes through POPIA and AI in more detail. This is general information, not legal advice.
Rolling It Out Without a Fight
- Explain why in two sentences. “We are protecting customer information and avoiding embarrassing mistakes. We are not trying to stop you using AI.”
- Make the approved tools good. If the sanctioned option is slow or awkward, people will go around it.
- Run a short session. Fifteen to twenty minutes, with the examples above, and time for questions.
- Get it acknowledged. A signature or a reply to an email, kept on file, especially for new starters. Our IT offboarding checklist covers the leaver end of the same process.
- Give people a way to ask. A named person and a quick answer beat silence.
- Review it. The tools and the law change quickly. Put a date in the diary.
- Look at what is actually in use. Check the apps and extensions connected to your accounts, and ask the team, without blame, what they are using.
How IT-Support-SA Can Help
We can help you put a policy into practice: setting up business accounts and approved tools, getting Microsoft 365 and Copilot ready (permissions, sensitivity and security settings), turning on multi-factor authentication, checking what AI apps are connected to your accounts, running a short staff session and, if you want AI answering customers, building it safely through our AI integration service. If you would like a plain review of how AI is being used in your business and where the risks are, contact IT-Support-SA or WhatsApp us on 069 560 0708. We support businesses across Pietermaritzburg, the KZN Midlands, Durban, Ladysmith, Johannesburg, Cape Town and all 9 provinces of South Africa.
Mistakes That Make an AI Policy Useless
- A ban that nobody follows. People will use AI anyway, so give them a safe way to do it.
- A fifteen-page policy that nobody reads. One page, in plain words.
- No named owner, so nobody can answer a question.
- Allowing personal accounts.
- Never checking what is in use.
- Vague rules, such as “use AI responsibly”, with no examples.
- No customer rule, so a chatbot goes live with nobody accountable.
- Writing it once and forgetting it.
- Treating the policy as the whole answer without the security controls underneath it.
Conclusion
You do not need a long document to get AI under control. You need a page that says which tools are approved, what never goes in, that people check what comes out, that AI does not decide things about people on its own, how customers are told and who to tell when something slips. Build the first draft with the tool above, adapt it to your business, explain it in plain words, make the approved tools easy and review it every year.
If you would like help putting it in place, or a plain look at how AI is being used in your business, contact IT-Support-SA or WhatsApp us.