My staff are using ChatGPT at work: what should a small business owner do?

If your staff are using ChatGPT at work, don't ban it: bring it in. Give them a business account you control, a short rule about what never goes in, and a one page policy. The real risk is not AI itself but personal accounts you cannot see, holding your clients' details.

This guide is for UK owners of small teams. It is general guidance, not legal or employment advice.

Should you ban ChatGPT at work?

A ban rarely works in a small business: the tool is free, on everyone's phone and genuinely useful. Staff who find it saves them an hour will keep using it, just less openly.

You lose sight of what goes in, and the people trying hardest to work faster feel they are breaking a rule. Bringing your own AI to work is already common. Microsoft and LinkedIn's 2024 Work Trend Index found that 78% of people using AI at work bring their own tools, rising to 80% in small and medium sized companies.

What is the actual risk when staff use personal accounts?

The risk is that client and business information sits in accounts the business does not own. On a personal ChatGPT account there is no data processing agreement with your business, and conversations can be used to train models unless the person has switched that off.

Under UK GDPR you stay responsible for client personal data your team puts into any tool. My guide on whether it is safe to put client data into ChatGPT explains what that means in plain English.

What should you do first?

Start with a conversation, not a policy. Ask the team what they use, what for, and on which account. You will learn which jobs AI already helps with.

Make it clear nobody is in trouble. The aim is to move good habits onto a safe footing.

Which account should the team move to?

Move everyone onto one business plan in one tool. For a team already using ChatGPT, that is usually ChatGPT Business, at £15 a seat a month billed annually or £18 billed monthly, for teams of two or more. OpenAI says it does not train on your business data by default.

Check what you already pay for first: Microsoft 365 business plans include Copilot Chat, and Google Workspace business plans include Gemini. My guides on which ChatGPT plan a small UK team should use and choosing between Microsoft Copilot, ChatGPT and Claude set out the options and prices.

At £15 an hour, the honest cost of delegating admin, a seat at that price pays for itself if it gives someone back one hour a month.

A note on dates: AI plans, plan names, prices and data terms change often. The details in this guide were checked on 10th November 2026. If you are reading this later, check the vendor's own pages before you buy.

What should a short AI rule say?

A short rule says what is fine, what never goes in, and who to ask. If it does not fit on one screen, nobody will remember it.

Something like: "Use AI for drafts, summaries and ideas, on the business account only. Take out client names unless the task needs them. Never put in health details, bank or card details, or passwords. A person reads anything before it goes to a client. If unsure, ask."

A one page AI policy you can copy

This policy is a starting point for a team of three to twelve. Change the names and tools, and review it every six months.

[Business name]: how we use AI tools

1. Which tools. We use [tool and plan] on our business account. Don't use personal or free AI accounts for work.
2. Who looks after it. [Name] manages accounts, adds and removes people, and answers questions.
3. What is fine. Drafting emails, quotes and documents; summarising notes; brainstorming; checking spelling and tone.
4. What never goes in. Health information and other special category data; bank details, card numbers and passwords typed into a chat; anything a client told us in confidence; whole client files when a summary would do.
5. Connecting tools. If an AI tool needs access to another system, [Name] sets it up through the official connection. Nobody shares their own login.
6. Checking. A person reads and corrects anything AI helped write before it leaves the business. AI can state wrong things confidently.
7. Clients. Our privacy notice says we use AI tools to help with our work. If a client asks us not to, we don't.
8. Questions and mistakes. If something goes in that shouldn't have, tell [Name] the same day. No blame; we just need to know.

Rule 5 is deliberate: passwords stay out of ordinary chats, but connecting an AI assistant to a tool through its official connection or a secure password store is fine.

Acas, the workplace advice service, recommends a clear policy on how AI is used at work, and talking to staff before you bring AI in. Whether the policy should sit in your staff handbook or be referenced in contracts is a question for an employment adviser.

Should you monitor what staff put into AI?

Monitoring is rarely the answer in a small team, and it brings its own data protection duties. The ICO's guidance on monitoring workers says you must tell staff about any monitoring, be clear about why you are doing it, and choose the least intrusive way. The ICO says that guidance is under review following the Data (Use and Access) Act.

A business plan already gives you sensible oversight: who has a seat, and work that stays with the business.

Who is this for, and who is it not for?

This guide is for owners of businesses with three to twelve people who know, or suspect, that staff use ChatGPT or similar tools at work. It assumes no technical or legal background.

It is not for larger organisations with HR and legal teams, or for regulated firms such as solicitors, accountants or financial advisers, who should follow their regulator's guidance. It is not legal or employment advice.

What should you do next?

Have the conversation this week, pick one business account, and copy the policy. Then choose one task the team already uses AI for and do it properly.

If you want help picking that task, the free Mini Assessment is a ten minute call with Danni, our AI business analyst, then a fifteen minute call where I hand you one fix.